c++ - CreateRemoteThread 因 ERROR_NOT_ENOUGH_MEMORY 而失败

Question

这是一个很奇怪的问题，但我相信，这是 SO 的主题。

简介:

我有一个用 C# 编写的服务，它调用我的 C++ 库。 C++ 库通过 WinExec 执行一些 3rdparty 软件。

第 3 方软件通过 CreateRemoteThread 注入(inject) DLL。我没有此软件的源文件。

主要部分

我有 2 台电脑 - Win2008 和 Win10。

对于 Win10 - 这个科学怪人工作完美，服务运行 DLL，DLL 运行 3rdparty DLL 注入(inject)器，DLL 注入(inject)器注入(inject)东西。

对于 Win2008，情况有所不同。如果我从 CMD 运行 3rdparty DLL 注入(inject)器 - 它可以完美运行。但是，如果我运行服务 - Injector 返回，他会从 CreateRemoteThread 获得 ERROR_NOT_ENOUGH_MEMORY。

服务从 LocalService 帐户运行，在 Windows 10 上一切正常。我正在寻找可能的想法\线索，为什么 SERVICE 有问题(记住，CMD 工作正常)并且仅适用于 Windows 2008。

Answer 1

此问题可能与创建跨权限级别的远程线程有关，如以下博客文章中所述:

Injecting Code Into Privileged Win32 Processes

With XP SP2 and later (2003, Vista) some new security measures prevent the traditional CreateRemoteThread() function from working properly. You should be able to open the process, allocate memory on its heap, and write data to the allocated region, but when trying to invoke the remote thread, it will fail with ERROR_NOT_ENOUGH_MEMORY.

...

For XP SP2 I did a little debugging and found that inside CreateRemoteThread(), there is a call to ZwCreateThread() which is an export from ntdll.dll. The call is made while specifying that the thread should start suspended, which it does properly, however down the road still inside CreateRemoteThread() before ZwResumeThread() is called, there is a call to CsrClientCallServer() which fails and eventually leads to the error message.

文章解释了在不同版本的 Windows 上注入(inject)远程线程以避免错误的一些不同方法，最后得出以下结论:

At this point, we can successfully execute remote threads into privileged processes across all target platforms, but as mentioned before, its pretty messy. We're using three different, largely undocumented functions and auto-detecting which one to use based on the OS version.

The better solution is to create a secondary program that adds a service object (your injector program) to the service control manager database on the target system. Since you're administrator, which is required anyway, you'll be able to add these entries and start the service. This will enable the injector program to run with different access rights than normal code, and the traditional CreateRemoteThread() will work properly on Windows 2000, all of XP, and 2003/Vista. The API functions for adding and controlling the service are documented by MSDN and remain consistent across all of the platforms.

So, what is learned is that we can use a number of different functions to inject code into privileged remote processes, including RtlCreateUserThread() on XP SP2, and NtCreateThreadEx() on Vista, but the optimal way is to install a temporary service and allow CreateRemoteThread() to be the single API that accomplishes the task for all platforms.

当然，这些都不重要，因为您没有注入(inject)器的源代码，因此无法更改它的工作方式。

此外，您也不能跨 session 边界创建远程线程。在服务中调用 WinExec() 将在与服务相同的 session 中运行注入(inject)器进程，即 session 0。如果它试图注入(inject)正在用户 session 中运行的进程，那将从不工作。这也可以解释为什么从 CMD 运行注入(inject)器有效，如果 CMD 与正在注入(inject)的进程在同一 session 中运行。