仙木同学 发表于 2024-4-23 20:36:46

易语言的这个命令谁能转成火山的

精易模块中的【程序_内存中运行EXE】
自己封装的时候被这结构体搞头疼了,实在翻不过来。
有没有大佬帮我翻成火山的，可有偿！


fengshangren 发表于 2024-4-23 21:37:37

易语言代码转火山都非常简单，你可以当作一种学习，这么简单的翻译代码都不会，以后还怎么学火山，加油

urenai 发表于 2024-4-23 22:23:52

未经测试的代码：

#include <windows.h>
#include <iostream>

// 获取PE文件头
PIMAGE_DOS_HEADER GetDosHeader(LPVOID lpBaseAddress) {
    return reinterpret_cast<PIMAGE_DOS_HEADER>(lpBaseAddress);
}

// 获取NT头
PIMAGE_NT_HEADERS GetNtHeaders(LPVOID lpBaseAddress) {
    PIMAGE_DOS_HEADER pDosHeader = GetDosHeader(lpBaseAddress);
    return reinterpret_cast<PIMAGE_NT_HEADERS>(
      reinterpret_cast<BYTE*>(pDosHeader) + pDosHeader->e_lfanew);
}

// 执行远程进程入口点
void ExecuteRemoteProcess(HANDLE hProcess, LPVOID remoteBaseAddress) {
    PIMAGE_NT_HEADERS pNtHeaders = GetNtHeaders(remoteBaseAddress);
    LPVOID entryPoint = (LPVOID)((DWORD_PTR)remoteBaseAddress + pNtHeaders->OptionalHeader.AddressOfEntryPoint);

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
      (LPTHREAD_START_ROUTINE)entryPoint, NULL, 0, NULL);
    if (hThread == NULL) {
      std::cerr << "CreateRemoteThread failed: " << GetLastError() << std::endl;
      return;
    }

    WaitForSingleObject(hThread, INFINITE);
    CloseHandle(hThread);
}

int main() {
    // 要注入的exe文件路径
    TCHAR szFilePath[] = _T("C:\\path\\to\\your\\app.exe");

    // 打开exe文件
    HANDLE hFile = CreateFile(szFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
      FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE) {
      std::cerr << "CreateFile failed: " << GetLastError() << std::endl;
      return -1;
    }

    // 获取exe文件大小
    LARGE_INTEGER fileSize;
    if (!GetFileSizeEx(hFile, &fileSize)) {
      std::cerr << "GetFileSizeEx failed: " << GetLastError() << std::endl;
      CloseHandle(hFile);
      return -1;
    }

    // 创建新进程
    PROCESS_INFORMATION pi;
    STARTUPINFO si = { sizeof(STARTUPINFO) };
    if (!CreateProcess(NULL, _T("C:\\Windows\\System32\\notepad.exe"), NULL, NULL, FALSE,
      CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
      std::cerr << "CreateProcess failed: " << GetLastError() << std::endl;
      CloseHandle(hFile);
      return -1;
    }

    // 映射exe文件到内存
    HANDLE hMapFile = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if (hMapFile == NULL) {
      std::cerr << "CreateFileMapping failed: " << GetLastError() << std::endl;
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    LPVOID pFileBase = MapViewOfFile(hMapFile, FILE_MAP_READ, 0, 0, 0);
    if (pFileBase == NULL) {
      std::cerr << "MapViewOfFile failed: " << GetLastError() << std::endl;
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    // 将exe文件内容写入新进程
    LPVOID remoteBaseAddress = VirtualAllocEx(pi.hProcess, NULL, fileSize.LowPart, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (remoteBaseAddress == NULL) {
      std::cerr << "VirtualAllocEx failed: " << GetLastError() << std::endl;
      UnmapViewOfFile(pFileBase);
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    SIZE_T bytesWritten;
    if (!WriteProcessMemory(pi.hProcess, remoteBaseAddress, pFileBase, fileSize.LowPart, &bytesWritten)) {
      std::cerr << "WriteProcessMemory failed: " << GetLastError() << std::endl;
      VirtualFreeEx(pi.hProcess, remoteBaseAddress, 0, MEM_RELEASE);
      UnmapViewOfFile(pFileBase);
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    // 执行注入的exe
    ExecuteRemoteProcess(pi.hProcess, remoteBaseAddress);

    // 清理
    VirtualFreeEx(pi.hProcess, remoteBaseAddress, 0, MEM_RELEASE);
    UnmapViewOfFile(pFileBase);
    CloseHandle(hMapFile);
    CloseHandle(hFile);
    ResumeThread(pi.hThread);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    return 0;
}

老道 发表于 2024-4-24 10:58:18

本帖最后由 老道 于 2024-4-24 10:59 编辑

urenai 发表于 2024-4-23 22:23
未经测试的代码：
官方样例带的！杂类->内存加载模块->内存模块

urenai 发表于 2024-4-24 11:10:51

官方的这个应该是在进程自身领空申请空间运行exe

793359277 发表于 2024-4-24 16:30:58

老道 发表于 2024-4-24 10:58
官方样例带的！杂类->内存加载模块->内存模块

你理解错了精易这个是傀儡进程运行

仙木同学 发表于 2024-4-24 19:18:26

urenai 发表于 2024-4-23 22:23
未经测试的代码：

不行啊不行啊不行啊不行啊

urenai 发表于 2024-4-24 19:52:42

仙木同学 发表于 2024-4-24 19:18
不行啊不行啊不行啊不行啊

你再试试没道理出错啊，错误提示什么

仙木同学 发表于 2024-4-24 20:00:21

#include <windows.h>
#include <iostream>

// 获取PE文件头
PIMAGE_DOS_HEADER GetDosHeader(LPVOID lpBaseAddress) {
    return reinterpret_cast<PIMAGE_DOS_HEADER>(lpBaseAddress);
}

// 获取NT头
PIMAGE_NT_HEADERS GetNtHeaders(LPVOID lpBaseAddress) {
    PIMAGE_DOS_HEADER pDosHeader = GetDosHeader(lpBaseAddress);
    return reinterpret_cast<PIMAGE_NT_HEADERS>(
      reinterpret_cast<BYTE*>(pDosHeader) + pDosHeader->e_lfanew);
}

// 执行远程进程入口点
void ExecuteRemoteProcess(HANDLE hProcess, LPVOID remoteBaseAddress) {
    PIMAGE_NT_HEADERS pNtHeaders = GetNtHeaders(remoteBaseAddress);
    LPVOID entryPoint = (LPVOID)((DWORD_PTR)remoteBaseAddress + pNtHeaders->OptionalHeader.AddressOfEntryPoint);

    HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
      (LPTHREAD_START_ROUTINE)entryPoint, NULL, 0, NULL);
    if (hThread == NULL) {
      std::cerr << "CreateRemoteThread failed: " << GetLastError() << std::endl;
      return;
    }

    WaitForSingleObject(hThread, INFINITE);
    CloseHandle(hThread);
}

int main() {
    // 要注入的exe文件路径
    TCHAR szFilePath[] = L"C:\\Users\\HZW\\Desktop\\32.exe";
    //被注入的exe文件
    TCHAR FilePath111[] = L"C:\\Windows\\System32\\notepad.exe";

    // 打开exe文件
    HANDLE hFile = CreateFile(szFilePath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
      FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE) {
      std::cerr << "CreateFile failed: " << GetLastError() << std::endl;
      return -1;
    }

    // 获取exe文件大小
    LARGE_INTEGER fileSize;
    if (!GetFileSizeEx(hFile, &fileSize)) {
      std::cerr << "GetFileSizeEx failed: " << GetLastError() << std::endl;
      CloseHandle(hFile);
      return -1;
    }


    // 创建新进程
    PROCESS_INFORMATION pi;
    STARTUPINFO si = { sizeof(STARTUPINFO) };
    if (!CreateProcess(NULL, FilePath111, NULL, NULL, FALSE,
      CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
      std::cerr << "CreateProcess failed: " << GetLastError() << std::endl;
      CloseHandle(hFile);
      return -1;
    }

    // 映射exe文件到内存
    HANDLE hMapFile = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    if (hMapFile == NULL) {
      std::cerr << "CreateFileMapping failed: " << GetLastError() << std::endl;
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    LPVOID pFileBase = MapViewOfFile(hMapFile, FILE_MAP_READ, 0, 0, 0);
    if (pFileBase == NULL) {
      std::cerr << "MapViewOfFile failed: " << GetLastError() << std::endl;
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    // 将exe文件内容写入新进程
    LPVOID remoteBaseAddress = VirtualAllocEx(pi.hProcess, NULL, fileSize.LowPart, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (remoteBaseAddress == NULL) {
      std::cerr << "VirtualAllocEx failed: " << GetLastError() << std::endl;
      UnmapViewOfFile(pFileBase);
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    SIZE_T bytesWritten;
    if (!WriteProcessMemory(pi.hProcess, remoteBaseAddress, pFileBase, fileSize.LowPart, &bytesWritten)) {
      std::cerr << "WriteProcessMemory failed: " << GetLastError() << std::endl;
      VirtualFreeEx(pi.hProcess, remoteBaseAddress, 0, MEM_RELEASE);
      UnmapViewOfFile(pFileBase);
      CloseHandle(hMapFile);
      TerminateProcess(pi.hProcess, -1);
      CloseHandle(hFile);
      return -1;
    }

    // 执行注入的exe
    ExecuteRemoteProcess(pi.hProcess, remoteBaseAddress);

    // 清理
    VirtualFreeEx(pi.hProcess, remoteBaseAddress, 0, MEM_RELEASE);
    UnmapViewOfFile(pFileBase);
    CloseHandle(hMapFile);
    CloseHandle(hFile);
    ResumeThread(pi.hThread);
    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);

    return 0;
}你看看，你试下

urenai 发表于 2024-4-24 20:02:57

我没空
页: [1]
查看完整版本: 易语言的这个命令谁能转成火山的