|
1.点击注入按钮：调用InitEGWork函数完成创建事件
2. CreateThread(NULL,NULL,CreateRemoteThreadProc,NULL,0,0);
创建线程完成将注入代码写入到被注入进程中，并执行注入代码
3.注入到被注入进程的代码为
DWORD WINAPI RemoteThread(void *lpParameter)
{
ThreadParam_t *ThreadParamp;
DWORD Id;
DWORD dwWaitResult;
HANDLE hMapFile;
IoEvnet_t IoEvnet;
MapFile_t *MapFilep;
VOID (__stdcall *LocalSleep)(DWORD dwMilliseconds);
BOOL (__stdcall *LocalSetEvent)(HANDLE hEvent);
DWORD (__stdcall *LocalWaitForSingleObject)(HANDLE hHandle,DWORD dwMilliseconds);
//--------------------------------------------------------
ThreadParamp = (ThreadParam_t*)lpParameter;
ThreadParamp->ok = 1;
LocalSleep = ThreadParamp->Sleep;
LocalSetEvent = ThreadParamp->SetEvent;
LocalWaitForSingleObject = ThreadParamp->WaitForSingleObject;
Id = 0;
dwWaitResult = 0;
IoEvnet.InEvent = ThreadParamp->OpenEventA(EVENT_ALL_ACCESS, TRUE, ThreadParamp->EVENT_NAMEUI);
IoEvnet.OutEvent = ThreadParamp->OpenEventA(EVENT_ALL_ACCESS, TRUE, ThreadParamp->EVENT_NAMEEG);
if (IoEvnet.InEvent==NULL||
IoEvnet.OutEvent==NULL)
{
ThreadParamp->MessageBoxA(NULL,ThreadParamp->OpenIoEvnetError,ThreadParamp->Tip,MB_OK);
}
hMapFile = ThreadParamp->OpenFileMapping(FILE_MAP_ALL_ACCESS,FALSE,ThreadParamp->FILEMAP_NAME);
if (hMapFile==NULL)
{
ThreadParamp->MessageBoxA(NULL,ThreadParamp->OpenFileMapError,ThreadParamp->Tip,MB_OK);
}
IoEvnet.MapViewpBuff =(BYTE *)ThreadParamp->MapViewOfFile(hMapFile,FILE_MAP_ALL_ACCESS,0,0,MAPFILESIZE);
if (IoEvnet.MapViewpBuff==NULL)
{
ThreadParamp->MessageBoxA(NULL,ThreadParamp->MapViewOfFileError,ThreadParamp->Tip,MB_OK);
}
IoEvnet.MapViewpBuff += MAPFILEOFFSET;
MapFilep = (MapFile_t *)(IoEvnet.MapViewpBuff+8);
ThreadParamp->ok++;
//if (ThreadParamp->ThreadId==1)
{
ThreadParamp->MessageBoxA(NULL,ThreadParamp->Text,ThreadParamp->Caption,MB_OK);
}
__asm
{
jmp tcgbegin
__asm {__emit('T')} __asm {__emit('C')} __asm {__emit('G')}
__asm {__emit('B')} __asm {__emit('E')} __asm {__emit('G')} __asm {__emit('I')} __asm {__emit('N')}
tcgbegin:
}
for (;;)
{
dwWaitResult = LocalWaitForSingleObject(IoEvnet.InEvent,-1);
if (dwWaitResult==WAIT_OBJECT_0)
{
//--------------------------------------
//decode
//------------------------------------------------------------------------------------------------------------------
Id = *(DWORD*)(IoEvnet.MapViewpBuff+0);
if (Id==1)
{
//------------------------------------------------------------------------------------------------------------------
((void (*)(MapFile_t *MapFilep,ULONG* InBuffer,ULONG InLength,ULONG *OutBuffer,ULONG OutLength,ULONG *OutLengthp))(DWORD)MapFilep->PipeFunCodeBuffer)(
MapFilep,MapFilep->PipeInBuffer,MapFilep->InLength,MapFilep->PipeOutBuffer,MapFilep->OutLength,&MapFilep->OutLengthReal);
//------------------------------------------------------------------------------------------------------------------
}
//------------------------------------------------------------------------------------------------------------------
LocalSetEvent(IoEvnet.OutEvent);
//------------------------------------------------------------------------------------------------------------------
}
}
__asm
{
jmp labelmark
__asm {__emit('L')} __asm {__emit('A')} __asm {__emit('B')} __asm {__emit('E')} __asm {__emit('L')}
__asm {__emit('M')} __asm {__emit('A')} __asm {__emit('R')}
labelmark:
}
FUNLENGTHMARK
return 0;
}
4.点击Test按钮程序会把函数IoTGBTestFunction拷贝到被注入进程中并执行
|
