c++ winapi 让目标程序(target)调用当前程序(local)的函数
如果你的目标程序是x86/x64, 那么当前程序也需要编译为x84/x64
#include <iostream>
#include <string>
#include <vector>
#include <regex>
#include "GameCheatEx.h"
using namespace std;
int n = 1;
/*
extern "C" __declspec(dllexport) void __stdcall hello()
{
n++;
printf("%d\n", n);
}
*/
void __stdcall hello(uintptr_t p)
{
n++;
printf("%d\n", n);
printf("%d\n", p); // 233
}
int main()
{
GameCheatEx::GC gc{ "game2.exe" };
uintptr_t pCreateRemoteThread = GameCheatEx::GC::GetProcAddressEx(gc.hProcess, "kernel32.dll", "CreateRemoteThread");
uintptr_t pOpenProcess = GameCheatEx::GC::GetProcAddressEx(gc.hProcess, "kernel32.dll", "OpenProcess");
uintptr_t pCloseHandle = GameCheatEx::GC::GetProcAddressEx(gc.hProcess, "kernel32.dll", "CloseHandle");
uintptr_t pWaitForSingleObject = GameCheatEx::GC::GetProcAddressEx(gc.hProcess, "kernel32.dll", "WaitForSingleObject");
#ifdef _WIN64
/*
0000- 55 - push rbp
0001- 48 8B EC - mov rbp,rsp
0004- 48 83 EC 18 - sub rsp,18
0008- 48 89 4D F8 - mov [rbp-08],rcx // save regs param
// get local hProcess
000C- 48 83 EC 20 - sub rsp,20
0010- 48 B8 A0A10675F87F0000 - mov rax,KERNEL32.OpenProcess
001A- 48 B9 FFFF1F0000000000 - mov rcx,00000000001FFFFF // PROCESS_ALL_ACCESS
0024- 48 31 D2 - xor rdx,rdx
0027- 49 B8 DC48000000000000 - mov r8,00000000000048DC // lcoal pid
0031- FF D0 - call rax
0033- 48 89 45 F0 - mov [rbp-10],rax // save local hProcess
0037- 48 83 C4 20 - add rsp,20
// call CreateRemoteThread
003B- 48 83 EC 38 - sub rsp,38
003F- 48 8B C8 - mov rcx,rax
0042- 48 31 D2 - xor rdx,rdx
0045- 4D 31 C0 - xor r8,r8
0048- 49 B9 80102E86F67F0000 - mov r9,00007FF6862E1080 // lpLocalFun
0052- 48 8B 45 F8 - mov rax,[rbp-08]
0056- 48 89 44 24 20 - mov [rsp+8*4],rax // lpParam
005B- C7 44 24 28 00000000 - mov [rsp+8*5],00000000
0063- C7 44 24 30 00000000 - mov [rsp+8*6],00000000
006B- 48 B8 70590875F87F0000 - mov rax,KERNEL32.CreateRemoteThread
0075- FF D0 - call rax
0077- 48 89 45 E8 - mov [rbp-18],rax // save pThread
007B- 48 83 C4 38 - add rsp,38
// call WaitForSingleObject
007F- 48 83 EC 20 - sub rsp,20
0083- 48 B8 00200775F87F0000 - mov rax,KERNEL32.WaitForSingleObject
008D- 48 8B 4D E8 - mov rcx,[rbp-18]
0091- 48 BA FFFFFFFF00000000 - mov rdx,00000000FFFFFFFF // INFINITE
009B- FF D0 - call rax
009D- 48 83 C4 20 - add rsp,20
// close hThread and hProcess
00A1- 48 83 EC 20 - sub rsp,20
00A5- 49 BC 101E0775F87F0000 - mov r12,KERNEL32.CloseHandle
00AF- 48 8B 4D E8 - mov rcx,[rbp-18]
00B3- 41 FF D4 - call r12
00B6- 48 8B 4D F0 - mov rcx,[rbp-10]
00BA- 41 FF D4 - call r12
00BD- 48 83 C4 20 - add rsp,20
// end
00C1- 48 83 C4 18 - add rsp,18
00C5- 48 8B E5 - mov rsp,rbp
00C8- 5D - pop rbp
00C9- C3 - ret
*/
vector<BYTE> funcode = GameCheatEx::GC::byteStr2Bytes("55 48 8B EC 48 83 EC 18 48 89 4D F8 48 83 EC 20 48 B8 A0 A1 06 75 F8 7F 00 00 48 B9 FF FF 1F 00 00 00 00 00 48 31 D2 49 B8 DC 48 00 00 00 00 00 00 FF D0 48 89 45 F0 48 83 C4 20 48 83 EC 38 48 8B C8 48 31 D2 4D 31 C0 49 B9 80 10 2E 86 F6 7F 00 00 48 8B 45 F8 48 89 44 24 20 C7 44 24 28 00 00 00 00 C7 44 24 30 00 00 00 00 48 B8 70 59 08 75 F8 7F 00 00 FF D0 48 89 45 E8 48 83 C4 38 48 83 EC 20 48 B8 00 20 07 75 F8 7F 00 00 48 8B 4D E8 48 BA FF FF FF FF 00 00 00 00 FF D0 48 83 C4 20 48 83 EC 20 49 BC 10 1E 07 75 F8 7F 00 00 48 8B 4D E8 41 FF D4 48 8B 4D F0 41 FF D4 48 83 C4 20 48 83 C4 18 48 8B E5 5D C3");
*(uintptr_t*)(funcode.data() + 0x12) = (uintptr_t)pOpenProcess; // OpenProcess
*(uintptr_t*)(funcode.data() + 0x29) = (uintptr_t)GetCurrentProcessId(); // local pid
*(uintptr_t*)(funcode.data() + 0x4A) = (uintptr_t)&hello; // lpLocalFun
*(uintptr_t*)(funcode.data() + 0x6D) = (uintptr_t)pCreateRemoteThread; // CreateRemoteThread
*(uintptr_t*)(funcode.data() + 0x85) = (uintptr_t)pWaitForSingleObject; // WaitForSingleObject
*(uintptr_t*)(funcode.data() + 0xA7) = (uintptr_t)pCloseHandle; // CloseHandle
#else
/*
0000- 55 - push ebp
0001- 8B EC - mov ebp,esp
0003- 83 EC 08 - sub esp,08
// get local hProcess
0006- 68 7C230000 - push 0000237C { local pid }
000B- 6A 00 - push 00
000D- 68 FFFF1F00 - push 001FFFFF { PROCESS_ALL_ACCESS }
0012- B8 0089C776 - mov eax,KERNEL32.OpenProcess
0017- FF D0 - call eax
0019- 89 45 FC - mov [ebp-04],eax
// call CreateRemoteThread
001C- 6A 00 - push 00
001E- 6A 00 - push 00
0020- FF 75 08 - push [ebp+08] { localfun param }
0023- 68 50102100 - push 00211050 { local funAddr }
0028- 6A 00 - push 00
002A- 6A 00 - push 00
002C- FF 75 FC - push [ebp-04]
002F- B8 0041C976 - mov eax,KERNEL32.CreateRemoteThread
0034- FF D0 - call eax
0036- 89 45 F8 - mov [ebp-08],eax
// call WaitForSingleObject
0039- B8 403EC876 - mov eax,KERNEL32.WaitForSingleObject
003E- 68 FFFFFFFF - push FFFFFFFF { INFINITE }
0043- FF 75 F8 - push [ebp-08]
0046- FF D0 - call eax
// close hThread and hProcess
0048- BB 503CC876 - mov ebx,KERNEL32.CloseHandle
004D- FF 75 F8 - push [ebp-08]
0050- FF D3 - call ebx
0052- FF 75 FC - push [ebp-04]
0055- FF D3 - call ebx
0057- 83 C4 08 - add esp,08
005A- 8B E5 - mov esp,ebp
005C- 5D - pop ebp
005D- C2 0400 - ret 0004
*/
vector<BYTE> funcode = GameCheatEx::GC::byteStr2Bytes("55 8B EC 83 EC 08 68 7C 23 00 00 6A 00 68 FF FF 1F 00 B8 00 89 C7 76 FF D0 89 45 FC 6A 00 6A 00 FF 75 08 68 50 10 21 00 6A 00 6A 00 FF 75 FC B8 00 41 C9 76 FF D0 89 45 F8 B8 40 3E C8 76 68 FF FF FF FF FF 75 F8 FF D0 BB 50 3C C8 76 FF 75 F8 FF D3 FF 75 FC FF D3 83 C4 08 8B E5 5D C2 04 00");
*(uintptr_t*)(funcode.data() + 0x07) = (uintptr_t)GetCurrentProcessId(); // local pid
*(uintptr_t*)(funcode.data() + 0x13) = (uintptr_t)pOpenProcess; // OpenProcess
*(uintptr_t*)(funcode.data() + 0x24) = (uintptr_t)&hello; // lpLocalFun
*(uintptr_t*)(funcode.data() + 0x30) = (uintptr_t)pCreateRemoteThread; // CreateRemoteThread
*(uintptr_t*)(funcode.data() + 0x3A) = (uintptr_t)pWaitForSingleObject; // WaitForSingleObject
*(uintptr_t*)(funcode.data() + 0x49) = (uintptr_t)pCloseHandle; // CloseHandle
#endif // _WIN64
BYTE* newmem = (BYTE*)VirtualAllocEx(gc.hProcess, 0, funcode.size(), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
printf("newmem: %x\n", newmem);
WriteProcessMemory(gc.hProcess, newmem, funcode.data(), funcode.size(), 0);
while (true)
{
HANDLE hThread = CreateRemoteThread(gc.hProcess, 0, 0, (LPTHREAD_START_ROUTINE)newmem, (LPVOID)233, 0, 0);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);
Sleep(1000);
}
VirtualFreeEx(gc.hProcess, newmem, 0, MEM_RELEASE);
return 0;
}
