//.h
#pragma once
#include<Windows.h>
#include<iostream>
#include<tchar.h>


using namespace std;


//https://securityxploded.com/ntcreatethreadex.php
//Here is the prototype of NtCreateThreadEx function [undocumented]
typedef NTSTATUS(WINAPI* LPFN_NTCREATETHREADEX)(
	OUT PHANDLE ThreadHandle,
	IN ACCESS_MASK DesiredAccess,
	IN LPVOID ObjectAttributes,
	IN HANDLE ProcessHandle,
	IN LPTHREAD_START_ROUTINE ThreadProcedure,
	IN LPVOID ParameterData,
	IN BOOL CreateSuspended,
	IN SIZE_T StackZeroBits,
	IN SIZE_T SizeOfStackCommit,
	IN SIZE_T SizeOfStackReserve,
	OUT LPVOID BytesBuffer);




typedef HMODULE(WINAPI * LPFN_LOADLIBRARYW)(LPCWSTR lpLibFileName);
typedef HMODULE(WINAPI * LPFN_LOADLIBRARYA)(LPCSTR lpLibFileName);


//.cpp
#include"NtCreateThreadEx.h"
#include"Helper.h"




#ifdef UNICODE
LPFN_LOADLIBRARYW __LoadLibrary = NULL;
#else
LPFN_LOADLIBRARYA __LoadLibrary = NULL;
#endif

LPFN_NTCREATETHREADEX __NtCreateThreadEx = NULL;

int _tmain(int argc, TCHAR* argv[], TCHAR *envp[])
{
	//控制台识别中文
	setlocale(LC_ALL, "Chinese-simplified");

	TCHAR ProcessImageName[MAX_PATH] = { 0 };//保存进程名字

	TCHAR CurrentFullPath[MAX_PATH] = { 0 }; //当前进程的完整路径

	TCHAR TargetProcessFullPath[MAX_PATH] = { 0 };//目标进程的完整路径
	ULONG_PTR TargetProcessPathLength = MAX_PATH;

	ULONG ProcessId = 0;//目标进程Id


	HANDLE ProcessHandle = INVALID_HANDLE_VALUE;//进程句柄
	LPVOID VirtualAddress = NULL;

	SIZE_T ReturnLength = 0;

	BOOL  IsOk = FALSE;

	//注入的启动程序和目标程序的位数
	BOOL  SourceIsWow64 = FALSE;
	BOOL  TargetIsWow64 = FALSE;


	_tprintf(_T("输入一个进程ImageName\r\n"));


	TCHAR RcceiveChar = _gettchar();//接受字符串
	int i = 0;//用来偏移ProcessName字符数组
	while (RcceiveChar != '\n')
	{
		ProcessImageName[i++] = RcceiveChar;
		RcceiveChar = _gettchar();

	}
	//ProcessImageName = 0x00000056f16ff2b0 "Taskmgr.exe"

	GetCurrentDirectory(MAX_PATH, CurrentFullPath);//保存当前进程的完整路径

	IsWow64Process(GetCurrentProcess(), &SourceIsWow64);//得到当前进程位数
	
	ProcessId = KtGetProcessIdentify(ProcessImageName);//通过进程名得到进程Id

	if (ProcessId == 0)
	{
		return 0;
	}
	IsOk = KtGetProcessFullPath(TargetProcessFullPath,
		&TargetProcessPathLength, ProcessId, FALSE);
	
	if (IsOk == FALSE)
	{
		return 0;
	}
	//判断目标进程位数
	KtIsWow64Process(TargetProcessFullPath, &TargetIsWow64);
	if (SourceIsWow64 == TRUE && TargetIsWow64 == TRUE)
	{
		_tcscat_s(CurrentFullPath, _T("\\Dll.dll"));
	}
	else if (SourceIsWow64 == FALSE && TargetIsWow64 == FALSE)
	{
		_tcscat_s(CurrentFullPath, _T("\\Dll.dll"));
	}
	//CurrentFullPath = 0x00000056f16ff3e0 "Z:\\Ring3层代码\\[2]Ring3注入\\NtCreateThreadEx\\NtCreateThreadEx\\Dll.dll"

	HMODULE  NtdllModuleBase = NULL;
	HMODULE  Kernel32ModuleBase = NULL;
	NtdllModuleBase = GetModuleHandle(_T("NTDLL.DLL"));
	Kernel32ModuleBase = GetModuleHandle(_T("KERNEL32.DLL"));
	if (NtdllModuleBase == NULL || Kernel32ModuleBase == NULL) {

		KtCloseHandle(ProcessHandle);
		return 0;
	}
	//当前exe模块中没有该函数导入
	__NtCreateThreadEx = (LPFN_NTCREATETHREADEX)GetProcAddress(NtdllModuleBase,
		"NtCreateThreadEx");
	//__NtCreateThreadEx = ntdll.dll!0x00007ffb6580c0e0 (加载符号以获取其他信息)

	if (__NtCreateThreadEx == NULL)
	{
		KtCloseHandle(ProcessHandle);
		return 0;
	}
#ifdef UNICODE
	__LoadLibrary = (LPFN_LOADLIBRARYW)GetProcAddress(Kernel32ModuleBase, "LoadLibraryW");
#else
	__LoadLibrary = (LPFN_LOADLIBRARYA)GetProcAddress(Kernel32ModuleBase, "LoadLibraryA");
#endif
	//__LoadLibrary = kernel32.dll!0x00007ffb63c7e710 (加载符号以获取其他信息)
	if (__LoadLibrary == NULL) {

		KtCloseHandle(ProcessHandle);
		return 0;
	}
	ProcessHandle = KtOpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessId);
	ULONG BufferLength = 0;
	//在目标进程空间中申请内存
	BufferLength = (_tcslen(CurrentFullPath) + 1) * sizeof(TCHAR);
	//目标进程空间中申请内存
	VirtualAddress = VirtualAllocEx(ProcessHandle, NULL, BufferLength, MEM_COMMIT, PAGE_READWRITE);
	//VirtualAddress = 0x0000021819010000
	if (VirtualAddress == NULL)
	{
		KtCloseHandle(ProcessHandle);
		return 0;
	}
	//目标进程空间中写入数据
	if (KtProcessMemoryWriteSafe(ProcessHandle, VirtualAddress, CurrentFullPath, BufferLength, &ReturnLength) == FALSE)
	{
		KtCloseHandle(ProcessHandle);
		return 0;
	}
	//再目标进程中启动一个线程
	HANDLE ThreadHandle = INVALID_HANDLE_VALUE;
	IsOk = __NtCreateThreadEx(&ThreadHandle,
		THREAD_ALL_ACCESS, NULL, ProcessHandle, (LPTHREAD_START_ROUTINE)__LoadLibrary, VirtualAddress,
		FALSE, NULL, NULL, NULL, NULL);
	if (IsOk < 0) 
	{


		VirtualFreeEx(ProcessHandle, VirtualAddress, BufferLength, MEM_RELEASE);
		KtCloseHandle(ProcessHandle);
		return 0;
	}

	else
	{
		WaitForSingleObject(ThreadHandle, INFINITE);
		VirtualFreeEx(ProcessHandle, VirtualAddress, BufferLength, MEM_RELEASE);
		KtCloseHandle(ProcessHandle);
	}
	return 0;
}

//.dllmain
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#include <tchar.h>
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
	{
		MessageBox(NULL, _T("NtCreateThreadEx"), _T("NtCreateThreadEx"), NULL);
	}
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}