| 254 | // ============================================================================= |
| 255 | |
| 256 | void TestProcessSpawnWithShellcode() { |
| 257 | printf("\n=== TEST 2: Process Spawn with Shellcode Allocation ===\n\n"); |
| 258 | |
| 259 | STARTUPINFOA si = { 0 }; |
| 260 | PROCESS_INFORMATION pi = { 0 }; |
| 261 | si.cb = sizeof(si); |
| 262 | |
| 263 | // Spawn notepad as a target process |
| 264 | printf("[Main] Spawning child process (notepad.exe)...\n"); |
| 265 | if (!CreateProcessA( |
| 266 | "C:\\Windows\\System32\\notepad.exe", |
| 267 | NULL, |
| 268 | NULL, |
| 269 | NULL, |
| 270 | FALSE, |
| 271 | CREATE_SUSPENDED, |
| 272 | NULL, |
| 273 | NULL, |
| 274 | &si, |
| 275 | &pi)) { |
| 276 | printf("[!] CreateProcess failed: %lu\n", GetLastError()); |
| 277 | return; |
| 278 | } |
| 279 | |
| 280 | printf("[Main] Process created - PID: %lu, TID: %lu\n", pi.dwProcessId, pi.dwThreadId); |
| 281 | |
| 282 | // Allocate memory in the target process |
| 283 | SIZE_T shellcodeSize = sizeof(g_dummyShellcode); |
| 284 | LPVOID pRemoteMemory = VirtualAllocEx( |
| 285 | pi.hProcess, |
| 286 | NULL, |
| 287 | shellcodeSize, |
| 288 | MEM_COMMIT | MEM_RESERVE, |
| 289 | PAGE_EXECUTE_READWRITE); |
| 290 | |
| 291 | if (!pRemoteMemory) { |
| 292 | printf("[!] VirtualAllocEx failed: %lu\n", GetLastError()); |
| 293 | TerminateProcess(pi.hProcess, 1); |
| 294 | CloseHandle(pi.hProcess); |
| 295 | CloseHandle(pi.hThread); |
| 296 | return; |
| 297 | } |
| 298 | |
| 299 | printf("[Main] Allocated %zu bytes at 0x%p in target process\n", |
| 300 | shellcodeSize, pRemoteMemory); |
| 301 | |
| 302 | // Write shellcode to the allocated memory |
| 303 | SIZE_T bytesWritten = 0; |
| 304 | if (!WriteProcessMemory( |
| 305 | pi.hProcess, |
| 306 | pRemoteMemory, |
| 307 | g_dummyShellcode, |
| 308 | shellcodeSize, |
| 309 | &bytesWritten)) { |
| 310 | printf("[!] WriteProcessMemory failed: %lu\n", GetLastError()); |
| 311 | VirtualFreeEx(pi.hProcess, pRemoteMemory, 0, MEM_RELEASE); |
| 312 | TerminateProcess(pi.hProcess, 1); |
| 313 | CloseHandle(pi.hProcess); |