#include <iostream>
#include <windows.h>
using namespace std;
int main()
{
STARTUPINFO si = {0};
si.cb = sizeof(STARTUPINFO);
PROCESS_INFORMATION pi;
TCHAR cmdline[] = TEXT("C:\\Program Files\\Internet Explorer\\iexplore.exe");
//以挂起形式创建进程
BOOL status = CreateProcess(NULL, cmdline, NULL, NULL, FASLE, CREATE_SUSPENDED, NULL, NULL, &si, &pi);
if (status)
{
//获取创建进程的主线程 context
CONTEXT context = {0};
context.ContextFlags = CONTEXT_FULL;
GetThreadContext(pi.hThread, &context);
//获取程序入口点( ImageBase + OEP )
cout << "Entry Point(OA):" << hex << context.Eax << endl;
//从 PEB 中获取 ImageBase
CHAR* baseAddress = (CHAR*)(context.Ebx + 8);
CHAR buffer[8] = { 0 };
ReadProcessMemory(pi.hProcess, baseAddress, buffer, 4, NULL);
cout << "ImageBase:" << hex << buffer << endl;
//恢复进程(主线程)
ResumeThread(pi.hThread);
//关闭句柄
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}
return 0;
}
如上,是以挂起的形式创建的进程,但就是获取不到相应的挂起主线程的 CONTEXT 结构数据,看了好多博客都是可以这样获取的呀,难道是我最近太衰了吗,连编译器都要与我为难一番,(′д` )…彡…彡
测试环境:WIN10 + VS2019
1
co3site OP @livid 请问我这个账号什么时候才能够恢复正常,就因为之前说了一件人尽皆知的新闻吗?现在真正想发帖询问都不行了
|
2
xiofee 2019-07-19 22:12:24 +08:00
```cpp
cout << "ImageBase:" << hex << *(uint32_t*)(buffer) << endl; ``` |
4
xuddk727 2019-07-30 10:13:21 +08:00
win10 的话多半是权限问题,可 getlasterror 查看原因
|
5
v2byy 2019-08-12 17:05:40 +08:00
|