我正在嘗試創(chuàng)建一個(gè)程序，利用MiniDumpWriteDumpWindows API 轉(zhuǎn)儲(chǔ)另一個(gè)進(jìn)程的內(nèi)存。但是，它不斷返回錯(cuò)誤并提示The handle is invalid。我對(duì)我的進(jìn)程句柄非常有信心，因?yàn)槲襉penProcess以前使用過 Windows API，所以我認(rèn)為這就是我使用CreateFileW.我在網(wǎng)上看過這樣的例子，但我無法讓任何東西發(fā)揮作用。到目前為止，這是我的代碼：package mainimport ( "fmt" "os" "strconv" "syscall" "unsafe")var kernel32 = syscall.NewLazyDLL("kernel32.dll")var procOpenProcess = kernel32.NewProc("OpenProcess")var procCreateFileW = kernel32.NewProc("CreateFileW")var procCloseHandle = kernel32.NewProc("CloseHandle")var dbghelp = syscall.NewLazyDLL("Dbghelp.dll")var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")func main() { fmt.Println("[ ] Starting Enum-DumpProcessMemory\n") pid, _ := strconv.Atoi(os.Args[1]) fmt.Println("[-] PID :", pid) processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid)) fmt.Println("[-] Process Handle :", processHandle) path, _ := syscall.UTF16PtrFromString(os.Args[2]) fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_READ, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0) fmt.Println("[-] File Handle :", fileHandle) ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0) if ret != 0 { fmt.Println("[+] Process memory dump successful") } else { fmt.Println("[x] Process memory dump not successful") fmt.Println(err) }}這是輸出：> .\Enum-DumpProcessMemory.exe 6892 C:\Users\user\Documents\dump.dmp[ ] Starting Enum-DumpProcessMemory[-] PID : 6892[-] Process Handle : 236[-] File Handle : 18446744073709551615[x] Process memory dump not successfulThe handle is invalid.
1 回答
鴻蒙傳說
TA貢獻(xiàn)1865條經(jīng)驗(yàn) 獲得超7個(gè)贊
問題是我試圖為不存在的文件創(chuàng)建處理程序。
這是我的工作代碼：
package main
import (
"fmt"
"os"
"strconv"
"syscall"
"unsafe"
)
var kernel32 = syscall.NewLazyDLL("kernel32.dll")
var procOpenProcess = kernel32.NewProc("OpenProcess")
var procCreateFileW = kernel32.NewProc("CreateFileW")
var dbghelp = syscall.NewLazyDLL("Dbghelp.dll")
var procMiniDumpWriteDump = dbghelp.NewProc("MiniDumpWriteDump")
func main() {
fmt.Println("[ ] Starting Enum-DumpProcessMemory\n")
pid, _ := strconv.Atoi(os.Args[1])
fmt.Println("[-] PID :", pid)
processHandle, _, _ := procOpenProcess.Call(uintptr(0xFFFF), uintptr(1), uintptr(pid))
fmt.Println("[-] Process Handle :", processHandle)
if _, err := os.Stat(os.Args[2]); os.IsNotExist(err) {
os.Create(os.Args[2])
}
path, _ := syscall.UTF16PtrFromString(os.Args[2])
fileHandle, _, _ := procCreateFileW.Call(uintptr(unsafe.Pointer(path)), syscall.GENERIC_WRITE, syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE, 0, syscall.OPEN_EXISTING, syscall.FILE_ATTRIBUTE_NORMAL, 0)
fmt.Println("[-] File Handle :", fileHandle)
ret, _, err := procMiniDumpWriteDump.Call(uintptr(processHandle), uintptr(pid), uintptr(fileHandle), 0x00061907, 0, 0, 0)
if ret != 0 {
fmt.Println("[+] Process memory dump successful")
} else {
fmt.Println("[x] Process memory dump not successful")
fmt.Println(err)
}
}
- 1 回答
- 0 關(guān)注
- 208 瀏覽
添加回答
舉報(bào)
0/150
提交
取消