如何解决WriteProcessMemory中的错误5

How can I solve error 5 from WriteProcessMemory?

本文关键字：错误 WriteProcessMemory 何解决 解决      更新时间：2024-03-28

我正在请求SE_DEBUG_NAME，但我仍然无法使用WriteProcessMemory((写入lsass.exe。我以管理员身份运行程序(将清单更改为"requireAdministrator"(。我试过我的程序，它确实写入svchost.exe、explorer.exe和chrome.exe，但只是没有写入lsass.exe。

#include <windows.h> 
#include <iostream> 

BOOL SetPrivilege(
HANDLE hToken,          // access token handle
LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
BOOL bEnablePrivilege   // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if (!LookupPrivilegeValue(
NULL,            // lookup privilege on local system
lpszPrivilege,   // privilege to lookup 
&luid))        // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %un", GetLastError());
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if (!AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,
(PDWORD)NULL))
{
printf("AdjustTokenPrivileges error: %un", GetLastError());
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printf("The token does not have the specified privilege. n");
return FALSE;
}
return TRUE;
}
void write()
{
std::string writing = "lmaoxd";
auto writing_size = sizeof(writing);
DWORD pID = 696;
HANDLE hToken;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
SetPrivilege(hToken, SE_DEBUG_NAME, TRUE);
CloseHandle(hToken);
HANDLE pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
WriteProcessMemory(pHandle, (LPVOID)0x1d72000391e, &writing, writing_size, 0);
CloseHandle(pHandle);
DWORD error = GetLastError();
std::cout << "Error: " << error << std::endl;
}
int main()
{
write();
system("pause");
}

我能做些什么来解决错误5？

Lsass是受保护的，它不是一个Admin进程，而是一个系统进程。只有从另一个系统进程才能(如果有的话(写入它。如果确实需要，请检查SysInternals psexec以启动您的进程作为系统。

https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

请尝试以下代码获取基地址，并使用VirtualProtectEx更改内存块上的页面保护。

代码示例：(对我有效(

#include <windows.h> 
#include <iostream> 
#include <tlhelp32.h>
#include <psapi.h>
DWORD_PTR GetProcessBaseAddress(DWORD processID)
{
DWORD_PTR   baseAddress = 0;
HANDLE      processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
HMODULE* moduleArray;
LPBYTE      moduleArrayBytes;
DWORD       bytesRequired;
if (processHandle)
{
if (EnumProcessModules(processHandle, NULL, 0, &bytesRequired))
{
if (bytesRequired)
{
moduleArrayBytes = (LPBYTE)LocalAlloc(LPTR, bytesRequired);
if (moduleArrayBytes)
{
unsigned int moduleCount;
moduleCount = bytesRequired / sizeof(HMODULE);
moduleArray = (HMODULE*)moduleArrayBytes;
if (EnumProcessModules(processHandle, moduleArray, bytesRequired, &bytesRequired))
{
baseAddress = (DWORD_PTR)moduleArray[0];
}
LocalFree(moduleArrayBytes);
}
}
}
CloseHandle(processHandle);
}
return baseAddress;
}
BOOL SetPrivilege(
HANDLE hToken,          // access token handle
LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
BOOL bEnablePrivilege   // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if (!LookupPrivilegeValue(
NULL,            // lookup privilege on local system
lpszPrivilege,   // privilege to lookup 
&luid))        // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %un", GetLastError());
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if (!AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES)NULL,
(PDWORD)NULL))
{
printf("AdjustTokenPrivileges error: %un", GetLastError());
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printf("The token does not have the specified privilege. n");
return FALSE;
}
return TRUE;
}
void write()
{
char writing[] = "lmaoxd";
int writing_size = sizeof(writing);
DWORD pID = 1092;  //pid of lsass.exe
HANDLE hToken;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
SetPrivilege(hToken, SE_DEBUG_NAME, TRUE);
CloseHandle(hToken);
HANDLE pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
DWORD h =  GetProcessBaseAddress(pID);
SetLastError(0);
DWORD oldProtect;
BOOL ret = VirtualProtectEx(pHandle, (LPVOID)h, writing_size, PAGE_READWRITE, &oldProtect);
DWORD error = GetLastError();
SetLastError(0);
ret = WriteProcessMemory(pHandle, (LPVOID)h, writing, writing_size, 0);
error = GetLastError();
std::cout << "Error: " << error << std::endl;
CloseHandle(pHandle);

}
int main()
{
write();
system("pause");
}

注意：请确保VS TOOL以管理员身份运行，并使用x64进行调试。

相关文章：