| 470 | // ============================================================================= |
| 471 | |
| 472 | void TestProcessSpawnWithSetThreadContext() { |
| 473 | printf("\n=== TEST 4: Process Spawn with SetThreadContext Injection ===\n\n"); |
| 474 | |
| 475 | STARTUPINFOA si = { 0 }; |
| 476 | PROCESS_INFORMATION pi = { 0 }; |
| 477 | si.cb = sizeof(si); |
| 478 | |
| 479 | printf("[Main] Spawning child process (notepad.exe) in suspended state...\n"); |
| 480 | if (!CreateProcessA( |
| 481 | "C:\\Windows\\System32\\notepad.exe", |
| 482 | NULL, |
| 483 | NULL, |
| 484 | NULL, |
| 485 | FALSE, |
| 486 | CREATE_SUSPENDED, |
| 487 | NULL, |
| 488 | NULL, |
| 489 | &si, |
| 490 | &pi)) { |
| 491 | printf("[!] CreateProcess failed: %lu\n", GetLastError()); |
| 492 | return; |
| 493 | } |
| 494 | |
| 495 | printf("[Main] Process created - PID: %lu, TID: %lu\n", pi.dwProcessId, pi.dwThreadId); |
| 496 | |
| 497 | // Allocate memory in the target process |
| 498 | SIZE_T shellcodeSize = sizeof(g_dummyShellcode); |
| 499 | LPVOID pRemoteMemory = VirtualAllocEx( |
| 500 | pi.hProcess, |
| 501 | NULL, |
| 502 | shellcodeSize, |
| 503 | MEM_COMMIT | MEM_RESERVE, |
| 504 | PAGE_READWRITE); |
| 505 | |
| 506 | if (!pRemoteMemory) { |
| 507 | printf("[!] VirtualAllocEx failed: %lu\n", GetLastError()); |
| 508 | TerminateProcess(pi.hProcess, 1); |
| 509 | CloseHandle(pi.hProcess); |
| 510 | CloseHandle(pi.hThread); |
| 511 | return; |
| 512 | } |
| 513 | |
| 514 | printf("[Main] Allocated %zu bytes at 0x%p in target process\n", |
| 515 | shellcodeSize, pRemoteMemory); |
| 516 | |
| 517 | // Write shellcode to the allocated memory |
| 518 | SIZE_T bytesWritten = 0; |
| 519 | if (!WriteProcessMemory( |
| 520 | pi.hProcess, |
| 521 | pRemoteMemory, |
| 522 | g_dummyShellcode, |
| 523 | shellcodeSize, |
| 524 | &bytesWritten)) { |
| 525 | printf("[!] WriteProcessMemory failed: %lu\n", GetLastError()); |
| 526 | VirtualFreeEx(pi.hProcess, pRemoteMemory, 0, MEM_RELEASE); |
| 527 | TerminateProcess(pi.hProcess, 1); |
| 528 | CloseHandle(pi.hProcess); |
| 529 | CloseHandle(pi.hThread); |