|
|
|
[求助]关于Window背景变化。
要操作屏幕不难, 首先用CreateDC("DISPLAY", NULL, NULL, NULL);得到屏幕的设备环境, 然后就可以对屏幕进行操作了, 至于图像的算法, 我没有研究过 |
|
《软件加密技术内幕》勘误?P40页 数据目录表结构
size是MASM的保留字而已, 类似的还有length被改为_length |
|
|
|
在VC中如何获得程序的完整路径
可以用GetModuleFileName函数 |
|
运行一个软件,在win98下正常,XP下出错,求助
CreateRemoteThread The CreateRemoteThread function creates a thread that runs in the virtual address space of another process. HANDLE CreateRemoteThread( HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId ); Parameters hProcess [in] Handle to the process in which the thread is to be created. The handle must have the PROCESS_CREATE_THREAD, PROCESS_QUERY_INFORMATION, PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_VM_READ access rights. For more information, see Process Security and Access Rights. lpThreadAttributes [in] Pointer to a SECURITY_ATTRIBUTES structure that specifies a security descriptor for the new thread and determines whether child processes can inherit the returned handle. If lpThreadAttributes is NULL, the thread gets a default security descriptor and the handle cannot be inherited. The access control lists (ACL) in the default security descriptor for a thread come from the primary token of the creator. Windows XP/2000/NT: The ACLs in the default security descriptor for a thread come from the primary or impersonation token of the creator. This behavior changed with Windows XP SP2 and Windows Server 2003. dwStackSize [in] Initial size of the stack, in bytes. The system rounds this value to the nearest page. If this parameter is 0 (zero), the new thread uses the default size for the executable. For more information, see Thread Stack Size. lpStartAddress [in] Pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more information, see ThreadProc. lpParameter [in] Pointer to a variable to be passed to the thread function. dwCreationFlags [in] Flags that control the creation of the thread. If the CREATE_SUSPENDED flag is specified, the thread is created in a suspended state and does not run until the ResumeThread function is called. If this value is zero, the thread runs immediately after creation. If the STACK_SIZE_PARAM_IS_A_RESERVATION flag is specified, the dwStackSize parameter specifies the initial reserve size of the stack. Otherwise, dwStackSize specifies the commit size. Windows 2000/NT: The STACK_SIZE_PARAM_IS_A_RESERVATION flag is not supported. lpThreadId [out] Pointer to a variable that receives the thread identifier. If this parameter is NULL, the thread identifier is not returned. Return Values If the function succeeds, the return value is a handle to the new thread. If the function fails, the return value is NULL. To get extended error information, call GetLastError. Note that CreateRemoteThread may succeed even if lpStartAddress points to data, code, or is not accessible. If the start address is invalid when the thread runs, an exception occurs, and the thread terminates. Thread termination due to a invalid start address is handled as an error exit for the thread's process. This behavior is similar to the asynchronous nature of CreateProcess, where the process is created even if it refers to invalid or missing dynamic-link libraries (DLL). Remarks The CreateRemoteThread function causes a new thread of execution to begin in the address space of the specified process. The thread has access to all objects that the process opens. Terminal Services isolates each terminal session by design. Therefore, CreateRemoteThread fails if the target process is in a different session than the calling process. The new thread handle is created with full access to the new thread. If a security descriptor is not provided, the handle may be used in any function that requires a thread object handle. When a security descriptor is provided, an access check is performed on all subsequent uses of the handle before access is granted. If the access check denies access, the requesting process cannot use the handle to gain access to the thread. The thread is created with a thread priority of THREAD_PRIORITY_NORMAL. Use the GetThreadPriority and SetThreadPriority functions to get and set the priority value of a thread. When a thread terminates, the thread object attains a signaled state, which satisfies the threads that are waiting for the object. The thread object remains in the system until the thread has terminated and all handles to it are closed through a call to CloseHandle. The ExitProcess, ExitThread, CreateThread, CreateRemoteThread functions, and a process that is starting (as the result of a CreateProcess call) are serialized between each other within a process. Only one of these events occurs in an address space at a time. This means the following restrictions hold: During process startup and DLL initialization routines, new threads can be created, but they do not begin execution until DLL initialization is done for the process. Only one thread in a process can be in a DLL initialization or detach routine at a time. ExitProcess returns after all threads have completed their DLL initialization or detach routines. A common use of this function is to inject a thread into a process that is being debugged to issue a break. However, this use is not recommended, because the extra thread is confusing to the person debugging the application and there are several side effects to using this technique: It converts single-threaded applications into multi-threaded applications. It changes the timing and memory layout of the process. It results in a call to the entry point of each DLL in the process. Another common use of this function is to inject a thread into a process to query heap or other process information. This can cause the same side effects mentioned in the previous paragraph. Also, the application can deadlock if the thread attempts to obtain ownership of locks that another thread is using. Requirements Client Requires Windows XP, Windows 2000 Professional, or Windows NT Workstation. Server Requires Windows Server 2003, Windows 2000 Server, or Windows NT Server. Header Declared in Winbase.h; include Windows.h. Library Link to Kernel32.lib. DLL Requires Kernel32.dll. See Also CloseHandle, CreateProcess, CreateThread, ExitProcess, ExitThread, GetThreadPriority, Process and Thread Functions, ResumeThread, SECURITY_ATTRIBUTES, SetThreadPriority, ThreadProc, Threads |
|
运行一个软件,在win98下正常,XP下出错,求助
WinXP中已经取消了这个函数, 所以你只能先找出软件中调用这个函数的那个模块的功能, 然后把那个模块重写一下 |
|
|
|
VC2005与VC6的主要区别是什么?
VC2005提供一个工程转换工具, 不过似乎不能100%兼容 |
|
运行一个软件,在win98下正常,XP下出错,求助
WinXP的kernel32.dll中已经没有这个函数了 |
|
|
|
关于SOFTICE的问题,已看过置顶贴,请大家看看.
1.在SoftICE的设置里去掉Display Diagnostic Message(显示诊断信息)选项 2.BMSG命令格式:BMSG 窗口句柄 消息号码 |
|
我觉得大家应该把主要的精力放到软件逆向工程上,这才是有实质作用的。
楼上的如果对逆向工程了解更多一点, 应该会改变想法的 |
|
哪些寄存器是只要用户不改变就不会改变?
这3个寄存器没有什么特别的, 但是任何公开的API都会自动保存他们的值. 这是微软编译器的约定 Windows内部使用这3个寄存器作为指针, 所以我们写一些回调函数(如WndProc, TimerProc)的时候也要注意保存他们的值 |
|
[求助]WinXp User权限下能否向SYSTEM进程注入代码
普通方法是不可能的 |
|
关于EQU等值定义问题
EQU的3种格式: 1. name EQU 整数表达式 例 NINE EQU 3 * 3 2. name EQU 已经定义的符号名 例: MAX_NUMBER EQU NINE 3.name EQU <文本> 例: MessageBox EQU <MessageBoxA> |
|
|
|
|
|
[求助]一个简单的汇编问题。
最初由 Kven 发布 我也是自学的汇编语言, 对Kven朋友的话深有同感啊, 只可惜一旦过了初期的那一"关", 就很难体会到当初的那份感觉了, 所以说, 很多步入"高手"的人就不大愿意回答新手的问题 我的水平不高, 但是我相信, 大家共同进步才是真正有利于论坛发展的 另外对gzgzlxg朋友的话解释一下: gzgzlxg朋友是从实用角度来说的, 毕竟, "DOS已死"(<<Windows 95 System Programming SECRETS>>侯杰译本), 继续把精力放在上面是一种浪费, 16位段基址*16+16位偏移=20位物理地址的寻址方式早已成为过去, 即使你对此研究得再透也没有地方可以应用. 但是, 从学习的角度来说, Dos下的汇编仍有可取之处. 首先, 学习汇编语言主要的目的是让你明白计算机软件的底层的工作方式和原理, 例如段基址+偏移的思想(分段式存储管理)是很多硬件和操作系统平台所共有的, 拿IA32的保护模式来说也是如此, 只不过它的段基址已经不是简单从段寄存器中得到的, 而是从段描述符中得到, 但是这种思想却没有改变, 对于中断也是如此. 其次, 就汇编语言本身而言, 一些经验和技巧是永远不会过时的(除非IA32体系淘汰), 例如字符串操作技巧, 运算技巧等. 最后, 由于任何编程语言都不可避免要和操作系统打交道, 而Windows系统把一些底层东西封装太深, 如中断, 用户模式程序根本无法使用中断(总不能让新手一开始就学写内核模式驱动程序吧). 不利于后继知识(如操作系统, 任何讲操作系统的书都会讲中断的)的学习 所以我认为, 学习Dos的汇编要重点掌握那些于Dos无关的东西(简单讲就是不涉及int 21h的东西), 如指令的使用等, 为后继学习打下一个基础, 对于那些和Dos操作系统关系太密切的东西(如Dos中断)只要了解原理就行了, 不要深究 |
操作理由
RANk
{{ user_info.golds == '' ? 0 : user_info.golds }}
雪币
{{ experience }}
课程经验
{{ score }}
学习收益
{{study_duration_fmt}}
学习时长
基本信息
荣誉称号:
{{ honorary_title }}
能力排名:
No.{{ rank_num }}
等 级:
LV{{ rank_lv-100 }}
活跃值:
在线值:
浏览人数:{{ visits }}
最近活跃:{{ last_active_time }}
注册时间:{{ user_info.create_date_jsonfmt }}
勋章
兑换勋章
证书
证书查询 >
能力值