正在加载小宠物
梦回起点
做你害怕做的事,你会发现:不过如此
本站基于WordPress—主题by 设计窝 \n
冀ICP备15003737号
梦回起点
Copyright © 2015-2024 All rights reserved.

创建进程时伪造子进程的父进程ID

#include "stdafx.h"
#include "windows.h"
#include <intrin.h>

#include <TlHelp32.h>

DWORD GetProcessIDFromName(WCHAR * name)
{
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);

    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE) {
        printf("CreateToolhelp32Snapshot Error!");
        return false;
    }

    BOOL bResult = Process32First(hProcessSnap, &pe32);

    int num(0);

    while (bResult)
    {
        if (_wcsicmp(pe32.szExeFile, name) == 0)
        {
            return pe32.th32ProcessID;
        }

        bResult = Process32Next(hProcessSnap, &pe32);
    }

    CloseHandle(hProcessSnap);

    return 0;

}

int _tmain(int argc, _TCHAR* argv[])
{
    CHAR* lpExePath = "c:\\windows\\system32\\calc.exe";

    /* 根据进程名获取任意进程Id */
    DWORD  pid = GetProcessIDFromName(L"explorer.exe");//遍历进程快照获取进程ID

    if (pid == 0)
    {
        printf("Can't find process pid!\n");
        return false;
    }

    HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

    /* 创建启动信息结构体 */
    STARTUPINFOEXA si;

    /* 初始化结构体 */
    ZeroMemory(&si, sizeof(si));

    /* 设置结构体成员 */
    si.StartupInfo.cb = sizeof(si);

    SIZE_T lpsize = 0;

    /* 用微软规定的特定的函数初始化结构体 */
    InitializeProcThreadAttributeList(NULL, 1, 0, &lpsize);

    /* 转换指针到正确类型 */
    char * temp = new char[lpsize];
    LPPROC_THREAD_ATTRIBUTE_LIST AttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)temp;

    /* 真正为结构体初始化属性参数 */
    InitializeProcThreadAttributeList(AttributeList, 1, 0, &lpsize);

    /* 用已构造的属性结构体更新属性表 */
    if (!UpdateProcThreadAttribute(AttributeList, 0, PROC_THREAD_ATTRIBUTE_PARENT_PROCESS, &handle, sizeof(HANDLE), NULL, NULL))
    {
        printf("%s", "Fail to update attributes");
        return 0;
    }

    si.lpAttributeList = AttributeList;

    PROCESS_INFORMATION pi;
    ZeroMemory(&pi, sizeof(pi));
    CreateProcessAsUserA(NULL, 0, lpExePath, 0, 0, 0, EXTENDED_STARTUPINFO_PRESENT, 0, 0, (LPSTARTUPINFOA)&si, &pi);

    DeleteProcThreadAttributeList(AttributeList);
    delete[] temp;

    return 0;
}
2022-05-02
暂无评论

发表回复