c++ - 恢复由NtCreateProcessEx创建的进程

Question

在这里，我试图创建并运行calc，但是该过程是在suspended状态下创建的。这是主要代码:

#include <Windows.h>
#include <iostream>

using namespace std;

#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )

typedef struct _LSA_UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES
{
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;

typedef NTSTATUS(NTAPI* fpNtCreateProcessEx)
(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    ULONG Flags,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL,
    BOOLEAN InJob
    );

typedef NTSTATUS(NTAPI* fpNtCreateTransaction)
(
    PHANDLE TransactionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    LPGUID Uow,
    HANDLE TmHandle,
    ULONG CreateOptions,
    ULONG IsolationLevel,
    ULONG IsolationFlags,
    PLARGE_INTEGER Timeout,
    PUNICODE_STRING Description
    );

typedef NTSTATUS(NTAPI* fpNtCreateSection)
(
    PHANDLE SectionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection,
    ULONG AllocationAttributes,
    HANDLE FileHandle
    );
typedef NTSTATUS(NTAPI* fpNtClose)
(
    HANDLE Handle
    );

typedef LONG(NTAPI* fpNtResumeProcess)
(
    HANDLE ProcessHandle
    );

typedef LONG(NTAPI* fpNtResumeThread)
(
    HANDLE ProcessHandle
    );

#define PS_INHERIT_HANDLES 4

int main()
{
    HANDLE hProcess;
    OBJECT_ATTRIBUTES objattr;
    WCHAR wstrObjName[MAX_PATH];
    lstrcpyW(wstrObjName, L"C:\\Windows\\System32\\calc.exe");

    const HINSTANCE hinst = LoadLibrary(L"ntdll.dll");
    const auto _NtCreateTransaction = fpNtCreateTransaction(GetProcAddress(hinst, "NtCreateTransaction"));
    const auto _NtCreateSection = fpNtCreateSection(GetProcAddress(hinst, "NtCreateSection"));
    const auto _NtCreateProcessEx = fpNtCreateProcessEx(GetProcAddress(hinst, "NtCreateProcessEx"));
    const auto _NtResumeProcess = fpNtResumeProcess(GetProcAddress(hinst, "NtResumeProcess"));
    const auto _NtResumeThread = fpNtResumeThread(GetProcAddress(hinst, "NtResumeThread"));
    const auto _NtClose = fpNtClose(GetProcAddress(hinst, "NtClose"));

    wcslen(wstrObjName) * sizeof(WCHAR);

    objattr.Length = sizeof(OBJECT_ATTRIBUTES);
    objattr.Attributes = 0x00000040L;
    objattr.ObjectName = nullptr;
    objattr.RootDirectory = nullptr;
    objattr.SecurityDescriptor = nullptr;
    objattr.SecurityQualityOfService = nullptr;

    HANDLE hTransaction = nullptr;
    _NtCreateTransaction(&hTransaction, TRANSACTION_ALL_ACCESS, &objattr, nullptr, nullptr, 0, 0, 0, nullptr, nullptr);

    const HANDLE h_transacted_file = CreateFileTransacted(wstrObjName, GENERIC_WRITE | GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr, hTransaction, nullptr, nullptr);
    HANDLE hSection = nullptr;
    _NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, h_transacted_file);

    _NtCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, nullptr, NtCurrentProcess(), PS_INHERIT_HANDLES, hSection, nullptr, nullptr, false);
    const DWORD pid = GetProcessId(hProcess);

    ResumeThread(hProcess);

    printf("Pid = %d\n", pid);

    CloseHandle(h_transacted_file);
    _NtClose(hTransaction);
    _NtClose(hSection);
    _NtClose(hProcess);

    return 0;
}

这是我的ProcessExplorer:


我试过的

将#define PS_INHERIT_HANDLES 4更改为其他类似2、1或8的选项，但没有运气。

尝试通过ResumeThread(hProcess);，ResumeProcess(hProcess);或_NtResumeProcess(hProcess);恢复该过程，但不起作用。

尝试使用ProcessExplorer手动恢复过程，并且Process立即返回挂起状态。

将目标文件更改为其他文件。

我的问题是: 为什么我无法恢复此创建的过程？我怎样才能解决这个问题？

Answer 1

如果您没有弄清楚，您需要使用NtCreateThreadEx创建一个线程