在內(nèi)存中讀取函數(shù)的ShellCode并執(zhí)行

下面是一個(gè)例子，實(shí)現(xiàn)的效果是將fun1函數(shù)的十六進(jìn)制讀取出來(lái)，在內(nèi)存中將str1的地址改成str2，分配一塊內(nèi)存，將改好的函數(shù)的ShellCode寫(xiě)入并執(zhí)行。

// FunTest.cpp : 定義控制臺(tái)應(yīng)用程序的入口點(diǎn)。 // // #include "stdafx.h" #include <windows.h>#pragma comment(lib,"user32.lib")char *str1 = "aaaa"; //字符串指針1 char *str2 = "bbbb"; //字符串指針2void fun1() {MessageBox(0,str1,0,0); }void fun2() {MessageBox(0,"2",0,0); }int _tmain(int argc, _TCHAR* argv[]) {fun1(); //調(diào)用fun1函數(shù)測(cè)試一下//獲取fun1函數(shù)的大小int iFun1Size = ((DWORD)fun2) - ((DWORD)fun1);printf("fun1 size: %d\n",iFun1Size);//獲取fun1函數(shù)的十六進(jìn)制內(nèi)容BYTE *pFun1Body = new BYTE [iFun1Size];memcpy(pFun1Body,&fun1,iFun1Size);for (int i=0;i<=iFun1Size;i++){printf("%x",*(pFun1Body+i));}printf("\n");//打印字符指針地址DWORD dwstrAddress1 = (DWORD)&str1;DWORD dwstrAddress2 = (DWORD)&str2;printf("Address1 %x\n",dwstrAddress1);printf("Address2 %x\n",dwstrAddress2);//判斷for (int i=0;i<(iFun1Size-4);i++){DWORD *dwPtr = (DWORD *)((BYTE *)pFun1Body + i);//找str1的地址if (*dwPtr == dwstrAddress1) {*dwPtr = (DWORD)dwstrAddress2; //替換字符串指針地址printf("dwstrAddress1 found\n");}else if (*dwPtr == dwstrAddress2){printf("dwstrAddress2 found\n");}}//分配內(nèi)存PVOID pData = VirtualAlloc(NULL,iFun1Size,MEM_COMMIT,PAGE_EXECUTE_READWRITE);if(!pData){DWORD dwError = GetLastError();printf("VirtualAllocEx error %d \n",dwError);return 0;}//寫(xiě)內(nèi)存HANDLE h = OpenProcess(PROCESS_ALL_ACCESS,0,GetCurrentProcessId());if(!WriteProcessMemory(h,pData,pFun1Body,iFun1Size,0)){DWORD dwError = GetLastError();printf("WriteProcessMemory error %d\n",dwError);return 0;}//執(zhí)行_asm{mov eax,pData;call eax}//釋放內(nèi)存VirtualFree(pData,0,MEM_RELEASE);delete []pFun1Body;getchar();return 0; }

?

總結(jié)

以上是生活随笔為你收集整理的在内存中读取函数的ShellCode并执行的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。