想做个简单的进程拦截 判断创建浏览器进程 是的话给他加个命令行跳到我的首页。但hook后，创建进程就闪退，感觉代码没啥问题啊，原因是什么呢？
typedef BOOL (_stdcall *MYCREATEPROCESS)( LPCTSTR lpApplicationName,
LPTSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCTSTR lpCurrentDirectory,
LPSTARTUPINFO lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation
);
//创建进程测试
void CHdllEXEDlg::OnBnClickedButton1()
{
STARTUPINFO si = { sizeof(si) };
PROCESS_INFORMATION pi;
si.dwFlags = STARTF_USESHOWWINDOW;
si.wShowWindow = TRUE; //TRUE表示显示创建的进程的窗口
TCHAR cmdline[] =TEXT("c://program files//internet explorer//iexplore.exe c6bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4G2L8h3#2#2L8X3W2@1P5g2)9J5k6h3y4K6k6r3&6Q4x3X3g2F1k6i4c8Q4x3V1j5`.");
BOOL bRet = ::CreateProcess (
NULL,
cmdline, //在Unicode版本中此参数不能为常量字符串，因为此参数会被修改
NULL,
NULL,
FALSE,
CREATE_NEW_CONSOLE,
NULL,
NULL,
&si,
&pi);
::CloseHandle (pi.hThread);
::CloseHandle (pi.hProcess);
}
//开始HOOK
void CHdllEXEDlg::OnBnClickedButton2()
{
Start();
}
DWORD jmpto=0;
typedef BOOL (_stdcall *MYCREATEPROCESS)(LPCTSTR lpApplicationName,
LPTSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCTSTR lpCurrentDirectory,
LPSTARTUPINFO lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation);
PTCHAR cmdline =TEXT("c://program files//internet explorer//iexplore.exe 2c5K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4G2L8h3#2#2L8X3W2@1P5g2)9J5k6h3y4K6k6r3c8Q4x3X3g2F1k6i4c8Q4x3V1j5`.");
__declspec(naked) BOOL HookedCreateProcess(LPCTSTR lpApplicationName,
LPTSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCTSTR lpCurrentDirectory,
LPSTARTUPINFO lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
__asm
{
push eax
push ebx
mov eax,esp
add eax,0x10
mov ebx,cmdline
mov [eax],ebx
pop ebx
pop eax
}
//cmdline=TEXT("c://program files//internet explorer//iexplore.exe 566K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4G2L8h3#2#2L8X3W2@1P5g2)9J5k6h3y4K6k6r3c8Q4x3X3g2F1k6i4c8Q4x3V1j5`.");
_asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp jmpto
}
}
void Start()
{
HMODULE hm=GetModuleHandle(L"kernel32.dll");
MYCREATEPROCESS RealCreateProcess=(MYCREATEPROCESS)GetProcAddress(hm,"CreateProcessW");
DWORD oldpro=0;
VirtualProtect(RealCreateProcess,5,PAGE_EXECUTE_READWRITE,&oldpro);
jmpto=(DWORD)RealCreateProcess+5;
DWORD value = (DWORD)HookedCreateProcess - (DWORD)RealCreateProcess - 5;
__asm
{
pushad
mov eax,RealCreateProcess
mov byte ptr[eax],0xe9
add eax,1
mov ebx,value
mov dword ptr[eax],ebx
popad
}
VirtualProtect(RealCreateProcess,5,oldpro,&oldpro);
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
