#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <winnt.h>
#include <tlhelp32.h>
#include <psapi.h>
#include <tchar.h>
#define DIE_IFNOT(cond, msg) if(!(cond)) fprintf(stderr, "%s\n", msg), exit(1);

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage);
HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName);
FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName);
void PrintProcessNameAndID(DWORD processID);
int PrintModules(DWORD processID);

static DWORD dwCRT; // address of CreateRemoteThread

int main()
{
 DWORD aProcesses[1024];
 DWORD cbNeeded;
 DWORD cProcesses;
 DWORD PID;
 unsigned int i, count;

 CreateRemoteThread(0, 0, 0, 0, 0, 0, 0); // Test
 // Get the list of process identifiers.
 if (!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded))
  return 1;

 // Calculate how many process identifiers were returned.

 cProcesses = cbNeeded / sizeof(DWORD);
 count = 1;
 for (i = 0; i < cProcesses; i++)
 {
  if (aProcesses[i] != 0)
  {
   printf("- . ", count);
   PrintProcessNameAndID(aProcesses[i]);
   count++;
  }
  if (count % 80 == 0) system("pause");
 }

 DWORD dwProcessId;
 printf("Process ID (Current = %d): ", GetCurrentProcessId());
 if (scanf("%u", &dwProcessId) < 1) return 1;

 PrintModules(dwProcessId);
 
 HMODULE hModRemote;
 printf("EXE/DLL Base Address: 0x");
 if (scanf("%p", &hModRemote) < 1) return 1;

 

 dwCRT = (DWORD)RemoteGetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), RemoteGetModuleHandle(dwProcessId, "kernel32.dll"), "CreateRemoteThread");

 HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
 DisplayImportTableEx(hProcess, hModRemote);
 CloseHandle(hProcess);
}

void DisplayImportTableEx(HANDLE hProcess, HMODULE hModImage)
{
 DWORD cbRead;
 IMAGE_DOS_HEADER idh;
 DIE_IFNOT(ReadProcessMemory(hProcess, hModImage, &idh, sizeof idh, &cbRead), "[!] Failed to read process memory!");
 DIE_IFNOT(idh.e_magic == IMAGE_DOS_SIGNATURE, "[!] Invalid DOS Signature!");

 IMAGE_NT_HEADERS inh;
 DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + idh.e_lfanew, &inh, sizeof inh, &cbRead), "[!] Failed to read process memory!");
 DIE_IFNOT(inh.Signature == IMAGE_NT_SIGNATURE, "[!] Invalid PE Signature!");

 IMAGE_DATA_DIRECTORY dirImport = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
 DIE_IFNOT(dirImport.VirtualAddress && dirImport.Size, "[!] No Import Table Found!");

 PIMAGE_IMPORT_DESCRIPTOR lpImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((PCHAR)hModImage + dirImport.VirtualAddress);
 IMAGE_IMPORT_DESCRIPTOR impDesc;
 DIE_IFNOT(ReadProcessMemory(hProcess, lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
 while (impDesc.Characteristics) {
  CHAR szImportDllName[MAX_PATH];
  DIE_IFNOT(ReadProcessMemory(hProcess, (PCHAR)hModImage + impDesc.Name, szImportDllName, sizeof szImportDllName, &cbRead), "[!] Failed to read process memory!");
  printf("[+] %s\n", szImportDllName);

  PIMAGE_THUNK_DATA lpImportThunk = (PIMAGE_THUNK_DATA)((PCHAR)hModImage + lpImportDesc->FirstThunk);
  IMAGE_THUNK_DATA impThunk;
  DIE_IFNOT(ReadProcessMemory(hProcess, lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
  while (impThunk.u1.Function) {
   printf("\t[+] Function: 0xlX", impThunk.u1.Function);

   if ((DWORD)impThunk.u1.Function == dwCRT) {
    printf(" (Gotcha! This is CreateRemoteThread)");
   }

   putchar('\n');
   DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportThunk, &impThunk, sizeof impThunk, &cbRead), "[!] Failed to read process memory!");
  }

  DIE_IFNOT(ReadProcessMemory(hProcess, ++lpImportDesc, &impDesc, sizeof impDesc, &cbRead), "[!] Failed to read process memory!");
 }
}

HMODULE RemoteGetModuleHandle(DWORD dwProcessId, LPCSTR lpModuleName) {
 HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
 if (hSnapshot != INVALID_HANDLE_VALUE) {
  MODULEENTRY32 me = { sizeof(MODULEENTRY32) };
  BOOL bRet = Module32First(hSnapshot, &me);
  while (bRet) {
   if (!strcmpi((const char *)me.szModule, lpModuleName))
    return me.hModule;
   bRet = Module32Next(hSnapshot, &me);
  }
  CloseHandle(hSnapshot);
 }
 return NULL;
}

FARPROC RemoteGetProcAddress(HMODULE hModule, HMODULE hModuleRemote, LPCSTR lpProcName) {
 FARPROC fp = GetProcAddress(hModule, lpProcName);
 if (!fp) return NULL;

 return (FARPROC)((PCHAR)fp - (PCHAR)hModule + (PCHAR)hModuleRemote);
}


void PrintProcessNameAndID(DWORD processID)
{

 TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>");

 // Get a handle to the process.

 HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION |
  PROCESS_VM_READ,
  FALSE, processID);

 // Get the process name.

 if (NULL != hProcess)
 {
  HMODULE hMod;
  DWORD cbNeeded;

  if (EnumProcessModules(hProcess, &hMod, sizeof(hMod),
   &cbNeeded))
  {
   GetModuleBaseName(hProcess, hMod, szProcessName,
    sizeof(szProcessName) / sizeof(TCHAR));
  }
 }

 // Print the process name and identifier.

 _tprintf(TEXT("%s  (PID: %u)\n"), szProcessName, processID);

 // Release the handle to the process.

 CloseHandle(hProcess);
}


int PrintModules(DWORD processID)
{
 HMODULE hMods[1024];
 HANDLE hProcess;
 DWORD cbNeeded;
 unsigned int i;

 // Print the process identifier.

 printf("\nProcess ID: %u\n", processID);

 // Get a handle to the process.

 hProcess = OpenProcess(PROCESS_QUERY_INFORMATION |
  PROCESS_VM_READ,
  FALSE, processID);
 if (NULL == hProcess)
  return 1;

 // Get a list of all the modules in this process.

 if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
 {
  for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++)
  {
   TCHAR szModName[MAX_PATH];

   // Get the full path to the module's file.

   if (GetModuleFileNameEx(hProcess, hMods[i], szModName,
    sizeof(szModName) / sizeof(TCHAR)))
   {
    // Print the module name and handle value.

    _tprintf(TEXT("\t%s (0xX)\n"), szModName, hMods[i]);
   }
  }
 }

 // Release the handle to the process.

 CloseHandle(hProcess);

 return 0;
}



여전히 다른프로세스 못갖고오는데 어떡해요