Method and system for injecting 64-bit processes into remote 32-bit process

Abstract

The invention provides a method and a system for injecting a 64-bit process into a remote 32-bit process. The system comprises a function positioning layer and an injection processing layer, the function positioning layer is used for switching a process space of a 32-bit injector process from an x86 working mode to an x64 working mode, positioning a key Native API function address in 64-bit ntdllrequired by a remote injection process in an x64 mode, switching to an x86 working mode after positioning is completed, and transmitting the key Native API function address to an injection processinglayer; the injection processing layer is used for packaging the information of the remote injection module into parameters required for calling the key Native API function, and switching the process to an x64 working mode, calling a remote thread creation function to inject the remote module or the remote process into a 64-bit target process, and then switching to an x86 working mode. According tothe system, the 32-bit remote process can be injected into the 32-bit process and the 64-bit process at the same time, and other auxiliary processes are not needed. The scheme is simple and convenient, so that hardware resources can play the maximum performance, the program execution efficiency is high, and function failure caused by process injection failure is avoided.

Description

technical field [0001] The invention relates to the field of operating system processing, in particular to a method and system for injecting a remote 32-bit process into a 64-bit process. Background technique [0002] At present, with the continuous development and maturity of hardware technology, it has become a common configuration for computers to be equipped with storage devices with large memory space and storage capacity. In order to give full play to the performance of the storage device, especially the memory device, a 64-bit operating system needs to be installed on the computer to maximize the performance of the hardware. Therefore, more and more users use 64-bit operating systems such as Microsoft Windows 10. Microsoft's 64-bit windows operating system is compatible with 32-bit applications, that is, there are 32-bit processes and 64-bit processes in the 64-bit operating system. [0003] In order to ensure information security, data security protection software ...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above technical problems, the present invention proposes a method and system for injecting 32-bit processes into 64-bit processes. The method and system are used to solve the cumbersome implementation process of the cross-injection method between 32-bit processes and 64-bit processes in the prior art. , a technical problem that requires creating an additional injector process

Images