如何在远程线程中创建新的线程

 

如何在远程线程中创建新的线程

对待这个问题，首先要考虑一个重要因素。即远程线程已经不是原先进程中的线程，由其创建的线程，必然存在于远程线程所在的进程当中。所以应该按照对待创建远程线程这个问题一样处理。也就是说，也要为这个线程在远程进程中开辟一段内存空间。

首先，定义一个结构体，其中包含与远程线程和远程线程要创建的线程的相关项目：

typedef struct _RemoteParam{

       FARPROC             LoadLibrary;

       FARPROC             GetProcAddress;

       FARPROC             CreateThread;

       LPVOID                Injection;

       char        lpszLibFileName[16];

       char        lpszMessageBox[64];

       char        lpszTextThread1[8];

       char        lpszTextThread2[8];

}REMOTEPARAM,*PREMOTEPARAM;

 

而后，将相应API进行映射，写入相应得参数：

REMOTEPARAM RemoteParam;

ZeroMemory(&RemoteParam,sizeof(REMOTEPARAM));

hModule =LoadLibrary("kernel32.dll");

RemoteParam.LoadLibrary                         = GetProcAddress(hModule,"LoadLibraryA");

RemoteParam.GetProcAddress                   = GetProcAddress(hModule,"GetProcAddress");

RemoteParam.CreateThread                       = GetProcAddress(hModule,"CreateThread");

strcpy(RemoteParam.lpszLibFileName,"user32.dll");

strcpy(RemoteParam.lpszMessageBox,"MessageBoxA");

strcpy(RemoteParam.lpszTextThread1,"Test1");

strcpy(RemoteParam.lpszTextThread2,"Test2");

 

然后，将远程线程要创建之线程的线程函数的地址写入该结构体：

RemoteParam.Injection = (LPVOID)VirtualAllocEx(hProcess,

                                                                         0,

                                                                         4*1024,

                                                                         MEM_COMMIT|MEM_RESERVE,

                                                                         PAGE_EXECUTE_READWRITE);

WriteProcessMemory(hProcess,

                             RemoteParam.Injection,

                             &Injection,

                             4*1024,

                             0);

然后再按照创建远程线程的步骤，创建第一个远程线程：

PREMOTEPARAM pRemoteParam      =

(PREMOTEPARAM)VirtualAllocEx( hProcess,

                                                                  0,

                                                                  sizeof(REMOTEPARAM),

                                                                  MEM_COMMIT | MEM_RESERVE,

                                                                  PAGE_EXECUTE_READWRITE);

WriteProcessMemory(hProcess,

                             pRemoteParam,

                             &RemoteParam,

                             sizeof(REMOTEPARAM),

                             0)

 

PVOID pRemoteThread =VirtualAllocEx(hProcess,

                                                         0,

                                                         (SIZE_T)RemoteThreadProc/1024,

                                                         MEM_COMMIT | MEM_RESERVE,

                                                         PAGE_EXECUTE_READWRITE);

WriteProcessMemory(hProcess,

                             pRemoteThread,

                             &RemoteThreadProc,

                             (SIZE_T)RemoteThreadProc/1024,

                             0)

 

CreateRemoteThread(hProcess ,

                             NULL,

                             0,

                             (LPTHREAD_START_ROUTINE)pRemoteThread,

                             pRemoteParam,

                             0,

                             &dwThreadID);

 

在远程线程中则需要进行如下几个步骤，以创建新的线程，其中MessageBox仅仅是起到提示作用并不影响线程创建：

DWORD __stdcall RemoteThreadProc(PREMOTEPARAM lpParam)

{

       typedef  HMODULE     (WINAPI *PLoadLibraryA)(LPCTSTR);

typedef  FARPROC      (WINAPI *PGetProcAddress)(HMODULE,LPCSTR);

       typedef    int                  (WINAPI *PMessageBoxA)

(HWND hWnd,LPCTSTR,LPCTSTR,UINT);

              typedef    HANDLE (WINAPI *PCreateThread)

(LPSECURITY_ATTRIBUTES,

SIZE_T,

LPTHREAD_START_ROUTINE,

LPVOID,

DWORD,

LPDWORD);

 

       HMODULE            hUser             = NULL;

 

       PLoadLibraryA                            pLoadLibraryA;

       PGetProcAddress                        pGetProcAddress;

       PCreateThread                                   pCreateThread;

       PMessageBoxA                           pMessageBoxA;

 

       pLoadLibraryA                     = (PLoadLibraryA)lpParam->LoadLibrary;

       pGetProcAddress                 = (PGetProcAddress)lpParam->GetProcAddress;

       pCreateThread                            = (PCreateThread)lpParam->CreateThread;

      

       hUser                                  = pLoadLibraryA(lpParam->lpszLibFileName);

       pMessageBoxA                    = (PMessageBoxA)pGetProcAddress(hUser,lpParam->lpszMessageBox);

 

       pMessageBoxA(NULL,

lpParam->lpszTextThread1,

lpParam->lpszTextThread1,

MB_OK);

 

       pCreateThread(NULL,

                             0,

                             (LPTHREAD_START_ROUTINE)lpParam->Injection,

                             lpParam,

                             0,

                             NULL);

      

       return 0;

}

 

新的线程函数Injection则可以如此编写：

void Injection(PREMOTEPARAM lpParam)

{

       typedef  HMODULE     (WINAPI *PLoadLibraryA)(LPCTSTR);

typedef  FARPROC      (WINAPI *PGetProcAddress)(HMODULE,LPCSTR);

       typedef    int                  (WINAPI *PMessageBoxA)

(HWND hWnd,LPCTSTR,LPCTSTR,UINT);

 

       HMODULE            hModule         = NULL;

 

       PLoadLibraryA                            pLoadLibraryA;

       PGetProcAddress                        pGetProcAddress;

       PMessageBoxA                           pMessageBoxA;

 

       pLoadLibraryA                            = (PLoadLibraryA)lpParam->LoadLibrary;

       pGetProcAddress                        = (PGetProcAddress)lpParam->GetProcAddress;

 

       hModule                              = pLoadLibraryA(lpParam->lpszLibFileName);

       pMessageBoxA                    = (PMessageBoxA)pGetProcAddress(hModule,lpParam->lpszMessageBox);

 

       pMessageBoxA(NULL,

lpParam->lpszTextThread2,

lpParam->lpszTextThread2,

MB_OK);

}

 

（由于这些片断都是从我的程序摘抄下来并且修改过的，所以没有进过测试）

程序很简单，构思也不是很复杂，希望能跟朋友们一起分享我的这一点点经验。其他API的调用我想，也不外乎是使用类似的方法。本人水平有限，希望广大编程爱好者多加指正！