刘收获

导航

32位程序读写64位程序内存

  32位程序可以通过NtWow64ReadVirtualMemory64,NtWow64WriteVirtualMemory64读写64程序内存。

  步骤:

  1.自定义函数参数结构,获取模块中的函数指针:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
typedef NTSTATUS(NTAPI *LPFN_NTWOW64READVIRTUALMEMORY64)(
    IN  HANDLE   ProcessHandle,
    IN  ULONG64  BaseAddress,
    OUT PVOID    BufferData,
    IN  ULONG64  BufferLength,
    OUT PULONG64 ReturnLength OPTIONAL);
 
 
typedef NTSTATUS(NTAPI *LPFN_NTWOW64WRITEVIRTUALMEMORY64)(
    IN  HANDLE   ProcessHandle,
    IN  ULONG64  BaseAddress,
    OUT PVOID    BufferData,
    IN  ULONG64  BufferLength,
    OUT PULONG64 ReturnLength OPTIONAL);
 
 
NtdllModuleBase = GetModuleHandle(L"Ntdll.dll");
    if (NtdllModuleBase == NULL)
    {
        return FALSE;
    }
     
    __NtWow64ReadVirtualMemory64 = (LPFN_NTWOW64READVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,
        "NtWow64ReadVirtualMemory64");
 
    __NtWow64WriteVirtualMemory64 = (LPFN_NTWOW64WRITEVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,
        "NtWow64WriteVirtualMemory64");

  2.获取进程ID和64进程中想要读写处的地址,调用函数读写目标进程内存

1
2
3
4
5
6
7
8
9
10
11
NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle,
    BaseAddress, BufferData, BufferLength, &ReturnLength);
if (NT_SUCCESS(Status))
{
    printf("%s\r\n", BufferData);
    ZeroMemory(BufferData, BufferLength);
    memcpy(BufferData, "LIUDADA", strlen("LIUDADA"));
    __NtWow64WriteVirtualMemory64(ProcessHandle,
        BaseAddress, BufferData,  strlen("LIUDADA")+1, (PULONG64)&ReturnLength);
     
}

  

posted on   沉疴  阅读(4713)  评论(0编辑  收藏  举报

努力加载评论中...
点击右上角即可分享
微信分享提示