首页
社区
课程
招聘
[求助]我想学习怎么用设置上下文的方法来实现线程插入
发表于: 2007-11-17 10:42 4641

[求助]我想学习怎么用设置上下文的方法来实现线程插入

2007-11-17 10:42
4641
我想学习怎么用设置上下文的方法来实现线程插入。我有C的源码可以不知道怎样翻译成汇编 ,希望高人指点一二 。付上C源码:
;SuspendThread(hThread);
;ctx.ContextFlags = CONTEXT_CONTROL;
;GetThreadContext(hThread, &ctx);
;oldIP = ctx.Eip;
;Set the EIP of the context to the addrddess of our stub
;ctx.Eip = (DWORD)stub;
;ctx.ContextFlags = CONTEXT_CONTROL;
;Right now loadDll is code, which isn't writable.We need to change that.
;VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot);
;Patch the first push instruction
;memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4);
;Patch the 2nd push instruction
;memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4)
;Patch the mov eax, 0xDEADBEEF to mov eax, LoadLibrary
;memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4);
;WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL); ;Write the stub into the target Set the new context of the target's thread
;SetThreadContext(hThread, &ctx);
;Let the target thread continue execution, starting at our stub
;ResumeThread(hThread); ;SuspendThread(hThread);
;ctx.ContextFlags = CONTEXT_CONTROL;
;GetThreadContext(hThread, &ctx);
;oldIP = ctx.Eip;
;Set the EIP of the context to the addrddess of our stub
;ctx.Eip = (DWORD)stub;
;ctx.ContextFlags = CONTEXT_CONTROL;
;Right now loadDll is code, which isn't writable.We need to change that.
;VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot);
;Patch the first push instruction
;memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4);
;Patch the 2nd push instruction
;memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4)
;Patch the mov eax, 0xDEADBEEF to mov eax, LoadLibrary
;memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4);
;WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL); ;Write the stub into the target Set the new context of the target's thread
;SetThreadContext(hThread, &ctx);
;Let the target thread continue execution, starting at our stub
;ResumeThread(hThread);

[培训]科锐逆向工程师培训第53期2025年7月8日开班!

收藏
免费 0
支持
分享
最新回复 (5)
雪    币: 66
活跃值: (16)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
2
简单来说 就是改了下eip
2007-11-17 21:21
0
雪    币: 1852
活跃值: (504)
能力值: (RANK:1010 )
在线值:
发帖
回帖
粉丝
3
只要封一下来自远程的WriteProcessMemory,VirtualProtect就跑不了
2007-11-17 23:05
0
雪    币: 326
活跃值: (41)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
4
我是想写成汇编,由于能力有限,不知道要怎么改,能不能给出关键的代码?谢谢了。 我在用SetThreadContext时,返回的是0,也主是不成功,为什么呀?我的权限不够??
2007-11-18 07:53
0
雪    币: 1852
活跃值: (504)
能力值: (RANK:1010 )
在线值:
发帖
回帖
粉丝
5
用GetLastError取得错误值
2007-11-18 22:28
0
雪    币: 326
活跃值: (41)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
6
谢谢各位大哥,我已经会了。成功了,高兴。
2008-4-16 21:52
0
游客
登录 | 注册 方可回帖
返回