ServiceMain
Image File Execution Options
Debuggers
windbg
cdb
ntsd
dbgsrv
Debuggers\x64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
svchost.exe
debugger
C:\Users\cmtest\Desktop\x64\ntsd.exe -server tcp:port=1234 -noio -y srv*C:\win_symbols*http://msdl.microsoft.com/download/symbols
-y
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
ServicesPipeTimeout
登录
允许服务与桌面交互
Connect to remote debugger
Connection strings
tcp:server=192.168.29.128,port=1234
OK
svchost2.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
ImagePath
svchost2
ntdll!NtTerminateProcess
.reload
The system cannot find the file specified
ntsd -p <pid>
.reload /f
LdrInitializeThunk
termsrv.dll
LoadLibrary
GetServiceMainFunctions
System\\CurrentControlSet\\Services\\Parameters
ServiceDll
ServiceManifest
a1
a1 + 8
SvchostPushServiceGlobals
SvchostPushServiceGlobalsEx
a2
a3
a4
DllMainCRTStartup
EB FE
termsrv.pdb
termsrv!DllMainCRTStartup
CC
int 3
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
yangya 直接改二进制文件不需要绕过签名吗?