ServiceMain
Image File Execution Options
Debuggers
windbg
cdb
ntsd
dbgsrv
Debuggers\x64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
svchost.exe
debugger
C:\Users\cmtest\Desktop\x64\ntsd.exe -server tcp:port=1234 -noio -y srv*C:\win_symbols*http://msdl.microsoft.com/download/symbols
-y
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
ServicesPipeTimeout
登录
允许服务与桌面交互
Connect to remote debugger
Connection strings
tcp:server=192.168.29.128,port=1234
OK
svchost2.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
ImagePath
svchost2
ntdll!NtTerminateProcess
.reload
The system cannot find the file specified
ntsd -p <pid>
.reload /f
LdrInitializeThunk
termsrv.dll
LoadLibrary
GetServiceMainFunctions
System\\CurrentControlSet\\Services\\Parameters
ServiceDll
ServiceManifest
a1
a1 + 8
SvchostPushServiceGlobals
SvchostPushServiceGlobalsEx
a2
a3
a4
DllMainCRTStartup
EB FE
termsrv.pdb
termsrv!DllMainCRTStartup
CC
int 3
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!
yangya 直接改二进制文件不需要绕过签名吗?