Silver

Love never dies a natural death.
It dies of blindness and errors and betrayals. It dies of weariness, of witherings, of tarnishings.
- Anais Nin

NtCreateThreadEx under x64

Last updated:Dec.11, 2016 CST 16:02:07

近日忙于大作业,顺手写了下逆向的上机作业,然后发现在Win10 x64下用NtCreateThreadEx怎么也注入不进去,GetLastError没有返回值,函数的返回值是“参数不正确”。索性试着逆向一下ntdll,然后发现,这个函数在x64和x86下的原型应该是不同的:

// NtCreateThreadEx - x32 
typedef DWORD(NTAPI *fNtCreateThreadEx)
(
    PHANDLE                 ThreadHandle,
    ACCESS_MASK             DesiredAccess,
    LPVOID                  ObjectAttributes,
    HANDLE                  ProcessHandle,
    LPTHREAD_START_ROUTINE  lpStartAddress,
    LPVOID                  lpParameter,
    BOOL                    CreateSuspended,
    DWORD                   dwStackSize,
    DWORD                   Arg8,
    DWORD                   Arg9,
    LPVOID                  Arg10
);

// NtCreateThreadEx - x64 
typedef DWORD64(NTAPI *fNtCreateThreadEx)
(
    PHANDLE                 ThreadHandle,
    ACCESS_MASK             DesiredAccess,
    LPVOID                  ObjectAttributes,
    HANDLE                  ProcessHandle,
    LPTHREAD_START_ROUTINE  lpStartAddress,
    LPVOID                  lpParameter,
    BOOL                    CreateSuspended,
    DWORD64                 dwStackSize,
    DWORD64                 Arg8,
    DWORD64                 Arg9,
    LPVOID                  Arg10
);

上网搜了一下才发现有人已经给出来了,有一点点尴尬。

实际其他的都差不多,主要是后几个参数的类型不一样。不过不知道怎么回事,对iexplore.exe的几个子进程还是注不进去,八成和令牌有关系?有时间再试试吧。

唉,好久没碰Windows,差点连OD都要不会用了……

//对,这就是一篇水文……

Contact webmaster at:
[email protected]