//子进程要执行的代码void ChildProc(){    MessageBox(NULL, L"This is a child process!", L"DebugMe2", MB_OK);     ExitProcess(0);} //主函数void _tmain(int argc, TCHAR *argv[]){    TCHAR                   szPath[MAX_PATH] = { 0, };    STARTUPINFO                si = { sizeof(STARTUPINFO), };    PROCESS_INFORMATION        pi = { 0, };    CONTEXT                 ctx = { 0, };     _tprintf(L"This is a parent process!\n");     if (!GetModuleFileName(NULL, szPath, sizeof(TCHAR) * MAX_PATH))    {        printf("GetModuleFileName() failed! [%d]\n", GetLastError());        return;    }     // 创建子进程    if (!CreateProcess(        szPath,        NULL,        NULL,        NULL,        FALSE,        CREATE_SUSPENDED,        NULL,        NULL,        &si,        &pi))    {        printf("CreateProcess() failed! [%d]\n", GetLastError());        return;    }     // 修改EIP    ctx.ContextFlags = CONTEXT_FULL;    if (!GetThreadContext(pi.hThread, &ctx))    {        printf("GetThreadContext() failed! [%d]\n", GetLastError());        return;    }     ctx.Eip = (DWORD)ChildProc;     if (!SetThreadContext(pi.hThread, &ctx))    {        printf("SetThreadContext() failed! [%d]\n", GetLastError());        return;    }     // 恢复线程    if (-1 == ResumeThread(pi.hThread))    {        printf("ResumeThread() failed! [%d]\n", GetLastError());        return;    }     //等待返回    WaitForSingleObject(pi.hProcess, INFINITE);     CloseHandle(pi.hProcess);    CloseHandle(pi.hThread);}

# 往期推荐

1.CVE-2022-21882提权漏洞学习笔记

2.wibu证书 - 初探

3.win10 1909逆向之APIC中断和实验

4.EMET下EAF机制分析以及模拟实现

5.sql注入学习分享

6.V8 Array.prototype.concat函数出现过的issues和他们的POC们