我的代码箱

最新推荐文章于 2024-09-23 09:09:27 发布

nooning

最新推荐文章于 2024-09-23 09:09:27 发布

阅读量722

点赞数

文章标签： null 测试 session module access dll

本文链接：https://blog.csdn.net/nooning/article/details/1648253

版权

以下代码已被废弃，特记录之

/**/ ////NtCreateSession Part

// HANDLE hHandle = GetCurrentProcess();

// DuplicateHandle(hHandle,*SectionHandle,hHandle,&m_hSectionHandle,SECTION_MAP_WRITE|SECTION_MAP_READ,FALSE,0);

// CloseHandle(hHandle);

// 测试是否为非系统DLL

// if ((DWORD)lpMap<0x70000000)

// {

// if (MessageBox(NULL,str,_T("Mabye Dll"),MB_ICONQUESTION|MB_OKCANCEL)!=IDOK)

// {

// CloseHandle(*SectionHandle);

// ret=STATUS_ACCESS_DENIED;

// }

NtCreateThread Part

// #else

// LPVOID lpRemote;

// LPVOID RealEnter;

// lpRemote = MapViewOfFileEx(m_hSectionHandle,SECTION_MAP_WRITE|SECTION_MAP_READ,0,0,0,NULL);

// CloseHandle(m_hSectionHandle);

// m_hSectionHandle=NULL;

// #endif

   //HMODULE hModule;
   //if (GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,(LPCTSTR)lpMap,&hModule))
   // GetModuleBaseName(GetCurrentProcess,(HMODULE)lpMap,str,MAX_PATH);
   //else if (!
   // 针对Session 无效

///死循环测试

B8 31 03 93 7C FF D0 ((FARPROC)(0x7c930331))();
//char ins[]={0xEB,0xFE,0xB8,0x31,0x03,0x93,0x7C,0xFF,0xD0};
//WriteProcessMemory(hProcess,(LPBYTE)lpRemote+sizeof(DWORD)*2,ins,9,&u_Written);