diff --git a/ReadMe.txt b/ReadMe.txt new file mode 100644 index 0000000..70a9ba6 --- /dev/null +++ b/ReadMe.txt @@ -0,0 +1,30 @@ +======================================================================== + 控制台应用程序:ReplaceProcess 项目概述 +======================================================================== + +应用程序向导已为您创建了此 ReplaceProcess 应用程序。 + +本文件概要介绍组成 ReplaceProcess 应用程序的每个文件的内容。 + + +ReplaceProcess.vcxproj + 这是使用应用程序向导生成的 VC++ 项目的主项目文件,其中包含生成该文件的 Visual C++ 的版本信息,以及有关使用应用程序向导选择的平台、配置和项目功能的信息。 + +ReplaceProcess.vcxproj.filters + 这是使用“应用程序向导”生成的 VC++ 项目筛选器文件。它包含有关项目文件与筛选器之间的关联信息。在 IDE 中,通过这种关联,在特定节点下以分组形式显示具有相似扩展名的文件。例如,“.cpp”文件与“源文件”筛选器关联。 + +ReplaceProcess.cpp + 这是主应用程序源文件。 + +///////////////////////////////////////////////////////////////////////////// +其他标准文件: + +StdAfx.h, StdAfx.cpp + 这些文件用于生成名为 ReplaceProcess.pch 的预编译头 (PCH) 文件和名为 StdAfx.obj 的预编译类型文件。 + +///////////////////////////////////////////////////////////////////////////// +其他注释: + +应用程序向导使用“TODO:”注释来指示应添加或自定义的源代码部分。 + +///////////////////////////////////////////////////////////////////////////// diff --git a/Release/ReplaceProcess.exe b/Release/ReplaceProcess.exe new file mode 100644 index 0000000..415d664 Binary files /dev/null and b/Release/ReplaceProcess.exe differ diff --git a/ReplaceProcess.cpp b/ReplaceProcess.cpp new file mode 100644 index 0000000..9010650 --- /dev/null +++ b/ReplaceProcess.cpp @@ -0,0 +1,144 @@ +// ReplaceProcess.cpp : ̨Ӧóڵ㡣 +// + +#include "stdafx.h" +#include + + +char data[624] = { + 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x8B, 0x7D, + 0x08, 0x81, 0xE7, 0x00, 0x00, 0xFF, 0xFF, 0x66, 0x81, 0x3F, 0x4D, 0x5A, 0x75, 0x12, 0x8B, 0xF7, + 0x03, 0x76, 0x3C, 0x81, 0x3E, 0x50, 0x45, 0x00, 0x00, 0x75, 0x05, 0x89, 0x7D, 0xFC, 0xEB, 0x10, + 0x81, 0xEF, 0x00, 0x00, 0x01, 0x00, 0x81, 0xFF, 0x00, 0x00, 0x00, 0x70, 0x72, 0x02, 0xEB, 0xD7, + 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC2, 0x04, 0x00, 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7, + 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0xA1, 0x30, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x8B, + 0x40, 0x1C, 0x8B, 0x00, 0x8B, 0x40, 0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3, + 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0xA1, + 0x30, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x40, 0x1C, 0x8B, 0x00, 0x8B, 0x00, 0x8B, 0x40, + 0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, + 0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0x8B, 0x35, 0x30, 0x00, 0x00, 0x00, 0x8B, + 0x76, 0x0C, 0x8B, 0x76, 0x1C, 0x8B, 0x46, 0x08, 0x8B, 0x7E, 0x20, 0x8B, 0x36, 0x38, 0x4F, 0x18, + 0x75, 0xF3, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xC4, + 0xF8, 0x60, 0x33, 0xC9, 0x8B, 0x55, 0x0C, 0x8A, 0x02, 0x0A, 0xC0, 0x74, 0x04, 0x41, 0x42, 0xEB, + 0xF6, 0x89, 0x4D, 0xF8, 0x8B, 0x75, 0x08, 0x03, 0x76, 0x3C, 0x8B, 0x76, 0x78, 0x03, 0x75, 0x08, + 0x33, 0xD2, 0x8B, 0x5E, 0x20, 0x03, 0x5D, 0x08, 0x56, 0x8B, 0x75, 0x0C, 0x8B, 0x3B, 0x03, 0x7D, + 0x08, 0x8B, 0x4D, 0xF8, 0xF3, 0xA6, 0x75, 0x03, 0x5E, 0xEB, 0x0A, 0x5E, 0x42, 0x83, 0xC3, 0x04, + 0x3B, 0x56, 0x18, 0x72, 0xE3, 0x8B, 0x5E, 0x24, 0x03, 0x5D, 0x08, 0xB8, 0x02, 0x00, 0x00, 0x00, + 0xF7, 0xE2, 0x03, 0xD8, 0x0F, 0xB7, 0x03, 0x8B, 0x5E, 0x1C, 0x03, 0x5D, 0x08, 0xB9, 0x04, 0x00, + 0x00, 0x00, 0xF7, 0xE1, 0x03, 0xD8, 0x8B, 0x03, 0x03, 0x45, 0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B, + 0x45, 0xFC, 0xC9, 0xC2, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x75, 0x73, + 0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6F, 0x63, + 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x00, 0x4C, 0x6F, 0x61, 0x64, 0x4C, 0x69, 0x62, 0x72, + 0x61, 0x72, 0x79, 0x41, 0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x6F, 0x78, 0x41, + 0x00, 0x57, 0x65, 0x6C, 0x63, 0x6F, 0x6D, 0x65, 0x20, 0x54, 0x6F, 0x20, 0x57, 0x6F, 0x72, 0x6C, + 0x64, 0x20, 0x4F, 0x66, 0x20, 0x44, 0x65, 0x6D, 0x6F, 0x6E, 0x00, 0x44, 0x65, 0x6D, 0x6F, 0x6E, + 0x47, 0x61, 0x6E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x60, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B, 0x81, 0xEB, 0xB6, 0x11, 0x40, 0x00, 0xE8, 0xAE, 0xFE, + 0xFF, 0xFF, 0x0B, 0xC0, 0x75, 0x05, 0xE9, 0x9A, 0x00, 0x00, 0x00, 0x89, 0x83, 0x46, 0x11, 0x40, + 0x00, 0x8D, 0x83, 0x59, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3, 0x46, 0x11, 0x40, 0x00, 0xE8, 0xE8, + 0xFE, 0xFF, 0xFF, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x7C, 0x89, 0x83, 0xA4, 0x11, 0x40, 0x00, 0x8D, + 0x83, 0x68, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3, 0x46, 0x11, 0x40, 0x00, 0xFF, 0x93, 0xA4, 0x11, + 0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x5D, 0x89, 0x83, 0xA8, 0x11, 0x40, 0x00, 0x8D, 0x83, + 0x4E, 0x11, 0x40, 0x00, 0x50, 0xFF, 0x93, 0xA8, 0x11, 0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB, + 0x44, 0x89, 0x83, 0x4A, 0x11, 0x40, 0x00, 0x8D, 0x83, 0x75, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3, + 0x4A, 0x11, 0x40, 0x00, 0xFF, 0x93, 0xA4, 0x11, 0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x25, + 0x89, 0x83, 0xAC, 0x11, 0x40, 0x00, 0x8D, 0x83, 0x81, 0x11, 0x40, 0x00, 0x8D, 0x8B, 0x9B, 0x11, + 0x40, 0x00, 0x6A, 0x04, 0x51, 0x50, 0x6A, 0x00, 0xFF, 0x93, 0xAC, 0x11, 0x40, 0x00, 0x83, 0xF8, + 0x06, 0x74, 0x02, 0x61, 0xC3, 0x61, 0xE9, 0xDE, 0xC4, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00 +}; + + +void ShowError(char *lpszText) +{ + char szErr[MAX_PATH] = {0}; + ::wsprintf(szErr, "%s Error!\nError Code Is:%d\n", lpszText, ::GetLastError()); + ::MessageBox(NULL, szErr, "ERROR", MB_OK | MB_ICONERROR); +} + + +BOOL ReplaceProcess(char *lpszSrcFile) +{ + LPVOID lpDestBaseAddr = ::VirtualAllocEx(::GetCurrentProcess(), NULL, sizeof(data), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + if (NULL == lpDestBaseAddr) + { + ShowError("VirtualAllocEx"); + return FALSE; + } + ::RtlZeroMemory(lpDestBaseAddr, sizeof(data)); + ::RtlCopyMemory(lpDestBaseAddr, data, sizeof(data)); + // + STARTUPINFO stStartupInfo = {0}; + PROCESS_INFORMATION stProcessInfo = {0}; + ::RtlZeroMemory(&stStartupInfo, sizeof(stStartupInfo)); + ::RtlZeroMemory(&stProcessInfo, sizeof(stProcessInfo)); + stStartupInfo.cb = sizeof(stStartupInfo); +// stStartupInfo.dwFlags = STARTF_USESHOWWINDOW; +// stStartupInfo.wShowWindow = SW_NORMAL; + if (!::CreateProcess(lpszSrcFile, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &stStartupInfo, &stProcessInfo)) + { + ::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE); + ShowError("CreateThread"); + return FALSE; + } + + + CONTEXT stContext = { 0 }; + stContext.ContextFlags = CONTEXT_FULL; // ע˴־һҪд!!! + if (!::GetThreadContext(stProcessInfo.hThread, &stContext)) + { + ::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE); + ShowError("GetThreadContext"); + return FALSE; + } + // ȡַķ: ʱcontextеEBXָPEBָ, PEBƫ8λô˻ַ. PEB´Ľ̵ڴռҪʹReadProcessMemoryȡ + DWORD dwProcessBaseAddr = 0; + ::ReadProcessMemory(stProcessInfo.hProcess, (LPVOID)(8 + stContext.Ebx), &dwProcessBaseAddr, sizeof(dwProcessBaseAddr), NULL); + + // 滻Ľһڴ + LPVOID lpSrcBaseAddr = ::VirtualAllocEx(stProcessInfo.hProcess, NULL, sizeof(data), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + if (NULL == lpSrcBaseAddr) + { + ::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE); + + ShowError("VirtualAllocEx"); + return FALSE; + } + // д滻 + ::WriteProcessMemory(stProcessInfo.hProcess, lpSrcBaseAddr, lpDestBaseAddr, sizeof(data), NULL); + + // ޸Ľ̵PEļڵַԼӳС,ȻȡԭPEṹļػַ + stContext.Eip = (DWORD)lpSrcBaseAddr + 432; + ::SetThreadContext(stProcessInfo.hThread, &stContext); + ::ResumeThread(stProcessInfo.hThread); + // ͷ + ::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE); + return TRUE; +} + + +int _tmain(int argc, _TCHAR* argv[]) +{ + // ڴ + LPVOID lpDestBaseAddr = ::VirtualAllocEx(::GetCurrentProcess(), NULL, 1024, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + if (NULL == lpDestBaseAddr) + { + ShowError("VirtualAllocEx"); + return FALSE; + } + ::RtlCopyMemory(lpDestBaseAddr, data, sizeof(data)); +// __asm + { +// mov eax, lpDestBaseAddr +// add eax,432 +// jmp eax + } + + char szPath[MAX_PATH] = {0}; + printf("Ҫ滻̵ij·:\n"); + scanf("%s", szPath); + ReplaceProcess(szPath); + + getchar(); + return 0; +} + diff --git a/ReplaceProcess.sln b/ReplaceProcess.sln new file mode 100644 index 0000000..2a62058 --- /dev/null +++ b/ReplaceProcess.sln @@ -0,0 +1,22 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.40629.0 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ReplaceProcess", "ReplaceProcess.vcxproj", "{63E4448F-E6E9-464C-845A-38A78E6846FD}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {63E4448F-E6E9-464C-845A-38A78E6846FD}.Debug|Win32.ActiveCfg = Release|Win32 + {63E4448F-E6E9-464C-845A-38A78E6846FD}.Debug|Win32.Build.0 = Release|Win32 + {63E4448F-E6E9-464C-845A-38A78E6846FD}.Release|Win32.ActiveCfg = Release|Win32 + {63E4448F-E6E9-464C-845A-38A78E6846FD}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/ReplaceProcess.v12.suo b/ReplaceProcess.v12.suo new file mode 100644 index 0000000..fd2e6fe Binary files /dev/null and b/ReplaceProcess.v12.suo differ diff --git a/ReplaceProcess.vcxproj b/ReplaceProcess.vcxproj new file mode 100644 index 0000000..b2e4c65 --- /dev/null +++ b/ReplaceProcess.vcxproj @@ -0,0 +1,95 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + + {63E4448F-E6E9-464C-845A-38A78E6846FD} + Win32Proj + ReplaceProcess + + + + Application + true + v120 + MultiByte + + + Application + false + v120_xp + true + MultiByte + + + + + + + + + + + + + true + + + false + + + + Use + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + Use + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + + Create + Create + + + + + + \ No newline at end of file diff --git a/ReplaceProcess.vcxproj.filters b/ReplaceProcess.vcxproj.filters new file mode 100644 index 0000000..d6c9cf0 --- /dev/null +++ b/ReplaceProcess.vcxproj.filters @@ -0,0 +1,36 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + + + + 头文件 + + + 头文件 + + + + + 源文件 + + + 源文件 + + + \ No newline at end of file diff --git a/stdafx.cpp b/stdafx.cpp new file mode 100644 index 0000000..42cfa74 --- /dev/null +++ b/stdafx.cpp @@ -0,0 +1,8 @@ +// stdafx.cpp : ֻ׼ļԴļ +// ReplaceProcess.pch ΪԤͷ +// stdafx.obj ԤϢ + +#include "stdafx.h" + +// TODO: STDAFX.H +// κĸͷļڴļ diff --git a/stdafx.h b/stdafx.h new file mode 100644 index 0000000..97ac785 --- /dev/null +++ b/stdafx.h @@ -0,0 +1,15 @@ +// stdafx.h : ׼ϵͳļİļ +// Ǿʹõĵ +// ضĿİļ +// + +#pragma once + +#include "targetver.h" + +#include +#include + + + +// TODO: ڴ˴óҪͷļ diff --git a/targetver.h b/targetver.h new file mode 100644 index 0000000..aadba2f --- /dev/null +++ b/targetver.h @@ -0,0 +1,8 @@ +#pragma once + +// SDKDDKVer.h õ߰汾 Windows ƽ̨ + +// ҪΪǰ Windows ƽ̨Ӧó WinSDKVer.h +// WIN32_WINNT ΪҪֵ֧ƽ̨Ȼٰ SDKDDKVer.h + +#include