WIN32 挂起创建进程 CREATE_SUSPENDED

#include "stdafx.h" #include <WINDOWS.H>

int main(int argc, char* argv[]) { SECURITY_ATTRIBUTES sa_p; sa_p.nLength = sizeof(sa_p); sa_p.lpSecurityDescriptor = NULL; sa_p.bInheritHandle = TRUE; SECURITY_ATTRIBUTES sa_t; sa_t.nLength = sizeof(sa_t); sa_t.lpSecurityDescriptor = NULL; sa_t.bInheritHandle = TRUE; STARTUPINFOA si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(si)); si.cb = sizeof(si); ZeroMemory(&pi, sizeof(pi)); //si.dwFlags = STARTF_USESHOWWINDOW; // 指定wShowWindow成员有效 //si.wShowWindow = TRUE; // 此成员设为TRUE的话则显示新建进程的主窗口，
    
    char s1[50] = {0}; char s2[255] = {0}; char szBuffer[256] = {0}; //TCHAR stcAppName[] = TEXT("C://Program Files//Internet Explorer//iexplore.exe");
    TCHAR stcAppName[] = TEXT("C:\\Windows\\SysWOW64\\notepad.exe"); BOOL res1 = CreateProcess(NULL,stcAppName,&sa_p,&sa_t,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi); if (!res1) { DWORD dwcode = GetLastError(); printf("%x\n",dwcode); } //打印入口值
 CONTEXT contx; contx.ContextFlags = CONTEXT_FULL; int    code = GetThreadContext(pi.hThread,&contx); printf("入口点：%x\n",contx.Eax); //获取ImageBase
    char* baseAddress = (CHAR *) contx.Ebx+8; memset(szBuffer,0,256); ReadProcessMemory(pi.hProcess,baseAddress,szBuffer,4,NULL); ResumeThread(pi.hThread); getchar(); printf("Hello World!\n"); return 0; }