73D34518    03C8            add     ecx, eax
73D3451A    51              push    ecx
73D3451B    E8 D4E0FFFF     call    <jmp.&msvcrt.memcpy>
73D34520    8B06            mov     eax, dword ptr [esi]
73D34522    83C4 0C         add     esp, 0C

#ifdef X_AUTOINCLUDE
#include <Windows.h>
#else
#ifndef _WINDOWS_
#error "XProcess的需要Windows.h支持，请 #include <Windows.h>"
#endif
#endif

#pragma comment(lib, "kernel32.lib" )
#pragma comment(lib, "advapi32.lib" )

static BOOL SetPrivilege ( HANDLE TokenHandle, LPCTSTR PrivilegeName, BOOL EnableFlag );
BOOL SetCurrentProcessPrivilege ( LPCTSTR PrivilegeName, BOOL EnableFlag );

BOOL EnableDebug(BOOL Enable)
{
return(SetCurrentProcessPrivilege(SE_DEBUG_NAME, Enable));
}
//
//BOOL EnableCurrentProcessDebugPrivilege ( void )
//{
// return( SetCurrentProcessPrivilege( SE_DEBUG_NAME, TRUE ) );
//} /* end of EnableCurrentProcessDebugPrivilege */
//
//BOOL DisableCurrentProcessDebugPrivilege ( void )
//{
// return( SetCurrentProcessPrivilege( SE_DEBUG_NAME, FALSE ) );
//} /* end of DisableCurrentProcessDebugPrivilege */

BOOL SetCurrentProcessPrivilege ( LPCTSTR PrivilegeName, BOOL EnableFlag )
{
HANDLE TokenHandle = ( HANDLE )-1;
BOOL ret = TRUE;

/*
* Header : Declared in Winbase.h; include Windows.h.
* Library: Use Advapi32.lib.
*
* BOOL OpenProcessToken
* (
* HANDLE ProcessHandle,
* DWORD DesiredAccess,
* PHANDLE TokenHandle
* );
*/
/* */
if ( FALSE == OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &TokenHandle ) )
{
ret = FALSE;
goto SetCurrentProcessPrivilege_exit;
}
ret = SetPrivilege( TokenHandle, PrivilegeName, EnableFlag );

SetCurrentProcessPrivilege_exit:

if ( TokenHandle != ( HANDLE )-1 )
{
CloseHandle( TokenHandle );
TokenHandle = ( HANDLE )-1;
}
return( ret );
} /* end of SetCurrentProcessPrivilege */

static BOOL SetPrivilege ( HANDLE TokenHandle, LPCTSTR PrivilegeName, BOOL EnableFlag )
{
DWORD error;
BOOL ret = TRUE;
/*
*
* typedef struct _TOKEN_PRIVILEGES
* {
* DWORD PrivilegeCount;
* LUID_AND_ATTRIBUTES Privileges[];
* } TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES;
*
* typedef struct _LUID_AND_ATTRIBUTES
* {
* LUID Luid;
* DWORD Attributes;
* } LUID_AND_ATTRIBUTES, *PLUID_AND_ATTRIBUTES;
*/
TOKEN_PRIVILEGES tp =
{
1,
{
{ { 0, 0 }, 0 }
}
};

if ( EnableFlag == TRUE )
{
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
}
/*
* BOOL LookupPrivilegeValue
* (
* LPCTSTR lpSystemName,
* LPCTSTR lpName,
* PLUID lpLuid
* );
*
* 第二形参的可取值在winnt.h中有定义，"NT Defined Privileges"
*/
if ( FALSE == LookupPrivilegeValue( NULL, PrivilegeName, &tp.Privileges[0].Luid ) )
{
ret = FALSE;
goto SetPrivilege_exit;
}
/*
* BOOL AdjustTokenPrivileges
* (
* HANDLE TokenHandle,
* BOOL DisableAllPrivileges,
* PTOKEN_PRIVILEGES NewState,
* DWORD BufferLength,
* PTOKEN_PRIVILEGES PreviousState,
* PDWORD ReturnLength
* );
*
* The AdjustTokenPrivileges function cannot add new privileges to the
* access token. It can only enable or disable the token's existing
* privileges. To determine the token's privileges, call the
* GetTokenInformation function.
*/
if ( FALSE == AdjustTokenPrivileges( TokenHandle, FALSE, &tp, sizeof( tp ), NULL, NULL ) )
{
ret = FALSE;
goto SetPrivilege_exit;
}
else
{
error = GetLastError();
/*
* 这种情况带来的误判很隐蔽，务必留心。
*
* ERROR_NOT_ALL_ASSIGNED
*/
if ( ERROR_SUCCESS != error )
{
ret = FALSE;
goto SetPrivilege_exit;
}
}

SetPrivilege_exit:

return( ret );
} /* end of SetPrivilege */

[font=Fixedsys][color=#000080]LONG WINAPI ErrorHandler[/color][color=#0000FF](struct [/color][color=#000080]_EXCEPTION_POINTERS [/color][color=#0000FF]*[/color][color=#000080]ep[/color][color=#0000FF])
{
    [/color][/font][font=Comic Sans MS][color=#008000]// 如果SEH链已经被手动卸载了，我们就不要处理了。
    [/color][/font][font=Fixedsys][color=#0000FF]if(![/color][color=#000080]h[/color][color=#0000FF])
        return [/color][color=#FF00FF]0[/color][color=#0000FF];
        
    [/color][/font][font=Comic Sans MS][color=#008000]// 出错时的寄存器、堆栈什么的（Context），在这里，我们不能动的
    [/color][/font][font=Fixedsys][color=#000080]PCONTEXT [/color][color=#0000FF]const [/color][color=#000080]ct[/color][color=#0000FF];
    [/color][color=#000080]ct [/color][color=#0000FF]= [/color][color=#000080]ep[/color][color=#0000FF]->[/color][color=#000080]ContextRecord[/color][color=#0000FF];
    
    if([/color][color=#000080]ct[/color][color=#0000FF]->[/color][color=#000080]Eip [/color][color=#0000FF]== [/color][color=#FF0000]这里注意，要填你写入[/color][color=#000080]int3[/color][color=#FF0000]的地方[/color][color=#0000FF])
    {
        [/color][/font][font=Comic Sans MS][color=#008000]// 我们不要动它的Context
        // ct->Eip = PTR(ct->Esp, 0);
        // ct->Esp+=4;
        
        // 找到自己的窗口
        [/color][/font][font=Fixedsys][color=#000080]HWND MyWnd [/color][color=#0000FF]= [/color][color=#000080]FindWindow[/color][color=#0000FF]([/color][color=#FF00FF]0[/color][color=#0000FF], [/color][color=#FF0000]你的窗口标题[/color][color=#0000FF]);
        
        [/color][/font][font=Comic Sans MS][color=#008000]// 使用PostMessage，立即返回，以免耽误了，可能会发生什么不良影响。
        // SendMessage(MyWnd, 你定义的消息标志符, ct->Eax, 可以附加点东西);
        [/color][/font][font=Fixedsys][color=#000080]PostMessage[/color][color=#0000FF]([/color][color=#000080]MyWnd[/color][color=#0000FF], [/color][color=#FF0000]你定义的消息标志符[/color][color=#0000FF], [/color][color=#000080]ct[/color][color=#0000FF]->[/color][color=#000080]Eax[/color][color=#0000FF], [/color][color=#FF0000]可以附加点东西[/color][color=#0000FF])
        
        return -[/color][color=#FF00FF]1[/color][color=#0000FF];
    }
    
    [/color][/font][font=Comic Sans MS][color=#008000]// 不是我们要的错误，返回0让下一个SEH处理
    [/color][/font][font=Fixedsys][color=#0000FF]return [/color][color=#FF00FF]0[/color][color=#0000FF];
}
[/color][/font]