在內存中讀取函數的ShellCode并執行

下面是一個例子，實現的效果是將fun1函數的十六進制讀取出來，在內存中將str1的地址改成str2，分配一塊內存，將改好的函數的ShellCode寫入并執行。

// FunTest.cpp : 定義控制臺應用程序的入口點。 // // #include "stdafx.h" #include <windows.h>#pragma comment(lib,"user32.lib")char *str1 = "aaaa"; //字符串指針1 char *str2 = "bbbb"; //字符串指針2void fun1() {MessageBox(0,str1,0,0); }void fun2() {MessageBox(0,"2",0,0); }int _tmain(int argc, _TCHAR* argv[]) {fun1(); //調用fun1函數測試一下//獲取fun1函數的大小int iFun1Size = ((DWORD)fun2) - ((DWORD)fun1);printf("fun1 size: %d\n",iFun1Size);//獲取fun1函數的十六進制內容BYTE *pFun1Body = new BYTE [iFun1Size];memcpy(pFun1Body,&fun1,iFun1Size);for (int i=0;i<=iFun1Size;i++){printf("%x",*(pFun1Body+i));}printf("\n");//打印字符指針地址DWORD dwstrAddress1 = (DWORD)&str1;DWORD dwstrAddress2 = (DWORD)&str2;printf("Address1 %x\n",dwstrAddress1);printf("Address2 %x\n",dwstrAddress2);//判斷for (int i=0;i<(iFun1Size-4);i++){DWORD *dwPtr = (DWORD *)((BYTE *)pFun1Body + i);//找str1的地址if (*dwPtr == dwstrAddress1) {*dwPtr = (DWORD)dwstrAddress2; //替換字符串指針地址printf("dwstrAddress1 found\n");}else if (*dwPtr == dwstrAddress2){printf("dwstrAddress2 found\n");}}//分配內存PVOID pData = VirtualAlloc(NULL,iFun1Size,MEM_COMMIT,PAGE_EXECUTE_READWRITE);if(!pData){DWORD dwError = GetLastError();printf("VirtualAllocEx error %d \n",dwError);return 0;}//寫內存HANDLE h = OpenProcess(PROCESS_ALL_ACCESS,0,GetCurrentProcessId());if(!WriteProcessMemory(h,pData,pFun1Body,iFun1Size,0)){DWORD dwError = GetLastError();printf("WriteProcessMemory error %d\n",dwError);return 0;}//執行_asm{mov eax,pData;call eax}//釋放內存VirtualFree(pData,0,MEM_RELEASE);delete []pFun1Body;getchar();return 0; }

?

總結

以上是生活随笔為你收集整理的在内存中读取函数的ShellCode并执行的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。