WFPdisable.exe的处理流程

一直不知道如何关闭WFP(Windows File Protection)，进行反汇编了一下WFPdisable.exe，理出它的大概处理流程。

HMODULE hSfc = LoadLibary( "sfc.dll" );
//这个地方在该程序中声明的是对win2k sp4和winxp sp1适用，不知道对其他版本是否适用
LPTHREAD_START_ROUTINE pThread = (LPTHREAD_START_ROUTINE)GetProcAddress( hSfc, 2 );
//得到"SeDebugPrivileges" 调整标记权限
SetDebugPrivileges();
//调用ZwQuerySystemInformation获取WinLogon.exe的进程编号
DWORD dwWinLogonId = GetProcessIdByName( "WinLogon.exe" );
//打开WinLogon进程
HANDLE hWinLogon = OpenProcess( dwWinLogonId, NULL, 0x1F0FFF );
//在WinLogon.exe中创建线程
HANDLE hRemoteThread = CreateRemoteThread( hWinLogon, NULL, 0, pThread, NULL, 0, &dwThreadId );
//等待远程线程结束
DWORD dwWaitResult = WaitForSingleObject( hRemoteThread, 15000 );
if( dwWaitResult == WAIT_OBJECT_0 )
 printf( "Ok!" );
else
 printf( "False!" );
//清理工作
CloseHandle( hWinLogon );
if( hRemoteThread != NULL )
 CloseHandle( hRemoteThread );