1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
| //---------------------------------------------------------------------------
#pragma hdrstop
//---------------------------------------------------------------------------
#pragma argsused
#include "windows.h"
#include "conio.h"
#include <iostream>
#include "Tlhelp32.h"
#define MAXMODULE 50
#define FOLSE 0
#define TRUE 1
using namespace std;
void MyMessage()
{
MessageBox(0,"OK","OK",MB_OK );
return;
}
void LabelEndMyMessage(){}
BOOL GetDebugPriv(PTOKEN_PRIVILEGES ptkpPrev)
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
BOOL bRet;
ULONG ulRet;
if (!OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY | PROCESS_VM_WRITE | PROCESS_VM_OPERATION ,&hToken))
return FALSE;
bRet=LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue);
if (!bRet)
{
CloseHandle(hToken);
return bRet;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
bRet=AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),ptkpPrev,&ulRet);
CloseHandle(hToken);
return bRet;
}
HANDLE GetProcessHandle(LPSTR szExeName)
{
PROCESSENTRY32 Pc = { sizeof(PROCESSENTRY32) };
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
if(Process32First(hSnapshot, &Pc)){
do{
if(!strcmp(Pc.szExeFile, szExeName)) {
return OpenProcess(PROCESS_ALL_ACCESS, TRUE, Pc.th32ProcessID);
}
}while(Process32Next(hSnapshot, &Pc));
}
return NULL;
}
int main(int argc, _TCHAR* argv[])
{
int SizeFunc;
HANDLE HandProc;
void *AddressMemoryOfFunc, *AddressFunc;
char NameProcess[30]="test.exe" ;// название текущего приложения -впишите своё
HANDLE ThreadFunc;
if(!GetDebugPriv(0))
{
cout <<"Error GetPrivelegy" <<endl;
cout <<"Error " <<GetLastError <<endl;
return FOLSE;
}
else
{
cout <<"Get privelegy - OK" <<endl;
}
if(!(HandProc=GetProcessHandle( NameProcess ) ) )
{
cout <<"Error OpenThreadProcess" <<endl;
cout <<"Error: " <<GetLastError() <<endl;
return FOLSE;
}
else
{
cout <<"Open process " <<NameProcess << "- OK" <<endl;
}
if(!(AddressMemoryOfFunc=VirtualAllocEx(HandProc,(LPVOID)(0),
9*1024,
MEM_COMMIT,
PAGE_READWRITE)))
{
cout <<"Error VirtualAlloc" <<endl;
cout <<"Error: " <<GetLastError() <<endl;
return FOLSE;
}
asm{
mov ebx,offset MyMessage
mov eax,offset LabelEndMyMessage
sub eax,ebx
mov SizeFunc,eax};
if(!WriteProcessMemory(HandProc,AddressMemoryOfFunc, AddressFunc, SizeFunc, 0) )
{
cout<<"Error: " <<GetLastError() <<endl;
return FOLSE;
}
else
{
cout <<"Function write of process - OK" <<endl;
}
ThreadFunc=CreateRemoteThread(HandProc,0,0,(unsigned long (__stdcall*)(void*))AddressMemoryOfFunc,0,0,0);//вот тут вылетает
CloseHandle(ThreadFunc);
getch();
return 0;
}
//---------- |
(
Сообщение от Van111
