Windows中的父进程欺骗技术实现

#include <windows.h>
#include <iostream>
#include <tlhelp32.h>
#include <psapi.h>
#include <string>

// 通过进程名获取PID
DWORD GetProcessIdByName(const wchar_t* processName) {
    PROCESSENTRY32W pe32;
    HANDLE hSnapshot;
    DWORD pid = 0;

    // 运行时获取进程在内存中的快照
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (hSnapshot == INVALID_HANDLE_VALUE) {
        std::cerr << "Error: CreateToolhelp32Snapshot failed (" << GetLastError() << ")n";
        return 0;
    }

    pe32.dwSize = sizeof(PROCESSENTRY32W);

    if (Process32FirstW(hSnapshot, &pe32)) {
        do { // 迭代获取所需的进程
            if (wcscmp(pe32.szExeFile, processName) == 0) { // 将可执行文件名称与进程名称进行匹配
                pid = pe32.th32ProcessID; // Retriving Its PID
                break;
            }
        } while (Process32NextW(hSnapshot, &pe32));
    }

    CloseHandle(hSnapshot);
    return pid;
}

int main(void) {
    std::wcout << L"Enter the process name: "; // 获取进程名
    std::wstring targetProcessName;
    std::getline(std::wcin, targetProcessName);

    DWORD targetProcessId = GetProcessIdByName(targetProcessName.c_str());

    if (targetProcessId == 0) {
        std::cerr << "Error: Process '" << &targetProcessName << "' not foundn";
        return 1;
    }

    PROCESS_INFORMATION pi;
    STARTUPINFOW si = { sizeof(si) };

    si.cb = sizeof(STARTUPINFOW);
    si.dwFlags = STARTF_USESTDHANDLES; // 使用标准句柄
    si.hStdInput = GetStdHandle(STD_INPUT_HANDLE);
    si.hStdOutput = GetStdHandle(STD_OUTPUT_HANDLE);
    si.hStdError = GetStdHandle(STD_ERROR_HANDLE);

    // 指定记事本可执行文件的完整路径
    std::wstring notepadPath = L"C:\Windows\System32\notepad.exe";

    // 使用指定的父进程创建一个新的进程（记事本）
    if (!CreateProcessW(nullptr, const_cast<LPWSTR>(notepadPath.c_str()), nullptr, nullptr, FALSE, 0, nullptr, nullptr, &si, &pi)) {
        std::cerr << "Error: CreateProcess failed (" << GetLastError() << ")n";
        return 1;
    }

    std::wcout << L"Notepad process created successfully with PID: " << pi.dwProcessId << std::endl;
    system("pause"); // Holding Console Window

    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    
    return 0;
}