我想把Python代碼注入到一個(gè)進(jìn)程中，當(dāng)它注入時(shí)，它似乎會(huì)使我的進(jìn)程崩潰。我沒(méi)有在我自己的程序中得到任何錯(cuò)誤，但目標(biāo)進(jìn)程停止工作。被調(diào)用的非托管api沒(méi)有給我任何錯(cuò)誤，并且似乎已經(jīng)正確地執(zhí)行了它們的執(zhí)行。在[DllImport("kernel32")]

public static extern IntPtr CreateRemoteThread(IntPtr hProcess,IntPtr lpThreadAttributes,uint dwStackSize, IntPtr lpStartAddress,IntPtr lpParameter,uint dwCreationFlags, out uint lpThreadId);

[Flags]

enum ProcessAccessFlags : uint

{

All = 0x001F0FFF,

Terminate = 0x00000001,

CreateThread = 0x00000002,

VMOperation = 0x00000008,

VMRead = 0x00000010,

VMWrite = 0x00000020,

DupHandle = 0x00000040,

SetInformation = 0x00000200,

QueryInformation = 0x00000400,

Synchronize = 0x00100000

}

[DllImport("kernel32.dll")]

static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);

[Flags]

public enum AllocationType

{

Commit = 0x1000,

Reserve = 0x2000,

Decommit = 0x4000,

Release = 0x8000,

Reset = 0x80000,

Physical = 0x400000,

TopDown = 0x100000,

WriteWatch = 0x200000,

LargePages = 0x20000000,

VIRTUAL_MEM = (0x1000 | 0x2000)

}

[Flags]

public enum MemoryProtection

{

Execute = 0x10,

ExecuteRead = 0x20,

ExecuteReadWrite = 0x40,

ExecuteWriteCopy = 0x80,

NoAccess = 0x01,

ReadOnly = 0x02,

ReadWrite = 0x04,

WriteCopy = 0x08,

GuardModifierflag = 0x100,

NoCacheModifierflag = 0x200,

WriteCombineModifierflag = 0x400,

PAGE_EXECUTE_READWRITE = 0x00000040

}

[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]

static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);

[DllImport("kernel32.dll", SetLastError = true)]

static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);

[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]

static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);

[DllImport("kernel32", SetLastError = true, ExactSpelling = true)]

internal static extern Int32 WaitForSingleObject( IntPtr handle,Int32 milliseconds);

[DllImport("kernel32.dll")]

public static extern Int32 CloseHandle(IntPtr hObject);

private void InjectCode(string shellcode = "print('Hello, World!')")

{

foreach (Process proc in Process.GetProcesses())

{

if (proc.ProcessName == "Toontown")

{

int shellcode_length = shellcode.Length;

IntPtr h_process = OpenProcess(ProcessAccessFlags.All, false, (int)proc.Id);

IntPtr shellcode_address = (IntPtr)VirtualAllocEx(h_process, (IntPtr)0, (uint)shellcode_length, AllocationType.VIRTUAL_MEM, MemoryProtection.PAGE_EXECUTE_READWRITE);

byte[] bytes = new byte[shellcode.Length * sizeof(char)];

Buffer.BlockCopy(shellcode.ToCharArray(), 0, bytes, 0, bytes.Length);

UIntPtr bytesout;

uint t_id;

bool Written = WriteProcessMemory(h_process, shellcode_address, bytes, (uint)shellcode_length, out bytesout);

IntPtr hThread = (IntPtr)CreateRemoteThread(h_process, (IntPtr)null, 0, (IntPtr)shellcode_length, (IntPtr)shellcode_address, 0, out t_id);

int Result = WaitForSingleObject(hThread, 10 * 1000);

if (Result == 0x00000080L || Result == 0x00000102L || Result == 0xFFFFFFFF)

{

if (hThread != null)

{

CloseHandle(hThread);

}

}

Thread.Sleep(1000);

VirtualFreeEx(h_process, shellcode_address, (UIntPtr)0, 0x8000);

if (hThread != null)

{

CloseHandle(hThread);

}

}

}

}

如您所見(jiàn)，我已經(jīng)將非托管API的返回值保存到變量中，這些變量用于查看它是否正常工作，它似乎運(yùn)行良好，但它會(huì)導(dǎo)致目標(biāo)進(jìn)程崩潰，日志中沒(méi)有記錄任何與之相關(guān)的錯(cuò)誤。

托管程序能否注入非托管進(jìn)程？我投錯(cuò)變量類(lèi)型了嗎？外殼代碼是否被錯(cuò)誤地轉(zhuǎn)換成字節(jié)數(shù)組？請(qǐng)告訴我，謝謝。在

編輯：它在CreateRemoteThread崩潰

總結(jié)

以上是生活随笔為你收集整理的python注入进程_向进程中注入Python代码的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。