红队武器开发系列：利用 Windows 线程池 API 和 I/O 完成回调来实现代理 DLL 加载

#include <windows.h>#include <stdio.h>extern "C" void CALLBACK IoCompletionCallback(PTP_CALLBACK_INSTANCE Instance, PVOID Context, PVOID Overlapped, ULONG IoResult, ULONG_PTR NumberOfBytesTransferred, PTP_IO Io);void StartRead(HANDLE pipe, PTP_IO tpIo, OVERLAPPED* overlapped, char* buffer);void CALLBACK ClientWorkCallback(PTP_CALLBACK_INSTANCE Instance, PVOID Context, PTP_WORK Work);PVOID pLoadLibraryA;HANDLE g_WriteCompleteEvent; // 表示写操作完成的全局事件typedef struct LOAD_CONTEXT {    char* DllName;    PVOID pLoadLibraryA;};int main(){    HANDLE pipe;    PTP_IO tpIo = NULL;    OVERLAPPED overlapped = { 0 };    char buffer[128] = { 0 };    // Get the address of LoadLibraryA    pLoadLibraryA = GetProcAddress(GetModuleHandleA("kernel32"), "LoadLibraryA");    // 准备LOAD_CONTEXT结构    LOAD_CONTEXT loadContext;    loadContext.DllName = (char*)"wininet.dll";    loadContext.pLoadLibraryA = pLoadLibraryA;    // 创建一个全局事件，在写操作完成时发出信号    g_WriteCompleteEvent = CreateEvent(NULL, TRUE, FALSE, NULL);    if (g_WriteCompleteEvent == NULL) {        printf("Failed to create write complete eventn");        return 1;    }    // Create a named pipe with FILE_FLAG_OVERLAPPED flag    pipe = CreateNamedPipe(        TEXT("\\.\pipe\MyPipe"),        PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,        PIPE_TYPE_BYTE | PIPE_READMODE_BYTE | PIPE_WAIT,        1,  // Number of instances        4096,  // Out buffer size        4096,  // In buffer size        0,  // Timeout in milliseconds        NULL); // Default security attributes    if (pipe == INVALID_HANDLE_VALUE) {        printf("Failed to create named pipen");        CloseHandle(g_WriteCompleteEvent);        return 1;    }    // 为OVERLAPPED结构创建一个事件    overlapped.hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);    if (overlapped.hEvent == NULL) {        printf("Failed to create eventn");        CloseHandle(pipe);        CloseHandle(g_WriteCompleteEvent);        return 1;    }    // 将管道与线程池关联    tpIo = CreateThreadpoolIo(pipe, IoCompletionCallback, &loadContext, NULL);    if (tpIo == NULL) {        printf("Failed to associate pipe with thread pooln");        CloseHandle(overlapped.hEvent);        CloseHandle(pipe);        CloseHandle(g_WriteCompleteEvent);        return 1;    }    // 为客户端代码创建线程池工作项    PTP_WORK clientWork = CreateThreadpoolWork(ClientWorkCallback, NULL, NULL);    if (clientWork == NULL) {        printf("Failed to create threadpool work itemn");        CloseThreadpoolIo(tpIo);        CloseHandle(overlapped.hEvent);        CloseHandle(pipe);        CloseHandle(g_WriteCompleteEvent);        return 1;    }    // 将客户端工作项提交到线程池    SubmitThreadpoolWork(clientWork);    // 等待客户端工作项发出写操作完成的信号    WaitForSingleObject(g_WriteCompleteEvent, INFINITE);    //启动异步读操作    StartRead(pipe, tpIo, &overlapped, buffer);    printf("Pipe buffer: %sn", buffer);    // 等待读操作完成    WaitForSingleObject(overlapped.hEvent, INFINITE);    // Wait for client work to complete    WaitForThreadpoolWorkCallbacks(clientWork, FALSE);    CloseThreadpoolWork(clientWork);    // Cleanup    CloseThreadpoolIo(tpIo);    CloseHandle(overlapped.hEvent);    CloseHandle(pipe);    CloseHandle(g_WriteCompleteEvent);    printf("wininet.dll should be loaded! Input any key to exit...n");    getchar();    return 0;}void StartRead(HANDLE pipe, PTP_IO tpIo, OVERLAPPED* overlapped, char* buffer){    DWORD bytesRead = 0;    StartThreadpoolIo(tpIo);    if (!ReadFile(pipe, buffer, 128, &bytesRead, overlapped) && GetLastError() != ERROR_IO_PENDING) {        printf("ReadFile failed, error %lun", GetLastError());        CancelThreadpoolIo(tpIo);    }}void CALLBACK ClientWorkCallback(PTP_CALLBACK_INSTANCE Instance, PVOID Context, PTP_WORK Work){    // Open the named pipe    HANDLE pipe = CreateFile(        TEXT("\\.\pipe\MyPipe"),        GENERIC_WRITE,        0,        NULL,        OPEN_EXISTING,        FILE_ATTRIBUTE_NORMAL,        NULL);    if (pipe == INVALID_HANDLE_VALUE) {        printf("Client failed to connect to pipen");        return;    }    const char message[] = "Hello from the pipe!";    DWORD bytesWritten;    if (!WriteFile(pipe, message, sizeof(message), &bytesWritten, NULL)) {        printf("Client WriteFile failed, error: %lun", GetLastError());    }    else {        printf("Client wrote to pipen");    }    // 写操作完成的信号    SetEvent(g_WriteCompleteEvent);    CloseHandle(pipe);}

.CODE;  LOAD_CONTEXT结构作为第二个参数传递给回调。根据64位Windows调用约定，这意味着该结构将包含在rdx寄存器中。;typedef struct LOAD_CONTEXT {;    char* DllName;;   PVOID pLoadLibraryA;;};IoCompletionCallback PROC    mov rcx, [rdx]       ; DllName into RCX    mov rax, [rdx + 8]       ; RCX包含dll字符串的地址    ; RAX包含跳转到的地址（pLoadLibraryA）    xor rdx, rdx            jmp raxIoCompletionCallback ENDPEND