Vista 또는 Win7에서 코드 삽입이 작동하지 않습니까?

Question

그래서 두 친구가 비스타 & Win7 운영 체제에서 실행 파일을 테스트해야했습니다. 또한 주입 된 코드가 실행되지 않았지만 (관리자로 실행) 실행되지 않았지만 콘솔이 열리거나 닫히지 않았습니다. WriteProcessMemory 및 CreateRemoteThread을 통한 코드 삽입이 Vista 또는 Win7에서도 계속 작동합니까?

강령 RTCu는 비주얼 스튜디오 2008에서 Windows XP에서 후 원격 스레드가 종료 동안 충돌 과정을 방지하기 위해/사용하여 컴파일 된

.

CodeInjector.h

#ifndef CODEINJECTOR_H 
#define CODEINJECTOR_H 

typedef HANDLE(WINAPI *GETPROC)(); 
typedef HMODULE(WINAPI *PLOADLIBRARYA)(const char *dll); 
typedef LPVOID(WINAPI *PGETPROCADDRESS)(HMODULE mod, const char *func); 
typedef int (WINAPI *FNMESSAGEBOX)(HWND, LPCSTR, LPCSTR, UINT); 

typedef struct _IAT { 
    PLOADLIBRARYA pLoadLibraryA; 
    PGETPROCADDRESS pGetProcAddress; 
    FNMESSAGEBOX fnMessageBox; 
} IAT; 

typedef struct _DATA { 
    void *szData[256]; 
} DATA; 

typedef struct _FNARGS { 
    LPVOID pIat; 
    LPVOID pData; 
} FNARGS; 

#endif /* CODEINJECTOR_H */ 

CodeInjector.cpp

#include "stdafx.h" 

#include <iostream> 
#include <string> 
#include <windows.h> 

#include "CodeInjector.h" 

using namespace std; 

HANDLE getHandleByName(const char* nameWnd) 
{ 
    HWND hWnd = FindWindowA(0, nameWnd); 

    if (hWnd == 0) { 
     std::cerr << "Cannot find window" << std::endl; 
    } else { 
     DWORD pId; 
     GetWindowThreadProcessId(hWnd, &pId); 

     HANDLE hToken; 
     TOKEN_PRIVILEGES tkp; 
     if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) { 
      LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid); 
      tkp.PrivilegeCount = 1; 
      tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
      AdjustTokenPrivileges(hToken, 0, &tkp, sizeof (tkp), NULL, NULL); 
     } 

     HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pId); 

     if (!hProc) { 
      std::cerr << "Cannot open process: " << GetLastError() << std::endl; 
     } else { 
      return hProc; 
     }cout << hProc; 
     getchar(); 
    } 

    return false; 
} 

static DWORD WINAPI ThreadFunc(FNARGS *info) 
{ 
    if (info == NULL || info->pIat == NULL || info->pData == NULL) { 
     return 0; 
    } 

    IAT *iat = (IAT *)info->pIat; 
    DATA *data = (DATA *)info->pData; 

    iat->fnMessageBox(NULL, (char*)data->szData[1], (char*)data->szData[0], MB_OK); 

    return 0; 
} 

static void ThreadFuncEnd() {} 

int main(int argc, char** argv) 
{ 
    HANDLE hProc = getHandleByName("Calculator"); 

    DWORD CodeSize = (DWORD) & ThreadFuncEnd - (DWORD) & ThreadFunc; 

    IAT hIAT; 

    DWORD hLibModule; 
    HMODULE hKernel = LoadLibraryA("kernel32.dll"); 
    HMODULE hUser32 = LoadLibraryA("user32.dll"); 

    hIAT.pLoadLibraryA = (PLOADLIBRARYA)GetProcAddress(hKernel, "LoadLibraryA"); 
    hIAT.pGetProcAddress = (PGETPROCADDRESS)GetProcAddress(hKernel, "GetProcAddress"); 
    hIAT.fnMessageBox = (FNMESSAGEBOX)GetProcAddress(hUser32, "MessageBoxA"); 

    LPVOID hIATMemAddr = VirtualAllocEx(hProc, NULL, sizeof (IAT), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    WriteProcessMemory(hProc, hIATMemAddr, (LPVOID) & hIAT, sizeof (IAT), NULL); 

    DATA hData; 
    LPVOID hDataMemAddr = VirtualAllocEx(hProc, NULL, sizeof (DATA), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    hData.szData[0] = VirtualAllocEx(hProc, NULL, 64, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    hData.szData[1] = VirtualAllocEx(hProc, NULL, 64, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    hData.szData[2] = VirtualAllocEx(hProc, NULL, 64, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    hData.szData[3] = VirtualAllocEx(hProc, NULL, 64, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 

    char tmp[64]; 

    strcpy(tmp, "Caption"); 
    WriteProcessMemory(hProc, hData.szData[0], (LPVOID) & tmp, sizeof (tmp), NULL); 

    strcpy(tmp, "Message"); 
    WriteProcessMemory(hProc, hData.szData[1], (LPVOID) & tmp, sizeof (tmp), NULL); 

    WriteProcessMemory(hProc, hDataMemAddr, (LPVOID) &hData, sizeof (DATA), NULL); 

    FNARGS tInfo; 
    tInfo.pIat = hIATMemAddr; 
    tInfo.pData = hDataMemAddr; 

    LPVOID hInfoMemAddr = VirtualAllocEx(hProc, NULL, sizeof (FNARGS), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); 
    WriteProcessMemory(hProc, hInfoMemAddr, (LPVOID) & tInfo, sizeof (FNARGS), NULL); 

    LPVOID CodeMemAddr = VirtualAllocEx(hProc, NULL, CodeSize, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE); 
    WriteProcessMemory(hProc, CodeMemAddr, (LPVOID) & ThreadFunc, CodeSize, NULL); 

    HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)CodeMemAddr, hInfoMemAddr, 0, NULL); 

    WaitForSingleObject(hRemoteThread, INFINITE); 
    GetExitCodeThread(hRemoteThread, &hLibModule); 

    CloseHandle(hProc); 

    return 0; 
} 

Answer 1

별로 놀랄. Vista와 Windows 7은 보안이 강화되었습니다. 많은 악성 코드가 Code Injection을 Windows XP에서 보안 메커니즘을 우회하는 단계 중 하나로 사용했으며 Microsoft에서이를 고칠 수있어서 기쁩니다.