CIR_OK=0 - OK, CIR_AlreadyInjected=1 - Already injected, иначе - ошибка Здесь вызывается CreateRemoteThread
| 385 | // CIR_OK=0 - OK, CIR_AlreadyInjected=1 - Already injected, иначе - ошибка |
| 386 | // Здесь вызывается CreateRemoteThread |
| 387 | CINFILTRATE_EXIT_CODES InjectRemote(DWORD nRemotePID, bool abDefTermOnly /*= false */, LPDWORD pnErrCode /*= nullptr*/) |
| 388 | { |
| 389 | CINFILTRATE_EXIT_CODES iRc = CIR_GeneralError/*-1*/; |
| 390 | DWORD nErrCode = 0; |
| 391 | const bool lbWin64 = WIN3264TEST((IsWindows64()!=0),true); |
| 392 | // ReSharper disable once CppJoinDeclarationAndAssignment |
| 393 | bool is32Bit = false; |
| 394 | // ReSharper disable once CppJoinDeclarationAndAssignment |
| 395 | int nBits = 0; |
| 396 | DWORD nWrapperWait = static_cast<DWORD>(-1); |
| 397 | DWORD nWrapperResult = static_cast<DWORD>(-1); |
| 398 | HANDLE hProc = nullptr; |
| 399 | HANDLE hProcInfo = nullptr; |
| 400 | DWORD nProcWait = static_cast<DWORD>(-1); |
| 401 | DWORD nProcExitCode = static_cast<DWORD>(-1); |
| 402 | wchar_t szSelf[MAX_PATH + 16] = L""; |
| 403 | wchar_t szHooks[MAX_PATH + 16] = L""; |
| 404 | wchar_t* pszNamePtr = nullptr; |
| 405 | wchar_t szArgs[32] = L""; |
| 406 | wchar_t szName[64] = L""; |
| 407 | wchar_t szKernelName[64] = L""; |
| 408 | HANDLE hEvent = nullptr; |
| 409 | HANDLE hDefTermReady = nullptr; |
| 410 | bool bAlreadyHooked = false; |
| 411 | HMODULE ptrOuterKernel = nullptr; |
| 412 | |
| 413 | { |
| 414 | wchar_t szLog[128]; |
| 415 | swprintf_c(szLog, L"...OpenProcess(preliminary) PID=%u", nRemotePID); |
| 416 | LogString(szLog); |
| 417 | HANDLE h = OpenProcess(SYNCHRONIZE |
| 418 | |PROCESS_QUERY_INFORMATION|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION|PROCESS_VM_WRITE|PROCESS_VM_READ, |
| 419 | FALSE, nRemotePID); |
| 420 | if (h) |
| 421 | { |
| 422 | hProc = h; |
| 423 | } |
| 424 | else |
| 425 | { |
| 426 | h = OpenProcess(PROCESS_QUERY_INFORMATION|SYNCHRONIZE, FALSE, nRemotePID); |
| 427 | if ((h == nullptr) && IsWin6()) |
| 428 | { |
| 429 | // PROCESS_QUERY_LIMITED_INFORMATION not defined in GCC |
| 430 | h = OpenProcess(SYNCHRONIZE|0x1000/*PROCESS_QUERY_LIMITED_INFORMATION*/, FALSE, nRemotePID); |
| 431 | } |
| 432 | } |
| 433 | if (h) |
| 434 | { |
| 435 | hProcInfo = h; |
| 436 | nProcWait = WaitForSingleObject(h, 0); |
| 437 | if (nProcWait == WAIT_OBJECT_0) |
| 438 | { |
| 439 | // Process was terminated already, injection was not in time? |
| 440 | GetExitCodeProcess(h, &nProcExitCode); |
| 441 | swprintf_c(szLog, L"Process PID=%u was already terminated, exitcode=%u, exiting", nRemotePID, nProcExitCode); |
| 442 | LogString(szLog); |
| 443 | iRc = CIR_ProcessWasTerminated/*-205*/; |
| 444 | goto wrap; |
no test coverage detected