int main(int argv,char* argc)

{

PROCESS_INFORMATION pi;

STARTUPINFO si;

ZeroMemory(&si,sizeof(STARTUPINFO));

si.cb = sizeof(STARTUPINFO);

si.wShowWindow = SW_NORMAL;

CreateProcess("d:\\winnt\\system32\\calc.exe","",NULL,NULL,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);

CONTEXT c;

c.ContextFlags = CONTEXT_FULL;

HANDLE h = OpenThread(THREAD_QUERY_INFORMATION | THREAD_GET_CONTEXT | THREAD_SET_CONTEXT, TRUE, pi.dwThreadId);

BOOL res = GetThreadContext(h,&c);

}

7C810867 kernel32.BaseProcessStartThunk      33ED            XOR     EBP, EBP

7C810869                                     50              PUSH    EAX

7C81086A                                     6A 00           PUSH    0

7C81086C                                     E9 BB640000     JMP     kernel32.BaseProcessStart

#include <windows.h>

#include <stdio.h>

#pragma argsused

int main(int argv,char* argc)

{

PROCESS_INFORMATION pi;

STARTUPINFO si;

CONTEXT c;

ULONG myEip;

ZeroMemory(&si,sizeof(STARTUPINFO));

si.cb = sizeof(STARTUPINFO);

si.wShowWindow = SW_NORMAL;

CreateProcess("C:\\Windows\\system32\\calc.exe","",NULL,NULL,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);

GetThreadContext(pi.hThread,&c);

myEip = c.Eip;

printf("the eip after create process is %x",myEip);

//c.ContextFlags = CONTEXT_FULL;

//HANDLE h = OpenThread(THREAD_QUERY_INFORMATION | THREAD_GET_CONTEXT | THREAD_SET_CONTEXT, TRUE, pi.dwThreadId);

//BOOL res = GetThreadContext(h,&c);

}

kd> g

Break instruction exception - code 80000003 (first chance)

01012420 cc              int     3

kd> !process -1 0

PROCESS ffaa7d60  SessionId: 0  Cid: 037c    Peb: 7ffdf000  ParentCid: 0390

    DirBase: 026b0000  ObjectTable: ffabff48  TableSize:  20.

    Image: calc.exe



kd> g

#include <windows.h>

#include <stdio.h>

#pragma argsused

int main(int argv,char* argc)

{

	char 			buffer[200]	= {0};

	PROCESS_INFORMATION	pi		= {0};

	STARTUPINFO 		si 		= {0};

	CONTEXT 		c  		= {0};

	ULONG 			myEip;

	LPVOID			base;

	char			wrbuff[20]	= {0xcc};

	char 			wxppath[]	= {"c:\\windows\\system32\\calc.exe"};

	char			w2kpath[]	= {"c:\\winnt\\system32\\calc.exe"};

	int 			wxpeip		= 0x1012475;

	int			w2keip		= 0x1012420;

	int			result;

	char 			path[MAX_PATH];

	int 			eip;



	

	result = MessageBox(NULL,"CHOOSE YES IF OS == WINXP  or NO if OS == W2k","os chooser",MB_YESNO | MB_ICONQUESTION);

	if(result == IDYES)

	{

		strncpy(path,wxppath,MAX_PATH-1);

		eip = wxpeip;

	}

	else if(result == IDNO)

	{

		strncpy(path,w2kpath,MAX_PATH-1);

		eip = w2keip;

	}

		

	c.ContextFlags = CONTEXT_FULL;

	si.cb = sizeof(STARTUPINFO);

	si.wShowWindow = SW_NORMAL;

	CreateProcess(path,NULL,NULL,NULL,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);

	GetThreadContext(pi.hThread,&c);

	myEip = c.Eip;

	sprintf(buffer,"the eip after create process is %x",myEip);

	MessageBox(0,buffer,"the eip register",0);

	(int)base = eip;

	WriteProcessMemory(pi.hProcess,base,&wrbuff,1,NULL);

	ResumeThread(pi.hThread);

}

c.Context_Flags = CONTEXT_FULL | CONTEXT_DEBUG_REGISTERS

GetThreadContext(pi.hThread,&c);

c.Dr0 = "YOUR ADDRESS OF EIP"

SetThreadContext(pi.Hthread,&c)

ResumeTHread(pi.hThread);

0012F740  |hProcess = 00000050 (window)

0012F744  |Address = kernel32.7C810867

0012F748  |Buffer = 0012F75C

0012F74C  \BufSize = 1C (28.)



before

0012F75C     00000000    00000000    00000000    00000000

0012F76C     00000000    00000000    00000000



after



0012F75C     7C810000    00000000    00000000    000F0000

0012F76C     00010000    00000001    00000000





so you cant change the protection status and write an 0xcc also to initial eip pointed by GetThreadContext()



i spalshed the code to printf the results 

and the eip after Resuspension is kiFastSystemCallRet and thats fine



>w2khero.exe

you chose winxp as your os

the eip after create process is 7c810867

the Dr0 after resuspending is 1012475

the eip after resuspending process is 7c90eb94



>



in w2k 

C:\DOCUME~1\ADMINI~1\Desktop>w2khero

you chose w2k as your os

the eip after create process is 7c4e87b3

the Dr0 after resuspending is 1012420

the eip after resuspending process is 77e12f5c



and 77e12f5c in w2k is return from ntuserGetmessage and thats fine too

77E12F51 _NtUserGetMes> B8 9A110000      MOV EAX,119A

77E12F56                8D5424 04        LEA EDX,DWORD PTR SS:[ESP+4]

77E12F5A                CD 2E            INT 2E

77E12F5C                C2 1000          RETN 10 <---------



Call stack of main thread, item 0

 Address=0006FDEC

 Stack=77E12F86

 Procedure / arguments=USER32._NtUserGetMessage@16

 Called from=USER32.77E12F81

 Frame=0006FE04









C:\DOCUME~1\ADMINI~1\Desktop>

#include <windows.h>

#include <stdio.h>

#pragma argsused

int main(int argv,char* argc)

{

	char 				buffer[200]	= {0};

	PROCESS_INFORMATION		pi		= {0};

	STARTUPINFO 			si 		= {0};

	CONTEXT 			c  		= {0};

	CONTEXT 			cnew  		= {0};

	ULONG 				myEip;

	ULONG				myDr0;

	LPVOID				base;

	char				wrbuff[20]	= {0xcc};

	char 				wxppath[]	= {"c:\\windows\\system32\\calc.exe"};

	char				w2kpath[]	= {"c:\\winnt\\system32\\calc.exe"};

	int 				wxpeip		= 0x1012475;

	int				w2keip		= 0x1012420;

	int				result;

	char 				path[MAX_PATH]	= {0};

	int 				eip;

	void 				*status;

	MEMORY_BASIC_INFORMATION	mbi		= {0};

	DWORD				lpOld;



	

	result = MessageBox(NULL,"CHOOSE YES IF OS == WINXP  or NO if OS == W2k","os chooser",MB_YESNO | MB_ICONQUESTION);

	if(result == IDYES)

	{

		strncpy(path,wxppath,MAX_PATH-1);

		eip = wxpeip;

		printf("you chose winxp as your os\n";

	}

	else if(result == IDNO)

	{

		strncpy(path,w2kpath,MAX_PATH-1);

		eip = w2keip;

		printf("you chose w2k as your os\n";

	}

		

	c.ContextFlags = CONTEXT_FULL|CONTEXT_DEBUG_REGISTERS;

	si.cb = sizeof(STARTUPINFO);

	si.wShowWindow = SW_NORMAL;

	CreateProcess(path,NULL,NULL,NULL,TRUE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);

	GetThreadContext(pi.hThread,&c);

	myEip = c.Eip;

	sprintf(buffer,"the eip after create process is %x",myEip);

	printf(buffer);

	printf("\n";

	MessageBox(0,buffer,"the eip register",0);

	(int)base = myEip;

	c.Dr0 = eip;

	SetThreadContext(pi.hThread,&c);

	VirtualQueryEx(pi.hProcess,(LPCVOID)myEip,&mbi,sizeof(mbi));

	VirtualProtectEx(pi.hProcess,mbi.BaseAddress,mbi.RegionSize,PAGE_EXECUTE_READWRITE,&lpOld);

	WriteProcessMemory(pi.hProcess,base,&wrbuff,1,NULL);

	VirtualProtectEx(pi.hProcess,mbi.BaseAddress,mbi.RegionSize,lpOld,&lpOld);

	ResumeThread(pi.hThread);

	Sleep(5000);

	SuspendThread(pi.hThread);

	cnew.ContextFlags = CONTEXT_FULL|CONTEXT_DEBUG_REGISTERS;

	GetThreadContext(pi.hThread,&cnew);

	myDr0 = cnew.Dr0;

	myEip = cnew.Eip;

	sprintf(buffer,"the Dr0 after resuspending is %x",myDr0);

	MessageBox(0,buffer,"the eip register",0);



	printf(buffer);

	printf("\n";

	

	sprintf(buffer,"the eip after resuspending process is %x",myEip);

	MessageBox(0,buffer,"the eip register",0);

	printf(buffer);

	printf("\n";

	ResumeThread(pi.hThread);	

}