Skip to content
This repository was archived by the owner on Feb 18, 2026. It is now read-only.

Commit b6dfff2

Browse files
kaveOOkaveOO
committed
+ | Added Threat and Process classes with main functionality for thread hijacking
1 parent 3521161 commit b6dfff2

7 files changed

Lines changed: 158 additions & 49 deletions

File tree

‎Threat/Main.cpp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#include "Threat.hpp"
2+
3+
int main() {
4+
Threat threat(L"Target.exe");
5+
6+
threat.DebugPrint();
7+
threat.Hijack();
8+
}

‎Threat/Process.cpp‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Process::Process(const wchar_t *processName) {
77

88
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
99
if (hSnapshot == INVALID_HANDLE_VALUE) {
10-
std::cerr << "Failed to create snapshot of processes" << std::endl;
10+
std::cerr << "Failed to snapshot processes: " << GetLastError() << std::endl;
1111
return;
1212
}
1313

@@ -22,21 +22,19 @@ Process::Process(const wchar_t *processName) {
2222
hResult = Process32Next(hSnapshot, &processEntry);
2323
}
2424

25+
CloseHandle(hSnapshot);
26+
2527
if (processId == 0) {
26-
std::wcerr << "Failed to find " << processName << std::endl;
28+
std::cerr << "[ ERROR ] Failed to get processId: " << GetLastError() << std::endl;
29+
return;
2730
}
2831

29-
CloseHandle(hSnapshot);
32+
hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
33+
if (!hProcess) {
34+
std::cerr << "[ ERROR ] OpenProcess: " << GetLastError() << std::endl;
35+
return;
36+
}
3037
}
3138

3239
Process::~Process() {
33-
CloseHandle(hProcess);
34-
}
35-
36-
DWORD Process::GetProcessId() const {
37-
return processId;
38-
}
39-
40-
HANDLE Process::GetProcessHandle() const {
41-
return hProcess;
4240
}

‎Threat/Process.hpp‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,11 @@
55
#include <TlHelp32.h>
66

77
class Process {
8-
private:
8+
protected:
99
DWORD processId = 0;
1010
HANDLE hProcess = NULL;
1111
public:
1212
Process() = delete;
1313
Process(const wchar_t *processName);
1414
~Process();
15-
16-
DWORD GetProcessId() const;
17-
HANDLE GetProcessHandle() const;
1815
};

‎Threat/Threat.cpp‎

Lines changed: 96 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,118 @@
1-
#include <iostream>
2-
#include <Windows.h>
3-
#include <ios>
1+
#include "Threat.hpp"
42

5-
// Should hijack target thread right here :)
6-
7-
CONTEXT GetAndPrintContext(HANDLE hThread) {
8-
CONTEXT context = { };
3+
Threat::Threat(const wchar_t *processName) : Process(processName) {
94
context.ContextFlags = CONTEXT_FULL;
105

11-
if (GetThreadContext(hThread, &context)) {
6+
HANDLE hSnapshot;
7+
THREADENTRY32 threadEntry = {};
8+
BOOL hResult;
129

10+
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
11+
if (hSnapshot == INVALID_HANDLE_VALUE) {
12+
std::cerr << "Failed to snapshot threads: " << GetLastError() << std::endl;
13+
return;
1314
}
1415

15-
return context;
16-
}
16+
threadEntry.dwSize = sizeof(THREADENTRY32);
17+
hResult = Thread32First(hSnapshot, &threadEntry);
18+
19+
while (hResult) {
20+
if (processId == threadEntry.th32OwnerProcessID) {
21+
threadId = threadEntry.th32ThreadID;
22+
break;
23+
}
24+
hResult = Thread32Next(hSnapshot, &threadEntry);
25+
}
1726

18-
int main() {
19-
HANDLE hThread;
20-
CONTEXT context;
27+
CloseHandle(hSnapshot);
2128

22-
hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, 6248);
29+
hThread = OpenThread(THREAD_ALL_ACCESS, 0, threadId);
2330
if (!hThread) {
24-
std::cout << "Failed to open thread handle : " << GetLastError() << std::endl;
25-
return 1;
31+
std::cerr << "[ ERROR ] OpenThread: " << GetLastError() << std::endl;
32+
return;
2633
}
34+
}
2735

28-
std::cout << "Successfully opened thread 0x" << hThread << std::endl;
36+
Threat::~Threat() {
37+
CloseHandle(hThread);
38+
}
2939

30-
context = GetAndPrintContext(hThread);
40+
void Threat::DebugPrint() const {
41+
std::cout << "-------------------------" << std::endl;
42+
std::cout << " THIS IS A DEBUG PRINT ! " << std::endl;
43+
std::cout << "-------------------------" << std::endl;
44+
std::cout << "[ DEBUG ] processId: " << processId << std::endl;
45+
std::cout << "[ DEBUG ] threadId: " << threadId << std::endl;
46+
std::cout << "[ DEBUG ] context: 0x" << std::hex << &context << std::endl;
47+
std::cout << "[ DEBUG ] hThread: 0x" << std::hex << hThread << std::endl;
48+
}
3149

32-
std::cout << "0x7ffad8f3cca4" << std::endl;
50+
bool Threat::Hijack() {
51+
HMODULE hModules[1024];
52+
DWORD modulesCount;
3353

34-
#ifdef _WIN64
35-
std::cout << "RIP (Instruction Pointer): 0x" << std::hex << context.Rip << std::endl;
36-
std::cout << "RSP (Stack Pointer): 0x" << std::hex << context.Rsp << std::endl;
37-
#endif
54+
if (!EnumProcessModules(hProcess, hModules, sizeof(hModules), &modulesCount)) {
55+
std::cerr << "[ ERROR ] EnumProcessModules: " << GetLastError() << std::endl;
56+
CloseHandle(hProcess);
57+
return false;
58+
}
3859

60+
HMODULE ntdll = nullptr;
3961

40-
if (SuspendThread(hThread) == -1) {
41-
std::cout << "Failed to suspend thread : " << GetLastError() << std::endl;
42-
return 1;
43-
}
62+
for (size_t i = 0; i < (modulesCount / sizeof(HMODULE)); i++) {
63+
TCHAR path[MAX_PATH];
64+
65+
if (!GetModuleFileNameEx(hProcess, hModules[i], path, sizeof(path) / sizeof(TCHAR))) {
66+
std::cerr << "[ ERROR ] GetModuleFileNameA: " << GetLastError() << std::endl;
67+
return false;
68+
}
4469

45-
std::cout << "Sucessfully suspended thread" << std::endl;
70+
if (_tcsstr(path, L"ntdll.dll") == 0) {
71+
std::cout << "[ DEBUG ] ntdll found!" << std::endl;
72+
break;
73+
}
4674

47-
//Sleep(3000);
75+
MODULEINFO moduleInfos;
76+
77+
if (!K32GetModuleInformation(hProcess, hModules[i], &moduleInfos, sizeof(moduleInfos))) {
78+
std::cerr << "[ ERROR ] K32GetModuleInformation: " << GetLastError() << std::endl;
79+
return false;
80+
}
4881

49-
if (ResumeThread(hThread) == -1) {
50-
std::cout << "Failed to resume thread : " << GetLastError() << std::endl;
51-
return 1;
82+
std::cout << moduleInfos.SizeOfImage << std::endl;
83+
84+
85+
std::wcout << path << std::endl;
5286
}
87+
88+
while (1) {
89+
if (SuspendThread(hThread) == (DWORD) -1) {
90+
std::cerr << "[ ERROR ] SuspendThread: " << GetLastError() << std::endl;
91+
return false;
92+
}
93+
94+
std::cout << "[ DEBUG ] SuspendThread" << std::endl;
95+
96+
if (!GetThreadContext(hThread, &context)) {
97+
std::cerr << "[ ERROR ] GetThreadContext: " << GetLastError() << std::endl;
98+
if (ResumeThread(hThread) == (DWORD) - 1) {
99+
std::cerr << "[ ERROR ] ResumeThread: " << GetLastError() << std::endl;
100+
}
101+
}
53102

54-
std::cout << "Sucessfully resumed thread" << std::endl;
103+
Sleep(1000);
104+
std::cout << "Resume in 3..." << std::endl;
105+
Sleep(1000);
106+
std::cout << "Resume in 2..." << std::endl;
107+
Sleep(1000);
108+
std::cout << "Resume in 1..." << std::endl;
109+
110+
if (ResumeThread(hThread) == (DWORD) -1) {
111+
std::cerr << "[ ERROR ] ResumeThread: " << GetLastError() << std::endl;
112+
return false;
113+
}
114+
std::cout << "[ DEBUG ] ResumeThread" << std::endl;
115+
116+
Sleep(5000);
117+
}
55118
}

‎Threat/Threat.hpp‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#pragma once
2+
3+
#include <iostream>
4+
#include <Windows.h>
5+
#include <ios>
6+
#include <Psapi.h>
7+
#include <tchar.h>
8+
9+
#include "Process.hpp"
10+
11+
class Threat : protected Process {
12+
private:
13+
HANDLE hThread = {};
14+
CONTEXT context = {};
15+
DWORD threadId = 0;
16+
public:
17+
Threat() = delete;
18+
Threat(const wchar_t *processName);
19+
~Threat();
20+
21+
void DebugPrint() const;
22+
bool Hijack();
23+
};

‎Threat/Threat.vcxproj‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,14 @@
123123
</Link>
124124
</ItemDefinitionGroup>
125125
<ItemGroup>
126+
<ClCompile Include="Main.cpp" />
127+
<ClCompile Include="Process.cpp" />
126128
<ClCompile Include="Threat.cpp" />
127129
</ItemGroup>
130+
<ItemGroup>
131+
<ClInclude Include="Process.hpp" />
132+
<ClInclude Include="Threat.hpp" />
133+
</ItemGroup>
128134
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
129135
<ImportGroup Label="ExtensionTargets">
130136
</ImportGroup>

‎Threat/Threat.vcxproj.filters‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,19 @@
1818
<ClCompile Include="Threat.cpp">
1919
<Filter>Source Files</Filter>
2020
</ClCompile>
21+
<ClCompile Include="Process.cpp">
22+
<Filter>Source Files</Filter>
23+
</ClCompile>
24+
<ClCompile Include="Main.cpp">
25+
<Filter>Source Files</Filter>
26+
</ClCompile>
27+
</ItemGroup>
28+
<ItemGroup>
29+
<ClInclude Include="Threat.hpp">
30+
<Filter>Header Files</Filter>
31+
</ClInclude>
32+
<ClInclude Include="Process.hpp">
33+
<Filter>Header Files</Filter>
34+
</ClInclude>
2135
</ItemGroup>
2236
</Project>

0 commit comments

Comments
 (0)