恢复由 NtCreateProcessEx 创建的进程

Question

我在这里尝试创建和运行 calc，但该进程是在 suspended 状态下创建的。这是主要代码：

#include <Windows.h>
#include <iostream>

using namespace std;

#define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 )

typedef struct _LSA_UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR Buffer;
} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES
{
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, * POBJECT_ATTRIBUTES;

typedef NTSTATUS(NTAPI* fpNtCreateProcessEx)
(
    PHANDLE ProcessHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    HANDLE ParentProcess,
    ULONG Flags,
    HANDLE SectionHandle OPTIONAL,
    HANDLE DebugPort OPTIONAL,
    HANDLE ExceptionPort OPTIONAL,
    BOOLEAN InJob
    );

typedef NTSTATUS(NTAPI* fpNtCreateTransaction)
(
    PHANDLE TransactionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    LPGUID Uow,
    HANDLE TmHandle,
    ULONG CreateOptions,
    ULONG IsolationLevel,
    ULONG IsolationFlags,
    PLARGE_INTEGER Timeout,
    PUNICODE_STRING Description
    );

typedef NTSTATUS(NTAPI* fpNtCreateSection)
(
    PHANDLE SectionHandle,
    ACCESS_MASK DesiredAccess,
    POBJECT_ATTRIBUTES ObjectAttributes,
    PLARGE_INTEGER MaximumSize,
    ULONG SectionPageProtection,
    ULONG AllocationAttributes,
    HANDLE FileHandle
    );
typedef NTSTATUS(NTAPI* fpNtClose)
(
    HANDLE Handle
    );

typedef LONG(NTAPI* fpNtResumeProcess)
(
    HANDLE ProcessHandle
    );

typedef LONG(NTAPI* fpNtResumeThread)
(
    HANDLE ProcessHandle
    );

#define PS_INHERIT_HANDLES 4

int main()
{
    HANDLE hProcess;
    OBJECT_ATTRIBUTES objattr;
    WCHAR wstrObjName[MAX_PATH];
    lstrcpyW(wstrObjName, L"C:\\Windows\\System32\\calc.exe");

    const HINSTANCE hinst = LoadLibrary(L"ntdll.dll");
    const auto _NtCreateTransaction = fpNtCreateTransaction(GetProcAddress(hinst, "NtCreateTransaction"));
    const auto _NtCreateSection = fpNtCreateSection(GetProcAddress(hinst, "NtCreateSection"));
    const auto _NtCreateProcessEx = fpNtCreateProcessEx(GetProcAddress(hinst, "NtCreateProcessEx"));
    const auto _NtResumeProcess = fpNtResumeProcess(GetProcAddress(hinst, "NtResumeProcess"));
    const auto _NtResumeThread = fpNtResumeThread(GetProcAddress(hinst, "NtResumeThread"));
    const auto _NtClose = fpNtClose(GetProcAddress(hinst, "NtClose"));

    wcslen(wstrObjName) * sizeof(WCHAR);

    objattr.Length = sizeof(OBJECT_ATTRIBUTES);
    objattr.Attributes = 0x00000040L;
    objattr.ObjectName = nullptr;
    objattr.RootDirectory = nullptr;
    objattr.SecurityDescriptor = nullptr;
    objattr.SecurityQualityOfService = nullptr;

    HANDLE hTransaction = nullptr;
    _NtCreateTransaction(&hTransaction, TRANSACTION_ALL_ACCESS, &objattr, nullptr, nullptr, 0, 0, 0, nullptr, nullptr);

    const HANDLE h_transacted_file = CreateFileTransacted(wstrObjName, GENERIC_WRITE | GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr, hTransaction, nullptr, nullptr);
    HANDLE hSection = nullptr;
    _NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, h_transacted_file);

    _NtCreateProcessEx(&hProcess, PROCESS_ALL_ACCESS, nullptr, NtCurrentProcess(), PS_INHERIT_HANDLES, hSection, nullptr, nullptr, false);
    const DWORD pid = GetProcessId(hProcess);

    ResumeThread(hProcess);

    printf("Pid = %d\n", pid);

    CloseHandle(h_transacted_file);
    _NtClose(hTransaction);
    _NtClose(hSection);
    _NtClose(hProcess);

    return 0;
}

这是我的 ProcessExplorer：

我尝试过的：

1. 将 #define PS_INHERIT_HANDLES 4 更改为 2、1 或 8 之类的其他值，但没有运气。
2. 尝试通过ResumeThread(hProcess);、ResumeProcess(hProcess); 或_NtResumeProcess(hProcess); 恢复进程，但不起作用。
3. 尝试使用 ProcessExplorer 手动恢复进程，进程立即返回挂起状态。
4. 将我的目标文件更改为其他文件。

我的问题是：为什么我不能恢复这个创建的进程？我该如何解决这个问题？

Answer 1

如果你没弄明白，你需要使用 NtCreateThreadEx 创建一个线程