|
|
|
[原创] Themida.demo.V1.8.0.0.CracKed.By.fly
汗 来迟了 现在才发现这个好东西 |
|
|
|
[原创]新人汉化FixResDemo,处女汉化,不要BS
大家就不要打击新人了 |
|
|
|
|
|
[求助]ASProtect 1.23 RC4脱方法!和破解检测语言区域
最初由 ourzn 发布 你这样说 就有点违规嫌疑了 sorry |
|
|
|
[求助]ASProtect 1.23 RC4脱方法!和破解检测语言区域
Stolen Code 0054B2ED U> 55 push ebp 0054B2EE 8BEC mov ebp,esp 0054B2F0 6A FF push -1 0054B2F2 68 E0B55B00 push Unpacked.005BB5E0 0054B2F7 68 DCB55400 push Unpacked.0054B5DC 0054B2FC 64:A1 00000000 mov eax,dword ptr fs:[0] 0054B302 50 push eax 0054B303 64:8925 00000000 mov dword ptr fs:[0],esp 0054B30A 83EC 58 sub esp,58 0054B30D 53 push ebx 0054B30E 56 push esi 0054B30F 57 push edi 0054B310 8965 E8 mov dword ptr ss:[ebp-18],esp 55 8B EC 6A FF 68 E0 B5 5B 00 68 DC B5 54 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 |
|
[讨论]远程线程注入导致程序速度慢的原因
没发现重复申请:) |
|
[讨论]远程线程注入导致程序速度慢的原因
unit ThreadInject; interface uses Windows, Messages, Classes, tlhelp32, //必须要的 SysUtils; //必须要的 type TLog = procedure(s : PChar);stdcall; TServiceMain = procedure(argc : Integer; VAR argv : pchar);stdcall; EDLLLoadError = class(Exception); procedure GetMyProcessID(const AFilename: string; const PathMatch: Boolean; var ProcessID: DWORD); function EnabledDebugPrivilege(const Enabled : Boolean) : Boolean; function InjectTo(const Host, Guest: string; const PID: DWORD = 0): DWORD; implementation {************************* * 作用:远程注入 * 调用:InjectTo('twin.exe', extractfilepath(paramstr(0))+'Twin.dll'); ************************** } function InjectTo(const Host, Guest: string; const PID: DWORD = 0): DWORD; var { 被注入的进程句柄,进程ID} hRemoteProcess: THandle; dwRemoteProcessId: DWORD; { 写入远程进程的内容大小 } memSize: DWORD; { 写入到远程进程后的地址 } pszLibFileRemote: Pointer; iReturnCode: Boolean; TempVar: DWORD; { 指向函数LoadLibraryW的地址 } pfnStartAddr: TFNThreadStartRoutine; { dll全路径,需要写到远程进程的内存中去 } pszLibAFilename: PwideChar; begin Result := 0; { 设置权限 } EnabledDebugPrivilege(True); { 为注入的dll文件路径分配内存大小,由于为WideChar,故要乘2 } Getmem(pszLibAFilename, Length(Guest) * 2 + 1); StringToWideChar(Guest, pszLibAFilename, Length(Guest) * 2 + 1); { 获取进程ID } if PID > 0 then dwRemoteProcessID := PID else GetMyProcessID(Host, False, dwRemoteProcessID); { 取得远程进程句柄,具有写入权限} hRemoteProcess := OpenProcess(PROCESS_CREATE_THREAD + {允许远程创建线程} PROCESS_VM_OPERATION + {允许远程VM操作} PROCESS_VM_WRITE, {允许远程VM写} FALSE, dwRemoteProcessId); { 用函数VirtualAllocex在远程进程分配空间,并用WriteProcessMemory中写入dll路径 } memSize := (1 + lstrlenW(pszLibAFilename)) * sizeof(WCHAR); pszLibFileRemote := PWIDESTRING(VirtualAllocEx(hRemoteProcess, nil, memSize, MEM_COMMIT, PAGE_READWRITE)); TempVar := 0; iReturnCode := WriteProcessMemory(hRemoteProcess, pszLibFileRemote, pszLibAFilename, memSize, TempVar); if iReturnCode then begin pfnStartAddr := GetProcAddress(GetModuleHandle('Kernel32'), 'LoadLibraryW'); TempVar := 0; { 在远程进程中启动dll } Result := CreateRemoteThread(hRemoteProcess, nil, 0, pfnStartAddr, pszLibFileRemote, 0, TempVar); end; { 释放内存空间 } Freemem(pszLibAFilename); end; {************************* * 作用:列举进程 * 返回:bool类型 ************************** } procedure GetMyProcessID(const AFilename: string; const PathMatch: Boolean; var ProcessID: DWORD); var lppe: TProcessEntry32; SsHandle: Thandle; FoundAProc, FoundOK: boolean; begin ProcessID :=0; { 创建系统快照 } SsHandle := CreateToolHelp32SnapShot(TH32CS_SnapProcess, 0); { 取得快照中的第一个进程 } { 一定要设置结构的大小,否则将返回False } lppe.dwSize := sizeof(TProcessEntry32); FoundAProc := Process32First(Sshandle, lppe); while FoundAProc do begin { 进行匹配 } if PathMatch then FoundOK := AnsiStricomp(lppe.szExefile, PChar(AFilename)) = 0 else FoundOK := AnsiStricomp(PChar(ExtractFilename(lppe.szExefile)), PChar(ExtractFilename(AFilename))) = 0; if FoundOK then begin ProcessID := lppe.th32ProcessID; break; end; { 未找到,继续下一个进程 } FoundAProc := Process32Next(SsHandle, lppe); end; CloseHandle(SsHandle); end; {************************* * 作用:设置权限 * 返回:bool类型 ************************** } function EnabledDebugPrivilege(const Enabled : Boolean) : Boolean; var hTk : THandle; { 打开令牌句柄 } rtnTemp : Dword; { 调整权限时返回的值 } TokenPri : TOKEN_PRIVILEGES; const SE_DEBUG = 'SeDebugPrivilege'; { 查询值 } begin Result := False; { 获取进程令牌句柄,设置权限 } if (OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,hTk)) then begin TokenPri.PrivilegeCount := 1; { 获取Luid值 } LookupPrivilegeValue(nil,SE_DEBUG,TokenPri.Privileges[0].Luid); if Enabled then TokenPri.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED else TokenPri.Privileges[0].Attributes := 0; rtnTemp := 0; { 设置新的权限 } AdjustTokenPrivileges(hTk,False,TokenPri,sizeof(TokenPri),nil,rtnTemp); Result := GetLastError = ERROR_SUCCESS; CloseHandle(hTk); end; end; end. |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值