加载shellcode到32位Windows程序远程进程中

BOOL WINAPI LoadDll(HANDLE hProcess,LPVOID lpBuf,int cbBuf)
{

BOOL br = FALSE;

LPVOID m_lpData  = VirtualAllocEx(hProcess, NULL,cbBuf,MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (m_lpData==NULL)
{
	goto cleanup0;
}
if(!WriteProcessMemory(hProcess,m_lpData,lpBuf,cbBuf,NULL))
{
	goto cleanup0;
}

pmemloadparam param = new memloadparam;
param->data = m_lpData;	
param->len = cbBuf;
param->userdata = 0;
param->fnLoadLibrary = (pfn_LoadLibraryA)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"LoadLibraryA");
param->fnGetProcAddress = (pfn_GetProcAddress)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"GetProcAddress");
param->fnFreeLibrary = (pfn_FreeLibrary)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"FreeLibrary");
param->fnSetLastError = (pfn_SetLastError)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"SetLastError");
param->fnVirtualAlloc = (pfn_VirtualAlloc)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"VirtualAlloc");
param->fnGetProcessHeap = (pfn_GetProcessHeap)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"GetProcessHeap");
param->fnHeapAlloc = (pfn_HeapAlloc)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"HeapAlloc");
param->fnVirtualFree = (pfn_VirtualFree)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"VirtualFree");
param->fnIsBadReadPtr = (pfn_IsBadReadPtr)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"IsBadReadPtr");
param->fnVirtualProtect = (pfn_VirtualProtect)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"VirtualProtect");
param->fnHeapFree = (pfn_HeapFree)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"HeapFree");
param->fnGetNativeSystemInfo = (pfn_GetNativeSystemInfo)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"GetNativeSystemInfo");
param->fnGetCurrentProcess = (pfn_GetCurrentProcess)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"GetCurrentProcess");
param->fnWriteProcessMemory = (pfn_WriteProcessMemory)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"WriteProcessMemory");
param->fnHeapReAlloc = (pfn_HeapReAlloc)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"HeapReAlloc");
param->fnWaitForSingleObject = (pfn_WaitForSingleObject)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"WaitForSingleObject");
param->fnOpenEventA = (pfn_OpenEventA)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"OpenEventA");
param->fnCloseHandle = (pfn_CloseHandle)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"CloseHandle");
param->fnCreateEventA = (pfn_CreateEventA)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")),"CreateEventA");

LPVOID m_lpParam  = VirtualAllocEx(hProcess, NULL,sizeof(memloadparam),MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (m_lpParam==NULL)
{
	goto cleanup0;
}
if(!WriteProcessMemory(hProcess,m_lpParam,param,sizeof(memloadparam),NULL))
{
	goto cleanup0;
}

LPVOID m_lpShell  = VirtualAllocEx(hProcess, NULL,g_ThreadShellCode32_Len,MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (m_lpShell==NULL)
{
	goto cleanup0;
}
if(!WriteProcessMemory(hProcess,m_lpShell,g_ThreadShellCode32,g_ThreadShellCode32_Len,NULL))
{
	goto cleanup0;
}
HANDLE hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)m_lpShell,m_lpParam,0,NULL);
WaitForSingleObject(hThread,INFINITE);
delete param;
br = TRUE;

cleanup0:

return br;

}

BOOL _LoadMemDll(LPVOID lpBuf,int cbBuf)
{
LoadDll(GetCurrentProcess(),lpBuf,cbBuf);

标签：Windows,32,param,dll,kernel32,TEXT,GetProcAddress,pfn,shellcode
来源： https://blog.csdn.net/hailong7308/article/details/121367551