CreateRemoteThread 32-> 64 and / or 64-> 32

I need a CreateRemoteThread method in x64 windows for 64-bit and 32-bit processes. I developed how to find a set of commands for the target process, how to allocate memory in the target process for assembly skids, and I almost decided what to do with the randomization of the address space.

I do not know how to actually start a thread in a remote process when it has the wrong instruction set.

Note: I don’t care which of the two problems you solve. My own exe can be 32 or 64 bits (but I really need to choose before I know the number of bits of the target process).

Before anyone complains that I really don't need to do this, ask Microsoft why I need to install FILE_SHARE_DELETEon all open descriptors before I can delete the file that is being used. No, you do not need to delete files opened by another process.

+3
source share
3 answers

CreateRemoteThread 32-> 64 does not work.

CreateRemoteThread 64-> 32 works.

+3
source

, , , , , , , FILE_SHARE_DELETE. , , , . .

If you are configured for remote flow, see workarounds on the MSDN page ; maybe there is inspiration. You can also consider that only brute force kills other processes (first at first, if necessary, as needed), since you still need access to the admin, and evading their internal handles may not leave them in good condition. What installers do (or ask the user to do) when they need to replace open files without rebooting.

+2
source

Source: https://habr.com/ru/post/1702451/


All Articles