-
-
[原创][反应用层反外挂]禁用你的DLL_THREAD_ATTACH
-
发表于:
2013-6-29 19:49
13648
-
[原创][反应用层反外挂]禁用你的DLL_THREAD_ATTACH
《win核心编程》里介绍DLL_THREAD_ATTACH的时候说过一个函数
BOOL DisableThreadLibraryCalls(
HMODULE hModule // handle to DLL module
);
他可以禁用某个模块的DLL_THREAD_ATTACH,但是它只能在本进程操作。
稍微跟了下,其实就是修改PEB->DllList->Flags,或了两个值0x40000、0x80000。
下面是一个测试工程。
我觉得应用层,不管你怎么反,只要能OpenProcess、Read、Write,总是可以揪到你的小丁丁的
BOOL MyDisableThreadLibraryCalls(HMODULE hMod)
{
PEB* pPEB=NULL;
PEB_LDR_DATA* pDllList=NULL;
LIST_ENTRY* pFlink=NULL;
LIST_ENTRY* pIndex=NULL;
LDR_DATA_TABLE_ENTRY* pEntry=NULL;
__asm
{
mov eax,fs:[0x30]
mov pPEB,eax
}
pDllList=pPEB->DllList;
//InLoadOrderLinks
pFlink=&pDllList->InLoadOrderLinks;
pIndex=pFlink->Flink;
pEntry=NULL;
while(pIndex!=pFlink)
{
pEntry=CONTAINING_RECORD(pIndex,LDR_DATA_TABLE_ENTRY,InLoadOrderLinks);
if(hMod==pEntry->DllBase)
{
pEntry->Flags|=0x40000;
pEntry->Flags|=0x80000;
}
pIndex=pEntry->InLoadOrderLinks.Flink;
}
//InMemoryOrderModuleList
pFlink=&pDllList->InMemoryOrderModuleList;
pIndex=pFlink->Flink;
pEntry=NULL;
while(pIndex!=pFlink)
{
pEntry=CONTAINING_RECORD(pIndex,LDR_DATA_TABLE_ENTRY,InMemoryOrderModuleList);
if(hMod==pEntry->DllBase)
{
pEntry->Flags|=0x40000;
pEntry->Flags|=0x80000;
}
pIndex=pEntry->InMemoryOrderModuleList.Flink;
}
//InInitializationOrderModuleList
pFlink=&pDllList->InInitializationOrderModuleList;
pIndex=pFlink->Flink;
pEntry=NULL;
while(pIndex!=pFlink)
{
pEntry=CONTAINING_RECORD(pIndex,LDR_DATA_TABLE_ENTRY,InInitializationOrderModuleList);
if(hMod==pEntry->DllBase)
{
pEntry->Flags|=0x40000;
pEntry->Flags|=0x80000;
}
pIndex=pEntry->InInitializationOrderModuleList.Flink;
}
return TRUE;
}
DllTest.rar
[课程]Android-CTF解题方法汇总!