EnhanceFunc__增强函数集

想将经常用到的功能函数写在一起,花时间精心维护,然后以后就用起来就舒服很多了

目前就写了进程调试权限,远程线程注入,远程线程释放这三个函数.还有很多功能,以后慢慢加

// last code by gwsbhqt@163.com at 20150708

#pragma once

#ifndef ENHANCEFUNC_H
#define ENHANCEFUNC_H

#include <cstdio>
#include <windows.h>

using namespace std;

BOOL EnableDebugPrivileges();

HANDLE RemoteThreadInjection(HANDLE hProcess, LPCSTR lpLibFilePath, LPDWORD lpRemoteThreadId = NULL);
BOOL RemoteThreadFreeing(HANDLE hProcess, LPCSTR lpLibFilePath, DWORD dwMilliseconds = INFINITE);

#endif    //    def    ENHANCEFUNC_H

// last code by gwsbhqt@163.com at 20150708

#include "EnhanceFunc.h"

BOOL EnableDebugPrivileges()
{
    HANDLE hToken;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken))
        return FALSE;

    LUID luid = {};
    if (!LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &luid))
    {
        CloseHandle(hToken);
        return FALSE;
    }

    TOKEN_PRIVILEGES tp = {};
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL))
    {
        CloseHandle(hToken);
        return FALSE;
    }
    
    CloseHandle(hToken);
    return TRUE;
}

HANDLE RemoteThreadInjection(HANDLE hProcess, LPCSTR lpLibFilePath, LPDWORD lpRemoteThreadId)
{
    int len = strlen(lpLibFilePath) + 1;

    LPVOID lpVir = VirtualAllocEx(hProcess, NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (NULL == lpVir)
        return ERROR;

    if (!WriteProcessMemory(hProcess, lpVir, lpLibFilePath, len, NULL))
    {
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return ERROR;
    }

    HMODULE hModule = GetModuleHandleA("Kernel32.dll");
    if (NULL == hModule)
    {
        hModule = LoadLibraryA("Kernel32.dll");
        if (NULL == hModule)
        {
            VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
            return ERROR;
        }
    }

    FARPROC fpProc = GetProcAddress(hModule, "LoadLibraryA");
    if (NULL == fpProc)
    {
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return ERROR;
    }

    DWORD dwRemoteThreadId;
    HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, lpVir, NULL, &dwRemoteThreadId);
    if (NULL == hRemoteThread)
    {
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return ERROR;
    }

    if (NULL != lpRemoteThreadId)
        *lpRemoteThreadId = dwRemoteThreadId;

    FreeLibrary(hModule);
    VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
    return hRemoteThread;
}

BOOL RemoteThreadFreeing(HANDLE hProcess, LPCSTR lpLibFilePath, DWORD dwMilliseconds)
{
    int len = strlen(lpLibFilePath) + 1;

    LPVOID lpVir = VirtualAllocEx(hProcess, NULL, len, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (NULL == lpVir)
        return FALSE;

    if (!WriteProcessMemory(hProcess, lpVir, lpLibFilePath, len, NULL))
    {
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return FALSE;
    }

    HMODULE hModule = GetModuleHandleA("Kernel32.dll");
    if (NULL == hModule)
    {
        hModule = LoadLibraryA("Kernel32.dll");
        if (NULL == hModule)
        {
            VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
            return FALSE;
        }
    }

    FARPROC fpProc = GetProcAddress(hModule, "GetModuleHandleA");
    if (NULL == fpProc)
    {
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return FALSE;
    }

    HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, lpVir, NULL, NULL);
    if (NULL == hRemoteThread)
    {
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return FALSE;
    }

    if (WAIT_OBJECT_0 != WaitForSingleObject(hRemoteThread, dwMilliseconds))
    {
        CloseHandle(hRemoteThread);
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return FALSE;
    }
    
    DWORD dwExitCode;
    if (!GetExitCodeThread(hRemoteThread, &dwExitCode))    //    dwExitCode is hRemoteLibModule
    {
        CloseHandle(hRemoteThread);
        FreeLibrary(hModule);
        VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
        return FALSE;
    }

    CloseHandle(hRemoteThread);
    VirtualFreeEx(hProcess, lpVir, len, MEM_RELEASE);
    
    //    CreateRemoteThread the second times

    fpProc = GetProcAddress(hModule, "FreeLibrary");
    if (NULL == fpProc)
    {
        FreeLibrary(hModule);
        return FALSE;
    }

    hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)fpProc, (LPVOID)((HMODULE)dwExitCode), NULL, NULL);
    if (NULL == hRemoteThread)
    {
        FreeLibrary(hModule);
        return FALSE;
    }

    if (WAIT_OBJECT_0 != WaitForSingleObject(hRemoteThread, dwMilliseconds))
    {
        CloseHandle(hRemoteThread);
        FreeLibrary(hModule);
        return FALSE;
    }

    if (!GetExitCodeThread(hRemoteThread, &dwExitCode))    //    dwExitCode is the return value of Remote FreeLibrary
    {
        CloseHandle(hRemoteThread);
        FreeLibrary(hModule);
        return FALSE;
    }

    FreeLibrary(hModule);
    CloseHandle(hRemoteThread);
    return (BOOL)dwExitCode;
}

#include <cstdio>
#include <windows.h>

#include "EnhanceFunc.h"

using namespace std;

int main()
{
    char cTargetDllPath[MAX_PATH] = "C:\\DLL.dll";    //    suppose I have a dll file in this path

    printf("Enable Debug Privilege %s...\n", EnableDebugPrivileges() ? "Succeed" : "Faild");

    system("pause > nul");
    
    STARTUPINFOA si = {};
    si.cb = sizeof(si);
    PROCESS_INFORMATION pi = {};
    CreateProcessA(NULL, "C:\\Windows\\System32\\calc.exe", NULL, NULL, FALSE, NULL, NULL, NULL, &si, &pi);

    system("pause > nul");

    printf("DLL.dll Inject %s...\n", RemoteThreadInjection(pi.hProcess, cTargetDllPath) ? "Succeed" : "Faild");

    system("pause > nul");

    printf("DLL.dll Freeing %s...\n", RemoteThreadFreeing(pi.hProcess, cTargetDllPath) ? "Succeed" : "Faild");

    system("pause > nul");

    TerminateProcess(pi.hProcess, NULL);

    system("pause > nul && exit");
    return 0;
}