突然发现自己还不是会员呢，不知道什么程度的技术才给邀请码,先发一个试试吧，虽然技术也是从兔子那刚学来的
[codde]
HANDLE GetProcessKernelObject(DWORD ProcessId)
{
HMODULE hNtDll = NULL;
ZWQUERYSYSTEMINFORMATION pfnZwQuerySystemInformation = NULL;
NTQUERYOBJECT pfnNtQueryObject = NULL;
PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = NULL;
POBJECT_ALL_INFORMATION pAllInfo =NULL;
POBJECT_NAME_INFORMATION pNameInfo = NULL;
ULONG nNumberHandle =0;
NTSTATUS ntStatus = 0;
ULONG ulSize,ulCount;
char cBuffer[0x80000],cInfoBuffer[0x10000];
hNtDll = GetModuleHandle(TEXT("ntdll.dll"));
pfnZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
pfnNtQueryObject = (NTQUERYOBJECT)GetProcAddress(hNtDll,"NtQueryObject");
ntStatus = pfnZwQuerySystemInformation(SystemHandleInformation,cBuffer,0x80000,&ulSize);
if(NT_SUCCESS(ntStatus))
{
DWORD n = ulSize/sizeof(SYSTEM_HANDLE_INFORMATION);
nNumberHandle = *(PULONG)cBuffer;
pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION)(cBuffer +4);
ulCount = 0;
for(ULONG i=0;i!=nNumberHandle;++i)
{
if(pSysHandleInfo[i].ProcessId != ProcessId)
continue;
ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo[i].Handle,ObjectAllInformation,cInfoBuffer,0x10000,&ulSize);
ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo[i].Handle,ObjectNameInformation,cInfoBuffer,0x10000,&ulSize);
if(NT_SUCCESS(ntStatus))
{
pAllInfo = (POBJECT_ALL_INFORMATION)cInfoBuffer;
pNameInfo = (POBJECT_NAME_INFORMATION)cInfoBuffer;
if(_tcsstr(pNameInfo->NameBuffer,TEXT("QQGame_Mutex")) !=NULL)
{
return (HWND)pSysHandleInfo[i].Handle;
}
}
}
}
return NULL;
}
hMuTex = GetProcessKernelObject(GetCurrentProcessId());
CloseHandle(hMuTex);
[/code]
原理,因为许多限制多开的软件都是利用命名内核对象来实现的，如果Create* 创建内核对象 返回 “以存在”那么就退出。
所以，先枚举进程中的所有内核对象，然后关闭他就好了~ 在R3下实现，用此方法可以多开大多数程序包括将来的~
大过年的人在不在，给个邀请码吧,大半夜的也不容易
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
