c# - 将 LPVOID 转换为结构

Question

我想读取我通过 CreateRemoteThread 发送到我在另一个进程中注入(inject)的 DLL 的参数。

我可以毫无问题地调用该函数，我只是不知道如何将 LPVOID 转换为结构。

这是一个例子:

#pragma pack(push,1)
struct tagRemoteThreadParams
{
    int Param1;
    int Param2;
} RemoteThreadParams, *PRemoteThreadParams;
#pragma pack(pop)

DWORD WINAPI testfunction(LPVOID param)
{
    // cast LPVOID to tagRemoteThreadParams (param)
    WriteToLog("YES YOU CALLED THE FUNCTION WITH PARAM: ");
    return 0;
}

这是我的结构以及我如何在进程中分配内存:

[StructLayout(LayoutKind.Sequential, Pack=1)]
public struct RemoteThreadParams
{
    [MarshalAs(UnmanagedType.I4)]
    public int Param1;

    [MarshalAs(UnmanagedType.I4)]
    public int Param2;
}

public uint CallFunction(int _arg1)
{
    RemoteThreadParams arguments = new RemoteThreadParams();
    arguments.Param1 = 1;
    arguments.Param2 = 2;

    //pointer to the function im trying to call
    IntPtr _functionPtr = IntPtr.Add(this.modulePtr, 69772);

    // Allocate some native heap memory in your process big enough to store the
    // parameter data
    IntPtr iptrtoparams = Marshal.AllocHGlobal(Marshal.SizeOf(arguments));

    // Copies the data in your structure into the native heap memory just allocated
    Marshal.StructureToPtr(arguments, iptrtoparams, false);

    //allocate som mem in remote process
    IntPtr lpAddress = VirtualAllocEx(this.processHandle, IntPtr.Zero, (IntPtr)Marshal.SizeOf(arguments), AllocationType.Commit | AllocationType.Reserve, MemoryProtection.ExecuteReadWrite);

    if (lpAddress == IntPtr.Zero)
    {
        return 0;
    }

    if (WriteProcessMemory(this.processHandle, lpAddress, iptrtoparams, (uint)Marshal.SizeOf(arguments), 0) == 0)
    {
        return 0;
    }
    //Free up memory
    Marshal.FreeHGlobal(iptrtoparams);

    uint threadID = 0;
    IntPtr hThread = CreateRemoteThread(this.processHandle, IntPtr.Zero, 0, _functionPtr, lpAddress, 0, out threadID);
    if (hThread == IntPtr.Zero)
    {
        //throw new ApplicationException(Marshal.GetLastWin32Error().ToString());
        throw new Win32Exception();
    }
    WaitForSingleObject(hThread, 0xFFFFFFFF);
    // wait for thread to exit


    // get the thread exit code
    uint exitCode = 0;
    GetExitCodeThread(hThread, out exitCode);

    // close thread handle
    CloseHandle(hThread);

    return exitCode;
}

Answer 1

如果我正确理解你的代码，你将 UT8 编码的字符串注入(inject)到对方的进程内存中(我很惊讶它能起作用)。

假设它确实有效，在您的 C++ 代码中，您需要将 param 指向的 UTF8 编码字节数组转换为 C++ 可以理解的某种字符串。

一种方法是使用 MultiByteToWideChar

另一种方法是使用STL。我发现了一个问题here .