我想实现一个这样的功能，一个外部程序通过远程线程注入的方法，来调用我自己写的程序中的一个函数然后传递变量进去，简单说就是一个lua的脚本执行调试器，我写完后发现执行內镶汇编就会出错，一直找不到问题在哪里，求高人指点。。。
HANDLE hThread;
HANDLE hProcess;
void *pRemoteThread;
BOOL _attachProc(char* fileName,char* winName/* = */ )
{
if(winName == NULL || fileName == NULL)
{
return false;
}
HWND hStart = ::FindWindow(NULL,winName);
if (hStart == NULL)
{
DWORD dwError = GetLastError();
return FALSE;
}
DWORD PID,TID;
TID = ::GetWindowThreadProcessId(hStart,&PID);
BOOL bSuccess = _enableDebugPriv();
if(!bSuccess)
{
//MessageBox("Fuck _enableDebugPriv挂了 可能加了壳","玩蛋去吧");
printf_s("Fuck _enableDebugPriv挂了 可能加了壳 玩蛋去吧");
return false;
}
//打开宿主进程
hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,PID);
if(!hProcess)
{
return FALSE;
}
//分配空间
DWORD cbCodeSize = (BYTE*)AfterThreadProc - (BYTE*)ThreadProc;
DWORD codeSize = cbCodeSize;
pRemoteThread = VirtualAllocEx(hProcess,0,40,MEM_COMMIT|MEM_RESERVE,
PAGE_EXECUTE_READWRITE);
if (!pRemoteThread)
{
DWORD dw = GetLastError();
char chTemp[MAX_PATH];
sprintf_s(chTemp,"** VirtualAllocEx Error %d",dw);
printf_s(chTemp);
return FALSE;
}
if(!WriteProcessMemory(hProcess,pRemoteThread,&ThreadProc,1024,0))
{
DWORD dw = GetLastError();
char chTemp[MAX_PATH];
sprintf_s(chTemp,"** WriteProcessMemory Error %d",dw);
printf_s(chTemp);
return FALSE;
}
hThread = CreateRemoteThread(hProcess,0,0,
(LPTHREAD_START_ROUTINE)pRemoteThread,
(LPVOID)fileName,0,0);
if(!hThread)
{
DWORD dw = GetLastError();
char chTemp[MAX_PATH];
sprintf_s(chTemp,"** CreateRemoteThread Error %d",dw);
printf_s(chTemp);
return FALSE;
}
_callFunction();
return TRUE;
}
bool _enableDebugPriv()
{
HANDLE hToken; // 进程访问令牌的句柄
LUID luid; // 用于存储调试权对应的局local unique identifier
TOKEN_PRIVILEGES tkp;// 要设置的权限
BOOL bSuccess = OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY,&hToken);
if(!bSuccess)
{
//MessageBox("Fuck OpenProcessToken挂了","悲剧再次上演");
return false;
}
// 获取访问令牌
bSuccess = LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&luid);
if(!bSuccess)
{
//MessageBox("Fuck LookupPrivilegeValue挂了","悲剧再次上演");
printf_s("Fuck LookupPrivilegeValue挂了\n");
CloseHandle(hToken);
return false;
}
tkp.PrivilegeCount = 1;// 设置调试权
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
bSuccess = AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL);// 使进程拥有调试权
if(!bSuccess)
{
//MessageBox("Fuck AdjustTokenPrivileges挂了","悲剧再次上演");
printf_s("Fuck AdjustTokenPrivileges挂了\n");
CloseHandle(hToken);
return false;
}
CloseHandle(hToken);
return true;
}
void _callFunction()
{
_asm
{
PUSH fileName;
MOV EAX,0x004789E0;//此处的调用地址 我通过IDA得到的 release版 为静态函数
CALL EAX;
}
//函数原型如下
int CScriptEnvironment::DoScriptFileExternal(LPCTSTR szFileName)
我尝试将调用的函数地址替换为messagebox messagebox有弹出无错
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
