跨进程边界共享内核的方法

朴灿烈づ我的快乐病毒、 2022-08-06 08:16 153阅读 0赞

跨进程边界共享内核的方法:

1 使用对象句柄继承

typedef struct _SECURITY_ATTRIBUTES {
         
    
      DWORD nLength;
    
      LPVOID lpSecurityDescriptor;
    
      BOOL bInheritHandle;

\} SECURITY\_ATTRIBUTES,\*PSECURITY\_ATTRIBUTES,\*LPSECURITY\_ATTRIBUTES;

句柄中的bInheritHandle设为TRUE，即可被其他进程继承。

再通过父进程生成子进程：

利用CreateProcess:

This function is used to run a new program. It creates a new process and its primary thread. The new process executes the specified executable file.

**Note** The remote application interface (RAPI) version of this function is named CeCreateProcess (RAPI).

**BOOL CreateProcess(**

**LPCWSTR** *pszImageName***,**

**LPCWSTR** *pszCmdLine***,**

**LPSECURITY\_ATTRIBUTES** *psaProcess***,**

**LPSECURITY\_ATTRIBUTES** *psaThread***,**

**BOOL** *fInheritHandles***,**

**DWORD** *fdwCreate***,**

**LPVOID** *pvEnvironment***,**

**LPWSTR** *pszCurDir***,**

**LPSTARTUPINFOW** *psiStartInfo***,**

**LPPROCESS\_INFORMATION** *pProcInfo*

**);**

KEY one: 改变句柄标志

**SetHandleInformation Function**

Sets certain properties of an object handle.

BOOL WINAPI SetHandleInformation(

__in          HANDLE hObject,

__in          DWORD dwMask,

__in          DWORD dwFlags

);

改变值 DWORD dwFlags：

HANDLE_FLAG_INHERIT

HANDLE_FLAG_PROTECT_FROM_CLOSE

2 为对象命名

如：

CreateMutex

This function creates a named or unnamed mutex object.

**HANDLE CreateMutex(**

**LPSECURITY\_ATTRIBUTES** *lpMutexAttributes***,**

**BOOL** *bInitialOwner***,**

**LPCTSTR** *lpName*

**);**

**给****LPCTSTR***lpName**设置名字，以让其他进程访问这个有名内核对象。*

KEY two:

终端服务命名空间（略）

专有命名空间（略）

3 复制对象句柄

使用DumplicateHandle函数:

原型:

This function duplicates an object handle. The duplicate handle refers to the same object as the original handle. Therefore, any changes to the object are reflected through both handles.

**BOOL DuplicateHandle(**

**HANDLE** *hSourceProcessHandle***,**

**HANDLE** *hSourceHandle***,**

**HANDLE** *hTargetProcessHandle***,**

**LPHANDLE** *lpTargetHandle***,**

**DWORD** *dwDesiredAccess***,**

**BOOL** *bInheritHandle***,**

**DWORD** *dwOptions*

**);**

**Parameters** *dwOptions*

<table style="margin: auto auto auto 36pt; width: 103%; background: #999999; mso-cellspacing: 0cm; mso-border-top-alt: .75pt; mso-border-left-alt: .25pt; mso-border-bottom-alt: .25pt; mso-border-right-alt: .75pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> 
 <tbody> 
 <tr style="mso-yfti-irow: 0; mso-yfti-firstrow: yes;"> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 38%; padding-right: 4.5pt; background: #cccccc; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> Value </td> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 62%; padding-right: 4.5pt; background: #cccccc; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> Description </td> 
 </tr> 
 <tr style="mso-yfti-irow: 1;"> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 38%; padding-right: 4.5pt; background: white; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> DUPLICATE_CLOSE_SOURCE </td> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 62%; padding-right: 4.5pt; background: white; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> Closes the source handle. This occurs regardless of any error status returned. </td> 
 </tr> 
 <tr style="mso-yfti-irow: 2; mso-yfti-lastrow: yes;"> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 38%; padding-right: 4.5pt; background: white; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> DUPLICATE_SAME_ACCESS </td> 
 <td style="padding-bottom: 3pt; padding-left: 4.5pt; width: 62%; padding-right: 4.5pt; background: white; padding-top: 3pt; mso-border-top-alt: .25pt; mso-border-left-alt: .75pt; mso-border-bottom-alt: .75pt; mso-border-right-alt: .25pt; mso-border-color-alt: #999999; mso-border-style-alt: solid; border: #999999 1pt solid;"> Ignores the dwDesiredAccess parameter. The duplicate handle has the same access as the source handle. This flag must be specified for Windows CE. </td> 
 </tr> 
 </tbody> 
</table>

参考资料：MSDN &Windows via C/C++