请问如何HOOK住CreateRemoteThread函数？ CreateRemoteThread函数和其它的函数有什么不同之住吗？ 在线等待中... ...
如何HOOK住CreateRemoteThread函数？ CreateRemoteThread函数和其它的函数有什么不同之住吗？ 在线等待中... ... 问题点数：0、回复次数：2Top
1 楼goodheartppl（goodheart）回复于 2005-04-21 14:51:29 得分 0
CreateRemoteThread
The CreateRemoteThread function creates a thread that runs in the virtual address space of another process.
HANDLE CreateRemoteThread(
HANDLE hProcess,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
DWORD dwCreationFlags,
LPDWORD lpThreadId
);
Parameters
hProcess
[in] Handle to the process in which the thread is to be created. The handle must have the PROCESS_CREATE_THREAD, PROCESS_QUERY_INFORMATION, PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_VM_READ access rights. For more information, see Process Security and Access Rights.
lpThreadAttributes
[in] Pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and determines whether child processes can inherit the returned handle. If lpThreadAttributes is NULL, the thread gets a default security descriptor and the handle cannot be inherited. The ACLs in the default security descriptor for a thread come from the primary or impersonation token of the creator.
dwStackSize
[in] Initial size of the stack, in bytes. The system rounds this value to the nearest page. If this parameter is zero, the new thread uses the default size for the executable. For more information, see Thread Stack Size.
lpStartAddress
[in] Pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more information on the thread function, see ThreadProc.
lpParameter
[in] Pointer to a variable to be passed to the thread function.
dwCreationFlags
[in] Flags that control the creation of the thread. If the CREATE_SUSPENDED flag is specified, the thread is created in a suspended state and will not run until the ResumeThread function is called. If this value is zero, the thread runs immediately after creation.
If the STACK_SIZE_PARAM_IS_A_RESERVATION flag is specified, the dwStackSize parameter specifies the initial reserve size of the stack. Otherwise, dwStackSize specifies the commit size.
Windows 2000/NT: The STACK_SIZE_PARAM_IS_A_RESERVATION flag is not supported.
lpThreadId
[out] Pointer to a variable that receives the thread identifier.
If this parameter is NULL, the thread identifier is not returned.
Return Values
If the function succeeds, the return value is a handle to the new thread.
If the function fails, the return value is NULL. To get extended error information, call GetLastError.
Note that CreateRemoteThread may succeed even if lpStartAddress points to data, code, or is not accessible. If the start address is invalid when the thread runs, an exception occurs, and the thread terminates. Thread termination due to a invalid start address is handled as an error exit for the thread's process. This behavior is similar to the asynchronous nature of CreateProcess, where the process is created even if it refers to invalid or missing dynamic-link libraries (DLLs).
Remarks
The CreateRemoteThread function causes a new thread of execution to begin in the address space of the specified process. The thread has access to all objects opened by the process.
The new thread handle is created with full access to the new thread. If a security descriptor is not provided, the handle may be used in any function that requires a thread object handle. When a security descriptor is provided, an access check is performed on all subsequent uses of the handle before access is granted. If the access check denies access, the requesting process cannot use the handle to gain access to the thread.
The thread is created with a thread priority of THREAD_PRIORITY_NORMAL. Use the GetThreadPriority and SetThreadPriority functions to get and set the priority value of a thread.
When a thread terminates, the thread object attains a signaled state, satisfying any threads that were waiting for the object.
The thread object remains in the system until the thread has terminated and all handles to it have been closed through a call to CloseHandle.
The ExitProcess, ExitThread, CreateThread, CreateRemoteThread functions, and a process that is starting (as the result of a CreateProcess call) are serialized between each other within a process. Only one of these events can happen in an address space at a time. This means the following restrictions hold:
During process startup and DLL initialization routines, new threads can be created, but they do not begin execution until DLL initialization is done for the process.
Only one thread in a process can be in a DLL initialization or detach routine at a time.
ExitProcess does not return until no threads are in their DLL initialization or detach routines.
Terminal Services: Terminal Services isolates each terminal session by design. Therefore, CreateRemoteThread fails if the target process is in a different session than the calling process.
Requirements
Client: Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation.
Server: Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server.
Header: Declared in Winbase.h; include Windows.h.
Library: Use Kernel32.lib.
See Also
Top
2 楼vatecxp（）回复于 2005-05-24 12:31:19 得分 0
调用该API需要指定一个线程函数指针作为参数，该线程函数的原型如下： Function ThreadProc(lpParam: Pointer): DWORD，我们再来看一下LoadLibrary的函数原型： Function LoadLibrary(lpFileName: PChar): HModule。发现了吧！这两个函数原型几乎是一样的（其实返回值是否相同关系不大，因为我们是无法得到远程线程函数的返回值的），这种类似使得我们可以把直接把LoadLibrary当做线程函数来使用，从而在目标进程中加载钩子DLL。
与此类似，当我们需要卸载钩子DLL时，也可以FreeLibrary作为线程函数来使用，在目标进程中卸载钩子DLL，一切看来是十分的简洁方便。通过调用GetProcAddress函数，我们可以得到LoadLibrary函数的地址。由于LoadLibrary是Kernel32中的函数，而这个系统DLL的映射地址对每一个进程来说都是相同的，因此LoadLibrary函数的地址也是如此。这点将确保我们能把该函数的地址作为一个有效的参数传递给CreateRemoteThread使用。 FreeLibrary也是一样的。
AddrOfLoadLibrary := GetProcAddress(GetModuleHandle(‘Kernel32.dll'), ‘LoadLibrary');
HRemoteThread := CreateRemoteThread(HTargetProcess, nil, 0, AddrOfLoadLibrary, HookDllName, 0, nil);
要使用CreateRemoteThread，我们需要目标进程的句柄作为参数。当我们用OpenProcess函数来得到进程的句柄时，通常是希望对此进程有全权的存取操作，也就是以PROCESS_ALL_ACCESS为标志打开进程。但对于一些系统级的进程，直接这样显然是不行的，只能返回一个的空句柄（值为零）。为此，我们必须把自己设置为拥有调试级的特权，这样将具有最大的存取权限，从而使得我们能对这些系统级的进程也可以进行一些必要的操作。
Top
