• WIN32 挂起创建进程 CREATE_SUSPENDED


    #include "stdafx.h"
    #include <WINDOWS.H>
    
    int main(int argc, char* argv[])
    {
        
        SECURITY_ATTRIBUTES sa_p;
        sa_p.nLength = sizeof(sa_p);
        sa_p.lpSecurityDescriptor = NULL;
        sa_p.bInheritHandle = TRUE;
        
        SECURITY_ATTRIBUTES sa_t;
        sa_t.nLength = sizeof(sa_t);
        sa_t.lpSecurityDescriptor = NULL;
        sa_t.bInheritHandle = TRUE;
        
        STARTUPINFOA si;
        PROCESS_INFORMATION pi;
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        ZeroMemory(&pi, sizeof(pi));
        
        //si.dwFlags = STARTF_USESHOWWINDOW;  // 指定wShowWindow成员有效
        //si.wShowWindow = TRUE;          // 此成员设为TRUE的话则显示新建进程的主窗口,
        
        char s1[50] = {0};
        char s2[255] = {0};
        char szBuffer[256] = {0};
        //TCHAR stcAppName[] = TEXT("C://Program Files//Internet Explorer//iexplore.exe");
        TCHAR stcAppName[] = TEXT("C:\\Windows\\SysWOW64\\notepad.exe");
    
        BOOL res1 = CreateProcess(NULL,stcAppName,&sa_p,&sa_t,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);
        if (!res1)
        {
            DWORD dwcode = GetLastError();
            printf("%x\n",dwcode);
        }
        //打印入口值
        CONTEXT contx;
        contx.ContextFlags = CONTEXT_FULL;
        int    code = GetThreadContext(pi.hThread,&contx);    
        printf("入口点:%x\n",contx.Eax);
    
        //获取ImageBase
        char* baseAddress = (CHAR *) contx.Ebx+8;                                
        memset(szBuffer,0,256);                                
        ReadProcessMemory(pi.hProcess,baseAddress,szBuffer,4,NULL);    
    
        ResumeThread(pi.hThread);
        
        getchar();
        printf("Hello World!\n");
        return 0;
    }
  • 相关阅读:
    C# BackgroundWorker使用总结
    C#如何优雅的结束一个线程
    C#线程中安全访问控件(重用委托,避免繁复的delegate,Invoke)总结
    C#异步方法调用(四大方法详解)
    C# Winform 跨线程更新UI控件常用方法汇总
    走进异步编程的世界
    走进异步编程的世界
    走进异步编程的世界
    Unity-Redis数据存储
    untiy
  • 原文地址:https://www.cnblogs.com/ganxiang/p/13221964.html
Copyright © 2020-2023  润新知