能力值:
( LV2,RANK:10 )
在线值:
2 楼
常规检查窗口标题,类名,互斥,任务管理器貌似检查标题,改一下标题就知道了
能力值:
( LV3,RANK:30 )
6 楼
signed int __stdcall sub_100538E(HINSTANCE hInstance, int a2, int a3, int nCmdShow)
{
HINSTANCE v4; // esi@1
HWND v5; // eax@7
int v6; // eax@15
LPARAM v7; // eax@19
int v8; // eax@23
int v9; // edx@23
LPARAM v10; // eax@28
int v11; // eax@35
HANDLE v13; // eax@1
DWORD v14; // eax@5
HWND v15; // eax@44
int v16; // [sp+418h] [bp-4h]@1
HINSTANCE v17; // [sp+44h] [bp-3D8h]@1
signed int v18; // [sp+48h] [bp-3D4h]@1
int Data; // [sp+3Ch] [bp-3E0h]@1
WCHAR WindowName; // [sp+4Ch] [bp-3D0h]@6
HWND hWnd; // [sp+30h] [bp-3ECh]@7
DWORD dwProcessId; // [sp+38h] [bp-3E4h]@8
DWORD dwResult; // [sp+34h] [bp-3E8h]@8
HKEY hKey; // [sp+40h] [bp-3DCh]@10
DWORD cbData; // [sp+2Ch] [bp-3F0h]@11
DWORD Type; // [sp+28h] [bp-3F4h]@11
WCHAR Caption; // [sp+3E4h] [bp-38h]@12
const WCHAR Text; // [sp+254h] [bp-1C8h]@12
struct tagMSG Msg; // [sp+Ch] [bp-410h]@48
v4 = hInstance;
v16 = dword_1015494;
v17 = hInstance;
hInstance = hInstance;
v18 = 1;
Data = 0;
dword_1015E10 = RegisterWindowMessageW(L"TaskbarCreated");
v13 = CreateMutexW(0, 1, L"NTShell Taskman Startup Mutex");
dword_1015E14 = v13;
if ( v13 )
{
if ( GetLastError() == 183 )
WaitForSingleObject(dword_1015E14, 0x2710u);
}
sub_1003DC9(&dword_1015E90, &dword_1015E94, &unk_1015E98);
if ( dword_1015E90 )
{
v14 = GetCurrentProcessId();
ProcessIdToSessionId(v14, &dword_1015E9C);
}
if ( !LoadStringW(v4, 0x2713u, &WindowName, 260)
|| (v5 = FindWindowW((LPCWSTR)0x8002, &WindowName), hWnd = v5, !v5)
|| (dwProcessId = 0, GetWindowThreadProcessId(v5, &dwProcessId), AllowSetForegroundWindow(dwProcessId), !SendMessageTimeoutW(hWnd, 0x40Bu, 0, 0, 2u, 0x2710u, &dwResult))
|| dwResult != 1035 )
{
if ( !RegOpenKeyExW(
HKEY_CURRENT_USER,
L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
0,
0x20019u,
&hKey) )
{
cbData = 4;
RegQueryValueExW(hKey, L"DisableTaskMgr", 0, &Type, (BYTE *)&Data, &cbData);
RegCloseKey(hKey);
if ( Data )
{
LoadStringW(v17, 0x2729u, &Caption, 25);
LoadStringW(v17, 0x272Au, (LPWSTR)&Text, 200);
MessageBoxW(0, &Text, &Caption, 0x10u);
goto LABEL_13;
}
}
InitCommonControls();
sub_100285D();
hHandle = CreateThread(0, 0, sub_100F4E1, 0, 0, &idThread);
dword_1015E74 = 5;
if ( sub_1002665(0x4Cu) )
v6 = sub_100394F();
else
v6 = 0;
dword_1015E78 = v6;
if ( !v6 || (!sub_1002665(0x50u) ? (v7 = 0) : (v7 = sub_10038EF()), dword_1015E7C = v7, !v7) )
goto LABEL_13;
if ( (unsigned __int8)sub_1003F03() )
{
dword_1015E74 = 2;
}
else
{
v8 = sub_1002665(0x54u);
v9 = v8;
if ( v8 )
{
*(_DWORD *)v8 = &off_1001A54;
memset((void *)(v8 + 32), 0, 0x24u);
}
else
{
v9 = 0;
}
dword_1015E80 = v9;
if ( !v9 || (!sub_1002665(0x74u) ? (v10 = 0) : (v10 = sub_10094A4()), dwInitParam = v10, !v10) )
goto LABEL_13;
if ( !dword_1015E90 || dword_1015E94 || SHLWAPI_437(38) )
{
--dword_1015E74;
}
else
{
if ( sub_1002665(0x48u) )
v11 = sub_10039BB();
else
v11 = 0;
dword_1015E88 = v11;
if ( !v11 )
goto LABEL_13;
}
}
if ( !sub_1003D3F()
|| !(unsigned __int8)sub_100661C()
|| !(unsigned __int8)sub_1007C0D()
|| (v15 = CreateDialogParamW(v17, (LPCWSTR)0x69, 0, DialogFunc, 0), hWnd = v15, !v15) )
{
LABEL_13:
v18 = 0;
goto LABEL_52;
}
sub_1003CCC();
dword_1015E6C = 1;
SetWindowPos(hWnd, 0, Rect.left, Rect.top, Rect.right - Rect.left, Rect.bottom - Rect.top, 4u);
ShowWindow(hWnd, nCmdShow);
if ( dword_1015E14 )
{
ReleaseMutex(dword_1015E14);
CloseHandle(dword_1015E14);
dword_1015E14 = 0;
}
SetProcessShutdownParameters(1u, 1u);
while ( GetMessageW(&Msg, 0, 0, 0) )
{
if ( !TranslateAcceleratorW(hWnd, hAccTable, &Msg) )
{
if ( !IsDialogMessageW(hWnd, &Msg) )
{
TranslateMessage(&Msg);
DispatchMessageW(&Msg);
}
}
}
}
LABEL_52:
if ( dword_1015E14 )
{
ReleaseMutex(dword_1015E14);
CloseHandle(dword_1015E14);
dword_1015E14 = 0;
}
if ( dword_1015E78 )
(*(int (__stdcall **)(signed int))(*(_DWORD *)dword_1015E78 + 28))(1);
if ( dword_1015E7C )
(*(int (__stdcall **)(signed int))(*(_DWORD *)dword_1015E7C + 28))(1);
if ( dword_1015E80 )
(*(int (__stdcall **)(signed int))(*(_DWORD *)dword_1015E80 + 28))(1);
if ( dwInitParam )
sub_1003F71((HLOCAL)dwInitParam, 1);
if ( dword_1015E90 )
{
if ( dword_1015E88 )
(*(int (__stdcall **)(signed int))(*(_DWORD *)dword_1015E88 + 28))(1);
}
sub_1006780();
return v18;
}
任务管理器处理多开的地方
能力值:
( LV6,RANK:90 )
10 楼
hMutex=CreateMutex(NULL,TRUE,"tickets"); //main 建立一个互斥对象
if(hMutex) //检测到这个互斥,那第2个直接 return 不给执行
{
if(ERROR_ALREADY_EXISTS==GetLastError())
{
cout<<"only instance can run!"<<endl;
return;
}
}