c# - 在另一个进程内调用不是用 .NET 编写的函数

Question

我想调用另一个进程内的函数，并通过 createremotethread 发送多个参数。

现在，我可以通过发送内联汇编来做到这一点，但我不知道足够的汇编知识来做到这一点。另外，我无权访问远程进程源代码。

我正在考虑使用:

[StructLayout(LayoutKind.Sequential, Pack=1)]
public struct RemoteThreadParams
{
    [MarshalAs(UnmanagedType.I4)]
    public int Param1;

    [MarshalAs(UnmanagedType.I4)]
    public int Param2;

}

但据我了解，远程进程必须知道如何处理它。

是否有一种简单的方法可以将多个参数发送到不包含任何程序集的远程进程？

编辑:

这就是我目前正在尝试解决的方法，但是我出现了内存不足异常，而且我真的不明白我做错了什么。

我们的函数 ptr 位于远程进程中的 0x64D480 处，这是从 IDA pro 中获取的程序集。

// FUNCTION PTR IS 0x64D480
.text:0064D480 sub_64D480      proc near               ; CODE XREF: sub_4DA7F0+3Ap
.text:0064D480                                         ; sub_64D550+Bp ...
.text:0064D480
.text:0064D480 var_C           = dword ptr -0Ch // arg1
.text:0064D480 arg_0           = dword ptr  4 // arg2
.text:0064D480
.text:0064D480                 push    esi
.text:0064D481                 push    edi
.text:0064D482                 mov     edi, [esp+8+arg_0]
.text:0064D486                 push    edi
.text:0064D487                 mov     esi, ecx
.text:0064D489                 call    sub_64D330
.text:0064D48E                 test    al, al
.text:0064D490                 jnz     short loc_64D497
.text:0064D492                 pop     edi
.text:0064D493                 pop     esi
.text:0064D494                 retn    4  

难道不能这样调用函数吗:

[StructLayout(LayoutKind.Sequential, Pack=1)]
public struct RemoteThreadParams
{
    [MarshalAs(UnmanagedType.I4)]
    public int Param1;

    [MarshalAs(UnmanagedType.I4)]
    public int Param2;

}  

void CallFunction(IntPtr _functionPtr, RemoteThreadParams _parameters)
{
    // Allocate some native heap memory in your process big enough to store the parameter data
    IntPtr iptrtoparams = Marshal.AllocHGlobal(Marshal.SizeOf(_parameters));

    // Copies the data in your structure into the native heap memory just allocated
    Marshal.StructureToPtr(_parameters, iptrtoparams, false);
    // Use to alloc "committed" memory that is addressable by other process
    IntPtr iptrremoteallocatedmemory = VirtualAllocEx(this.handle, IntPtr.Zero, (uint)Marshal.SizeOf(_parameters), AllocationType.Commit, MemoryProtection.ExecuteReadWrite);
    UIntPtr bytesWritten = UIntPtr.Zero;
    // Copy from local process memory to the memory of the remote process
    WriteProcessMemory(this.handle, iptrremoteallocatedmemory, iptrtoparams, (uint)Marshal.SizeOf(_parameters), out bytesWritten);
    //Free up memory
    Marshal.FreeHGlobal(iptrtoparams);

    //thread id and return value in case we need it for later
    uint iThreadId;
    uint returnValue = 0;

    IntPtr hThread = CreateRemoteThread(this.handle, IntPtr.Zero, 0, _functionPtr, iptrtoparams, 0, out iThreadId);

    WaitForSingleObject(hThread, 0xFFFFFFFF);
    GetExitCodeThread(hThread, out returnValue);

    CloseHandle(hThread);
    CloseHandle(this.handle);
}  

Answer 1

没有简单的方法。最简单的方法是使用 LoadLibrary 和非托管代码来完成此操作。您需要两个版本:32位dll和64位dll，您根据目标进程的“位数”选择注入(inject)哪一个。

CreateRemoteThread(....., Address of LoadLibrary,   "location of your unmanaged dll");

当您在 google 上搜索 C# CreateRemoteThread LoadLibrary 时，您会在 Internet 上找到引用资料。

之后，您希望自定义 dll 进行函数调用:

#include "stdafx.h"

typedef void (__stdcall *MyCustomFunc)(int param1, int param2);

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        {
            // this code is executed arbitrarily. 
            // this is just a test,
            // you're better off writing a separate function in a DLL
            // and export it, so you can later call it from C#, once DLL is injected.
            MyCustomFunc test = 0x64D480;
            test(2, 4);
        }
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

ps，如果需要，您还需要 FreeLibrary。正确的调用约定也很重要。我在这里冒险说它看起来像 __stdcall，但它可能是 __cdecl，或 __fastcall，或其他。请参阅:http://www.codeproject.com/Articles/1388/Calling-Conventions-Demystified了解更多信息。