CreateProcessW劫持

利用detours库实现

CreateProcessW劫持

#include"stdio.h"
#include "stdlib.h"
#include "windows.h"
#include "detours.h"

#pragma comment(lib,"detours.lib")


BOOL(WINAPI *poldCreateProcess)(
	LPCWSTR lpApplicationName,
	LPWSTR lpCommandLine,
	LPSECURITY_ATTRIBUTES lpProcessAttributes,
	LPSECURITY_ATTRIBUTES lpThreadAttributes,
	BOOL bInheritHandles,
	DWORD dwCreationFlags,
	LPVOID lpEnvironment,
	LPCWSTR lpCurrentDirectory,
	LPSTARTUPINFOW lpStartupInfo,
	LPPROCESS_INFORMATION lpProcessInformation
	) = CreateProcessW;


BOOL NEWCreateProcessW(
	LPCWSTR lpApplicationName,
	LPWSTR lpCommandLine,
	LPSECURITY_ATTRIBUTES lpProcessAttributes,
	LPSECURITY_ATTRIBUTES lpThreadAttributes,
	BOOL bInheritHandles,
	DWORD dwCreationFlags,
	LPVOID lpEnvironment,
	LPCWSTR lpCurrentDirectory,
	LPSTARTUPINFOW lpStartupInfo,
	LPPROCESS_INFORMATION lpProcessInformation
	)
{
	

	return 0;
}

void hook()
{
	DetourRestoreAfterWith(); //恢复状态
	DetourTransactionBegin();//开始拦截
	DetourUpdateThread(GetCurrentThread());//刷新线程
	DetourAttach((void**)&poldCreateProcess, NEWCreateProcessW);
	DetourTransactionCommit();


}



_declspec(dllexport)void injection()
{
	hook();

}

编译成dll的形式然后通过注入桌面进程，即可实现劫持，请在32位系统下实验，由于是免费的不是专业版的所以不支持64位的系统