• WIN32 挂起创建进程 CREATE_SUSPENDED


    #include "stdafx.h"
    #include <WINDOWS.H>
    
    int main(int argc, char* argv[])
    {
        
        SECURITY_ATTRIBUTES sa_p;
        sa_p.nLength = sizeof(sa_p);
        sa_p.lpSecurityDescriptor = NULL;
        sa_p.bInheritHandle = TRUE;
        
        SECURITY_ATTRIBUTES sa_t;
        sa_t.nLength = sizeof(sa_t);
        sa_t.lpSecurityDescriptor = NULL;
        sa_t.bInheritHandle = TRUE;
        
        STARTUPINFOA si;
        PROCESS_INFORMATION pi;
        ZeroMemory(&si, sizeof(si));
        si.cb = sizeof(si);
        ZeroMemory(&pi, sizeof(pi));
        
        //si.dwFlags = STARTF_USESHOWWINDOW;  // 指定wShowWindow成员有效
        //si.wShowWindow = TRUE;          // 此成员设为TRUE的话则显示新建进程的主窗口,
        
        char s1[50] = {0};
        char s2[255] = {0};
        char szBuffer[256] = {0};
        //TCHAR stcAppName[] = TEXT("C://Program Files//Internet Explorer//iexplore.exe");
        TCHAR stcAppName[] = TEXT("C:\\Windows\\SysWOW64\\notepad.exe");
    
        BOOL res1 = CreateProcess(NULL,stcAppName,&sa_p,&sa_t,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);
        if (!res1)
        {
            DWORD dwcode = GetLastError();
            printf("%x\n",dwcode);
        }
        //打印入口值
        CONTEXT contx;
        contx.ContextFlags = CONTEXT_FULL;
        int    code = GetThreadContext(pi.hThread,&contx);    
        printf("入口点:%x\n",contx.Eax);
    
        //获取ImageBase
        char* baseAddress = (CHAR *) contx.Ebx+8;                                
        memset(szBuffer,0,256);                                
        ReadProcessMemory(pi.hProcess,baseAddress,szBuffer,4,NULL);    
    
        ResumeThread(pi.hThread);
        
        getchar();
        printf("Hello World!\n");
        return 0;
    }
  • 相关阅读:
    SPLAY,LCT学习笔记(五)
    SPLAY,LCT学习笔记(四)
    SPLAY,LCT学习笔记(三)
    NOI 2012 随机数生成器
    SPLAY,LCT学习笔记(二)
    SPLAY,LCT学习笔记(一)
    bzoj 1503 郁闷的出纳员
    bzoj 1112 poi 2008 砖块
    bzoj 1064 noi2008 假面舞会题解
    数论知识点总结(noip范围)
  • 原文地址:https://www.cnblogs.com/ganxiang/p/13221964.html
Copyright © 2020-2023  润新知