c++ - 远程线程的 DuplicateHandle 失败，错误为 ERROR_INVALID_HANDLE

Question

您好，我试图挂起一个远程线程，但在途中我偶然发现 DuplicateHandle 失败并出现错误 6，ERROR_INVALID_HANDLE。

下面的方法适用于当前进程，但如果给出了像“calc”(在同一主机中)这样的远程进程，则 DuplicateHandle 会失败。

进程以 Admin priv 运行，SeDebugPriv 和 SeSecurityPriv 被授予(Process Explorer 确认)，但没有用。任何的想法？`

bool DbgHelpWrapper::GetThreadStartAddress( IntPtr processHandle, DWORD processId, DWORD threadID, DWORD *dwStartAddress )
{
    // Get ntdll entry points.
    HMODULE ntDLLHandle = LoadLibrary(L"ntdll.dll");
    tNtQueryInformationThread NtQueryInformationThread = (tNtQueryInformationThread)GetProcAddress(ntDLLHandle, "NtQueryInformationThread");

    // Open thread with wrong access rights.
    HANDLE hRemoteProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, processId );
    HANDLE hRemoteThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, threadID);

    if (hRemoteThread != 0 && hRemoteProcess != 0 )
    {
        try
        {
            // Duplicate handle to get correct access rights.
            HANDLE temporaryHandle = 0;
            DWORD duplicateHandleResult = DuplicateHandle(hRemoteProcess, hRemoteThread, GetCurrentProcess(),
                                                              &temporaryHandle, THREAD_QUERY_INFORMATION, FALSE, 0 );
            System::Console::WriteLine( String::Format("DuplicateHandle returned {0}", duplicateHandleResult ));
            System::Console::WriteLine( String::Format("DuplicateHandle error {0}", Marshal::GetLastWin32Error()));
            if (duplicateHandleResult != 0 )
            {
                try
                {
                    NTSTATUS ntStatus = NtQueryInformationThread(temporaryHandle, ThreadQuerySetWin32StartAddress, dwStartAddress, sizeof(DWORD), NULL);
                    System::Console::WriteLine( String::Format("NtQueryInformationThread returned {0}", ntStatus ));
                    if (ntStatus == 0)
                    {
                        System::Console::WriteLine( String::Format("StartAddress: {0:X16}", *dwStartAddress ));
                        return true;
                    }
                    else
                    {
                        System::Console::WriteLine( String::Format("NtQueryInformationThread error {0}", Marshal::GetLastWin32Error()));
                        return false;
                    }
                }
                finally
                {
                    CloseHandle(temporaryHandle);
                }
            }
            else
            {
                System::Console::WriteLine( String::Format("Cannot duplicate the thread handle to THREAD_QUERY_INFORMATION rights"));
                return false;
            }
        }
        finally
        {
            // Cleanup
            CloseHandle(hRemoteThread);
        }
    }
    else
    {
        System::Console::WriteLine( String::Format("Cannot open the thread with THREAD_SUSPEND_RESUME rights"));
        return FALSE;
    }
}

`

Answer 1

您告诉 DuplicateHandle hRemoteThread 是 hRemoteProcess 中的句柄，但它不是。它是您当前流程中的句柄 - 您之前几行打开了它。 (线程是远程进程的一部分，但它的句柄不是。)