首页
社区
课程
招聘
Int3断点设置与移除函数(C++)
2023-10-2 21:25 7941

Int3断点设置与移除函数(C++)

2023-10-2 21:25
7941

小菜学习in3断点之余,感觉封装为两个函数调用有点方便。小白分享,大神飘过

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
插入代码
```void SetInt3Breakpoint(HANDLE hProcess, DWORD SetInt3address)
{
    DWORD oldProtect;
    VirtualProtect((LPVOID)SetInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
    originalByte = *(BYTE*)SetInt3address;
    BOOL VirtualProtectResult = VirtualProtect((LPVOID)SetInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
    if (VirtualProtectResult)
    {
        MessageBox(NULL, TEXT("SetInt3_VirtualProtect操作成功"), TEXT("提示"), NULL);
    }
    else
    {
        MessageBox(NULL, TEXT("SetInt3_VirtualProtect操作失败"), TEXT("提示"), NULL);
        DWORD dwError = GetLastError();
        VirtualProtectEx(hProcess, (LPVOID)SetInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
        BOOL VirtualProtectExResult = VirtualProtectEx(hProcess, (LPVOID)SetInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
        if (VirtualProtectExResult)
        {
            MessageBox(NULL, TEXT("SetInt3_VirtualProtectEx操作成功"), TEXT("提示"), NULL);
        }
        else
        {
            MessageBox(NULL, TEXT("SetInt3_VirtualProtectEx操作失败"), TEXT("提示"), NULL);
            DWORD dwError = GetLastError();
        }
    }
    //WriteProcessMemory(hProcess, (LPVOID)SetInt3address, &KeyInfo, 0x1, NULL);
    memcpy((LPVOID)SetInt3address, KeyInfo, sizeof(KeyInfo));
    //BOOL writeResult = WriteProcessMemory(hProcess, (LPVOID)SetInt3address, &KeyInfo, 0x1, NULL);
    //if (writeResult)
    //{
    //  MessageBox(NULL, TEXT("SetInt3_address Int3写入成功"), TEXT("提示"), NULL);
 
    //}
    //else
    //{
    //  MessageBox(NULL, TEXT("SetInt3_address Int3写入失败"), TEXT("提示"), NULL);
    //  DWORD dwError = GetLastError();
 
    //}
 
    VirtualProtect((LPVOID)SetInt3address, sizeof(BYTE), oldProtect, &oldProtect);
    wsprintf(szBuffer, TEXT("Int3设置完成 *(BYTE*)SetInt3address= %#I32x"), *(BYTE*)SetInt3address);
    OutputDebugString(szBuffer);
    if (*(BYTE*)SetInt3address == 0xCC)
    {
        MessageBox(NULL, TEXT("Int3设置成功"), TEXT("提示"), NULL);
    }
}
 
void RemoveInt3Breakpoint(HANDLE hProcess, DWORD RemoveInt3address)
{
    DWORD oldProtect;
    VirtualProtect((LPVOID)RemoveInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
    BOOL VirtualProtectResult = VirtualProtect((LPVOID)RemoveInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
    if (VirtualProtectResult)
    {
        MessageBox(NULL, TEXT("Remove_VirtualProtect操作成功"), TEXT("提示"), NULL);
    }
    else
    {
        MessageBox(NULL, TEXT("Remove_VirtualProtect操作失败"), TEXT("提示"), NULL);
        DWORD dwError = GetLastError();
 
        VirtualProtectEx(hProcess, (LPVOID)RemoveInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
        BOOL VirtualProtectExResult = VirtualProtectEx(hProcess, (LPVOID)RemoveInt3address, sizeof(BYTE), PAGE_EXECUTE_READWRITE, &oldProtect);
        if (VirtualProtectExResult)
        {
            MessageBox(NULL, TEXT("Remove_VirtualProtectEx操作成功"), TEXT("提示"), NULL);
        }
        else
        {
            MessageBox(NULL, TEXT("Remove_VirtualProtectEx操作失败"), TEXT("提示"), NULL);
            DWORD dwError = GetLastError();
        }
    }
    memcpy((LPVOID)RemoveInt3address, &originalByte, sizeof(originalByte));
    //WriteProcessMemory(hProcess, (LPVOID)RemoveInt3address, &originalByte, sizeof(BYTE), NULL);
/*      BOOL writeResult = WriteProcessMemory(hProcess, (LPVOID)RemoveInt3address, &originalByte, sizeof(BYTE), NULL);
        if (writeResult)
        {
            MessageBox(NULL, TEXT("SetInt3address Int3还原成功"), TEXT("提示"), NULL);
        }
        else
        {
            MessageBox(NULL, TEXT("SetInt3address Int3还原失败"), TEXT("提示"), NULL);
            DWORD dwError = GetLastError();
        }*/
    VirtualProtect((LPVOID)RemoveInt3address, sizeof(BYTE), oldProtect, &oldProtect);
    wsprintf(szBuffer, TEXT("Int3执行完成 *(BYTE*)RemoveInt3address= %#I32x"), *(BYTE*)RemoveInt3address);
    OutputDebugString(szBuffer);
}

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

最后于 2023-10-2 21:26 被daohaodaye编辑 ,原因:
收藏
点赞2
打赏
分享
最新回复 (3)
雪    币: 19299
活跃值: (28938)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
秋狝 2023-10-2 22:10
2
1
感谢分享
雪    币: 10719
活跃值: (4084)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
jgs 2023-10-3 09:19
3
0
题主是飘云阁的冷月孤心
雪    币: 2481
活跃值: (2726)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
院士 2023-10-3 15:28
4
0
冷版?厉害了,感谢分享,学习学习。
游客
登录 | 注册 方可回帖
返回