#include "stdafx.h"
#include <Windows.h>

// 函数声明
typedef BOOL (WINAPI* Proc_CreateProcessW)(LPCWSTR lpApplicationName,
                       LPWSTR lpCommandLine,
                       LPSECURITY_ATTRIBUTES lpProcessAttributes,
                       LPSECURITY_ATTRIBUTES lpThreadAttributes,
                       BOOL bInheritHandles,
                       DWORD dwCreationFlags,
                       LPVOID lpEnvironment,
                       LPCWSTR lpCurrentDirectory,
                       LPSTARTUPINFOW lpStartupInfo,
                       LPPROCESS_INFORMATION lpProcessInformation);

typedef HMODULE (WINAPI* Func_LoadLibraryW)(LPCWSTR lpLibFileName);


BYTE* mov_eax_xx(BYTE* lpCurAddres, DWORD eax)
{
  *lpCurAddres = 0xB8;
  *(DWORD*)(lpCurAddres + 1) = eax;
  return lpCurAddres + 5;
}

BYTE* mov_ebx_xx(BYTE* lpCurAddres, DWORD ebx)
{
  *lpCurAddres = 0xBB;
  *(DWORD*)(lpCurAddres + 1) = ebx;
  return lpCurAddres + 5;
}

BYTE* mov_ecx_xx(BYTE* lpCurAddres, DWORD ecx)
{
  *lpCurAddres = 0xB9;
  *(DWORD*)(lpCurAddres + 1) = ecx;
  return lpCurAddres + 5;
}

BYTE* mov_edx_xx(BYTE* lpCurAddres, DWORD edx)
{
  *lpCurAddres = 0xBA;
  *(DWORD*)(lpCurAddres + 1) = edx;
  return lpCurAddres + 5;
}

BYTE* mov_esi_xx(BYTE* lpCurAddres, DWORD esi)
{
  *lpCurAddres = 0xBE;
  *(DWORD*)(lpCurAddres + 1) = esi;
  return lpCurAddres + 5;
}

BYTE* mov_edi_xx(BYTE* lpCurAddres, DWORD edi)
{
  *lpCurAddres = 0xBF;
  *(DWORD*)(lpCurAddres + 1) = edi;
  return lpCurAddres + 5;
}

BYTE* mov_ebp_xx(BYTE* lpCurAddres, DWORD ebp)
{
  *lpCurAddres = 0xBD;
  *(DWORD*)(lpCurAddres + 1) = ebp;
  return lpCurAddres + 5;
}

BYTE* mov_esp_xx(BYTE* lpCurAddres, DWORD esp)
{
  *lpCurAddres = 0xBC;
  *(DWORD*)(lpCurAddres + 1) = esp;
  return lpCurAddres + 5;
}

BYTE* mov_eip_xx(BYTE* lpCurAddres, DWORD eip, DWORD newEip)
{
  if ( !newEip )
  {
    newEip = (DWORD)lpCurAddres;
  }

  *lpCurAddres = 0xE9;
  *(DWORD*)(lpCurAddres + 1) = eip - (newEip + 5);
  return lpCurAddres + 5;
}

BYTE* push_xx(BYTE* lpCurAddres, DWORD dwAdress)
{

  *lpCurAddres = 0x68;
  *(DWORD*)(lpCurAddres + 1) = dwAdress;

  return lpCurAddres + 5;
}

BYTE* Call_xx(BYTE* lpCurAddres, DWORD eip, DWORD newEip)
{
  if ( !newEip )
  {
    newEip = (DWORD)lpCurAddres;
  }

  *lpCurAddres = 0xE8;
  *(DWORD*)(lpCurAddres + 1) = eip - (newEip + 5);
  return lpCurAddres + 5;
}

BOOL SuspendTidAndInjectCode(HANDLE hProcess, HANDLE hThread, DWORD dwFuncAdress, const BYTE * lpShellCode, size_t uCodeSize)
{
  SIZE_T NumberOfBytesWritten = 0;
  BYTE ShellCodeBuf[0x480];
  CONTEXT Context;
  DWORD flOldProtect = 0;
  LPBYTE lpCurESPAddress = NULL;
  LPBYTE lpCurBufAdress = NULL;
  BOOL bResult = FALSE;
  

  // 挂载起线程
  SuspendThread(hThread);

  memset(&Context,0,sizeof(Context));
  Context.ContextFlags = CONTEXT_FULL;

  if ( GetThreadContext(hThread, &Context))
  {
    // 在对方线程中开辟一个 0x480 大小的局部空
    lpCurESPAddress = (LPBYTE)((Context.Esp - 0x480) & 0xFFFFFFE0);
    
    // 获取指针 用指针来操作
    lpCurBufAdress = &ShellCodeBuf[0];

    if (lpShellCode)
    {
      memcpy(ShellCodeBuf + 128, lpShellCode, uCodeSize);
      lpCurBufAdress = push_xx(lpCurBufAdress, (DWORD)lpCurESPAddress + 128); // push
      lpCurBufAdress = Call_xx(lpCurBufAdress, dwFuncAdress, (DWORD)lpCurESPAddress + (DWORD)lpCurBufAdress - (DWORD)&ShellCodeBuf); //Call
    }

    lpCurBufAdress = mov_eax_xx(lpCurBufAdress, Context.Eax);
    lpCurBufAdress = mov_ebx_xx(lpCurBufAdress, Context.Ebx);
    lpCurBufAdress = mov_ecx_xx(lpCurBufAdress, Context.Ecx);
    lpCurBufAdress = mov_edx_xx(lpCurBufAdress, Context.Edx);
    lpCurBufAdress = mov_esi_xx(lpCurBufAdress, Context.Esi);
    lpCurBufAdress = mov_edi_xx(lpCurBufAdress, Context.Edi);
    lpCurBufAdress = mov_ebp_xx(lpCurBufAdress, Context.Ebp);
    lpCurBufAdress = mov_esp_xx(lpCurBufAdress, Context.Esp);
    lpCurBufAdress = mov_eip_xx(lpCurBufAdress, Context.Eip, (DWORD)lpCurESPAddress + (DWORD)lpCurBufAdress - (DWORD)&ShellCodeBuf);
    Context.Esp = (DWORD)(lpCurESPAddress - 4);
    Context.Eip = (DWORD)lpCurESPAddress;
    
    if ( VirtualProtectEx(hProcess, lpCurESPAddress, 0x480, PAGE_EXECUTE_READWRITE, &flOldProtect)
      && WriteProcessMemory(hProcess, lpCurESPAddress, &ShellCodeBuf, 0x480, &NumberOfBytesWritten)
      && FlushInstructionCache(hProcess, lpCurESPAddress, 0x480)
      && SetThreadContext(hThread, &Context) )
    {
      bResult = TRUE;
    }

  }
  
  // 回复线程
  ResumeThread(hThread);

  return TRUE;
}

DWORD GetFuncAdress()
{
  return (DWORD)GetProcAddress(GetModuleHandleA("Kernel32"), "LoadLibraryW");
}

BOOL WINAPI CreateProcessWithDllW(  LPCWSTR lpApplicationName,
                  LPWSTR lpCommandLine,
                  LPSECURITY_ATTRIBUTES lpProcessAttributes,
                  LPSECURITY_ATTRIBUTES lpThreadAttributes,
                  BOOL bInheritHandles,
                  DWORD dwCreationFlags,
                  LPVOID lpEnvironment,
                  LPCWSTR lpCurrentDirectory,
                  LPSTARTUPINFOW lpStartupInfo,
                  LPPROCESS_INFORMATION lpProcessInformation,
                  LPWSTR lpDllFullPath,
                  Proc_CreateProcessW FuncAdress
                  )
{
  BOOL bResult = FALSE;
  size_t uCodeSize = 0;
  DWORD dwCreaFlags;
  PROCESS_INFORMATION pi;
  ZeroMemory( &pi, sizeof(pi) );

  if (FuncAdress == NULL)
  {
    FuncAdress = CreateProcessW;
  }
  

  // 设置创建就挂起进程
  dwCreaFlags = dwCreationFlags | CREATE_SUSPENDED;
  if (CreateProcessW(lpApplicationName, 
            lpCommandLine, 
            lpProcessAttributes, 
            lpThreadAttributes, 
            bInheritHandles, 
            dwCreaFlags, 
            lpEnvironment,
            lpCurrentDirectory,
            lpStartupInfo,
            &pi
           ))
  {
    if ( lpDllFullPath )
      uCodeSize = 2 * wcslen(lpDllFullPath) + 2;
    else
      uCodeSize = 0;

    // 得到LoadLibraryW 的地址
    DWORD dwLoadDllProc = GetFuncAdress();

    // 挂起线程 写入Shellcode
    if (SuspendTidAndInjectCode(pi.hProcess, pi.hThread, dwLoadDllProc, (BYTE*)lpDllFullPath, uCodeSize))
    {
      if ( lpProcessInformation )
        memcpy(lpProcessInformation, &pi, sizeof(PROCESS_INFORMATION));

      if ( !(dwCreationFlags & CREATE_SUSPENDED) )
        ResumeThread(pi.hThread);

      bResult = TRUE;
    }
  }

  return bResult;
}


int _tmain(int argc, _TCHAR* argv[])
{  
  WCHAR wszPath[] = L"D:\\TestCreateProcessWithDll.exe";
  WCHAR wszDll[] = L"D:\\SampleDLL.dll";

  STARTUPINFOW si;
  PROCESS_INFORMATION pi;
  
  ZeroMemory( &si, sizeof(si) );
  si.cb = sizeof(si);
  ZeroMemory( &pi, sizeof(pi) );
  CreateProcessWithDllW(NULL, wszPath, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi, wszDll, NULL);

  return 0;
}