4字節被陷在RemotThread

我用這個片段注入只是一個小功能，像這樣的遠程過程：4字節被陷在RemotThread

function InjectMemory(Process: LongWord; Memory: pointer; Len: longword): pointer; 
var 
    BytesWritten: longword; 
begin 
    Result := VirtualAllocEx(Process, nil, Len, MEM_COMMIT or MEM_RESERVE, PAGE_EXECUTE_READWRITE); 
    WriteProcessMemory(Process, Result, Memory, Len, BytesWritten); 
end; 

function MyFunc (p : pointer) : Integer; stdcall; 
begin end; 

var 
PHandle  : Cardinal; 
RemoteThreadID : Cardinal; 
begin 
pHandle := OpenProcess (PROCESS_ALL_ACCESS, false, 1234) 
if pHandle <> 0 then 
    pThreadAddress := InjectMemory (pHandle, @MyThread, SizeOfProc(@MyThread)); 
    CreateRemoteThread (pHandle, nil, 0, pThreadAddress, nil, 0, RemoteThreadID); 
    CloseHandle (pHandle) 
end; 
end;

的SizeOfProc功能：

uses 
    Windows, sysutils; 

function SizeOfCode(Code: pointer): integer; 
function SizeOfProc(Proc: pointer): integer; 

implementation 

const 
    Opcodes1: array [0..255] of word = 
    (
    (16913),(17124),(8209),(8420),(33793),(35906),(0),(0),(16913),(17124),(8209),(8420),(33793),(35906),(0),(0),(16913), 
    (17124),(8209),(8420),(33793),(35906),(0),(0),(16913),(17124),(8209),(8420),(33793),(35906),(0),(0),(16913), 
    (17124),(8209),(8420),(33793),(35906),(0),(32768),(16913),(17124),(8209),(8420),(33793),(35906),(0),(32768),(16913), 
    (17124),(8209),(8420),(33793),(35906),(0),(32768),(529),(740),(17),(228),(1025),(3138),(0),(32768),(24645), 
    (24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(69), 
    (69),(69),(69),(69),(69),(69),(69),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(24645),(0), 
    (32768),(228),(16922),(0),(0),(0),(0),(3072),(11492),(1024),(9444),(0),(0),(0),(0),(5120), 
    (5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(5120),(1296), 
    (3488),(1296),(1440),(529),(740),(41489),(41700),(16913),(17124),(8209),(8420),(17123),(8420),(227),(416),(0), 
    (57414),(57414),(57414),(57414),(57414),(57414),(57414),(32768),(0),(0),(0),(0),(0),(0),(32768),(33025), 
    (33090),(769),(834),(0),(0),(0),(0),(1025),(3138),(0),(0),(32768),(32768),(0),(0),(25604), 
    (25604),(25604),(25604),(25604),(25604),(25604),(25604),(27717),(27717),(27717),(27717),(27717),(27717),(27717),(27717),(17680), 
    (17824),(2048),(0),(8420),(8420),(17680),(19872),(0),(0),(2048),(0),(0),(1024),(0),(0),(16656), 
    (16800),(16656),(16800),(33792),(33792),(0),(32768),(8),(8),(8),(8),(8),(8),(8),(8),(5120), 
    (5120),(5120),(5120),(33793),(33858),(1537),(1602),(7168),(7168),(0),(5120),(32775),(32839),(519),(583),(0), 
    (0),(0),(0),(0),(0),(8),(8),(0),(0),(0),(0),(0),(0),(16656),(416) 
); 

    Opcodes2: array [0..255] of word = 
    (
    (280),(288),(8420),(8420),(65535),(0),(0),(0),(0),(0),(65535),(65535),(65535),(272),(0),(1325),(63), 
    (575),(63),(575),(63),(63),(63),(575),(272),(65535),(65535),(65535),(65535),(65535),(65535),(65535),(16419), 
    (16419),(547),(547),(65535),(65535),(65535),(65535),(63),(575),(47),(575),(61),(61),(63),(63),(0), 
    (32768),(32768),(32768),(0),(0),(65535),(65535),(65535),(65535),(65535),(65535),(65535),(65535),(65535),(65535),(8420), 
    (8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(8420),(16935), 
    (63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(63),(237), 
    (237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(101),(237),(1261), 
    (1192),(1192),(1192),(237),(237),(237),(0),(65535),(65535),(65535),(65535),(65535),(65535),(613),(749),(7168), 
    (7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(7168),(16656), 
    (16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(16656),(0), 
    (0),(32768),(740),(18404),(17380),(49681),(49892),(0),(0),(0),(17124),(18404),(17380),(32),(8420),(49681), 
    (49892),(8420),(17124),(8420),(8932),(8532),(8476),(65535),(65535),(1440),(17124),(8420),(8420),(8532),(8476),(41489), 
    (41700),(1087),(548),(1125),(9388),(1087),(33064),(24581),(24581),(24581),(24581),(24581),(24581),(24581),(24581),(65535), 
    (237),(237),(237),(237),(237),(749),(8364),(237),(237),(237),(237),(237),(237),(237),(237),(237), 
    (237),(237),(237),(237),(237),(63),(749),(237),(237),(237),(237),(237),(237),(237),(237),(65535), 
    (237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(237),(0) 
); 

    Opcodes3: array [0..9] of array [0..15] of word = 
    (
    ((1296),(65535),(16656),(16656),(33040),(33040),(33040),(33040),(1296),(65535),(16656),(16656),(33040),(33040),(33040),(33040)), 
    ((3488),(65535),(16800),(16800),(33184),(33184),(33184),(33184),(3488),(65535),(16800),(16800),(33184),(33184),(33184),(33184)), 
    ((288),(288),(288),(288),(288),(288),(288),(288),(54),(54),(48),(48),(54),(54),(54),(54)), 
    ((288),(65535),(288),(288),(272),(280),(272),(280),(48),(48),(0),(48),(0),(0),(0),(0)), 
    ((288),(288),(288),(288),(288),(288),(288),(288),(54),(54),(54),(54),(65535),(0),(65535),(65535)), 
    ((288),(65535),(288),(288),(65535),(304),(65535),(304),(54),(54),(54),(54),(0),(54),(54),(0)), 
    ((296),(296),(296),(296),(296),(296),(296),(296),(566),(566),(48),(48),(566),(566),(566),(566)), 
    ((296),(65535),(296),(296),(272),(65535),(272),(280),(48),(48),(48),(48),(48),(48),(65535),(65535)), 
    ((280),(280),(280),(280),(280),(280),(280),(280),(566),(566),(48),(566),(566),(566),(566),(566)), 
    ((280),(65535),(280),(280),(304),(296),(304),(296),(48),(48),(48),(48),(0),(54),(54),(65535)) 
); 

function SizeOfCode(Code: pointer): integer; 
var 
    Opcode: word; 
    Modrm: byte; 
    Fixed, AddressOveride: boolean; 
    Last, OperandOveride, Flags, Rm, Size, Extend: longword; 
begin 
    try 
    Last := longword(Code); 
    if Code <> nil then 
    begin 
     AddressOveride := False; 
     Fixed := False; 
     OperandOveride := 4; 
     Extend := 0; 
     repeat 
     Opcode := byte(Code^); 
     Code := pointer(longword(Code) + 1); 
     if Opcode = $66 then 
     begin 
      OperandOveride := 2; 
     end 
     else if Opcode = $67 then 
     begin 
      AddressOveride := True; 
     end 
     else 
     begin 
      if not ((Opcode and $E7) = $26) then 
      begin 
      if not (Opcode in [$64..$65]) then 
      begin 
       Fixed := True; 
      end; 
      end; 
     end; 
     until Fixed; 
     if Opcode = $0f then 
     begin 
     Opcode := byte(Code^); 
     Flags := Opcodes2[Opcode]; 
     Opcode := Opcode + $0f00; 
     Code := pointer(longword(Code) + 1); 
     end 
     else 
     begin 
     Flags := Opcodes1[Opcode]; 
     end; 
     if ((Flags and $0038) <> 0) then 
     begin 
     Modrm := byte(Code^); 
     Rm := Modrm and $7; 
     Code := pointer(longword(Code) + 1); 
     case (Modrm and $c0) of 
      $40: Size := 1; 
      $80: 
      begin 
       if AddressOveride then 
       begin 
       Size := 2; 
       end 
       else 
       Size := 4; 
       end; 
      else 
      begin 
      Size := 0; 
      end; 
     end; 
     if not (((Modrm and $c0) <> $c0) and AddressOveride) then 
     begin 
      if (Rm = 4) and ((Modrm and $c0) <> $c0) then 
      begin 
      Rm := byte(Code^) and $7; 
      end; 
      if ((Modrm and $c0 = 0) and (Rm = 5)) then 
      begin 
      Size := 4; 
      end; 
      Code := pointer(longword(Code) + Size); 
     end; 
     if ((Flags and $0038) = $0008) then 
     begin 
      case Opcode of 
      $f6: Extend := 0; 
      $f7: Extend := 1; 
      $d8: Extend := 2; 
      $d9: Extend := 3; 
      $da: Extend := 4; 
      $db: Extend := 5; 
      $dc: Extend := 6; 
      $dd: Extend := 7; 
      $de: Extend := 8; 
      $df: Extend := 9; 
      end; 
      if ((Modrm and $c0) <> $c0) then 
      begin 
      Flags := Opcodes3[Extend][(Modrm shr 3) and $7]; 
      end 
      else 
      begin 
      Flags := Opcodes3[Extend][((Modrm shr 3) and $7) + 8]; 
      end; 
     end; 
     end; 
     case (Flags and $0C00) of 
     $0400: Code := pointer(longword(Code) + 1); 
     $0800: Code := pointer(longword(Code) + 2); 
     $0C00: Code := pointer(longword(Code) + OperandOveride); 
     else 
     begin 
      case Opcode of 
      $9a, $ea: Code := pointer(longword(Code) + OperandOveride + 2); 
      $c8: Code := pointer(longword(Code) + 3); 
      $a0..$a3: 
       begin 
       if AddressOveride then 
       begin 
        Code := pointer(longword(Code) + 2) 
       end 
       else 
       begin 
        Code := pointer(longword(Code) + 4); 
       end; 
       end; 
      end; 
     end; 
     end; 
    end; 
    Result := longword(Code) - Last; 
    except 
    Result := 0; 
    end; 
end; 

function SizeOfProc(Proc: pointer): integer; 
var 
    Length: longword; 
begin 
    Result := 0; 
    repeat 
    Length := SizeOfCode(Proc); 
    Inc(Result, Length); 
    if ((Length = 1) and (byte(Proc^) = $C3)) then Break; 
    Proc := pointer(longword(Proc) + Length); 
    until Length = 0; 
end;

的RemoteThread工作得很好。但是我可以看到在線程被釋放後仍然有4k字節（或字節？！）。有什麼我失蹤？！

來源

2012-11-26 Benjamin Weiss

「但是我可以看到在線程被釋放後仍然有4k字節（或字節？！）。」你能否詳細解釋這一部分？ –

我查看了taskmanager，看到每次創建線程時（實際上在分配內存之後），它都會增加4k字節（例如，一個進程有296k字節，然後有300k字節） –

您可以顯示解除分配內存的代碼，以及它如何被稱爲？這就是調用'VirtualFree'的代碼。 –

看來你並沒有打電話給VirtualFreeEx，所以內存沒有被釋放。如果你想釋放它，那麼你顯然需要撥打VirtualFreeEx。但是，您需要等到遠程線程發出信號後再執行此操作。

在評論你說：線程做之前

我的進程關閉。那麼我該如何釋放它呢？

那麼，這將是一個挑戰！一個建議是，你根本不試圖釋放這些內存。相反，這將確保您只分配一次。每次創建線程時都要分配內存。更改該策略以分配一次內存，然後將其重用於您創建的每個後續線程。

替代方法是確保您的進程等待遠程線程，然後釋放。通過在遠程線程句柄上調用WaitForSingleObject來完成此操作。請注意，遠程線程句柄是從CreateRemoteThread返回的值。您目前忽略它。

來源

2012-11-26 09:57:45

4字節被陷在RemotThread

回答

相關問題