以前有人发过类似文章(或者说我抄袭了吧。),但是那个代码我测试了已经不能用了。貌似MFC上也会出错。这里我的代码可以在mfc上使用。
此方法不需注入就读写Hackshield的进程地址空间数据,以及其它API的Detour Hook。【不能用于过保护。】
HS白名单可用伪装的进程列表,
代码:
1. Name: patcher.exe
2. Name: WerFault.exe
3. Name: IAANTmon.exe
4. Name: avp.exe
5. Name: WmiApSrv.exe
6. Name: xsync.exe
7. Name: fssm32.exe
8. Name: LGDCORE.exe
9. Name: ACS.EXE
10.Name: ITPYE.EXE
11.Name: Joy2Key.exe
12.Name: JOYTOKEYHIDE.EXE
13.Name: JOYTOKEYKR.EXE
14.Name: JOYTOKEY.EXE
15.Name: DWM.EXE
16.Name: WMIPRVSE.EXE
17.Name: DK2.EXE
18.Name: CSTRIKE-ONLINE.EXE
19.Name: RAGII.EXE
20.Name: EKRN.EXE
21.Name: GOM.EXE
22.Name: GAMEMON.DES
23.Name: VAIOCAMERACAPTUREUTILITY.EXE
24.Name: IPOINT.EXE
25.Name: NMCOSRV.EXE
26.Name: DEKARON.EXE
27.Name: AUDIODG.EXE
28.Name: NGM.EXE
29.Name: TASKMGR.EXE
30.Name: HGSCRAPEDITORHELPER.EXE
31.Name: SE