第04－20种方法
hehe02.rar
04
GetProcAddress(得到ExitProcess函数地址)->
OpenProcess(得到进程HANDLE(用PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION)这种方式打开，绕过过滤)->
CreateRemoteThread(创建一个ExitProcess的线程让程序退出)
05
ObReferenceObjectByName(得到crackme DRIVER_OBJECT)->
(计算crackme内部unhook函数地址)->
调用crackme内部的unhook卸载ssdt hook->
ring3下面
OpenProcess(打开crackmeapp进程)
TerminateProcess(关掉进程)
06
ObReferenceObjectByName(得到crackme DRIVER_OBJECT)->
(修改crackme.sys内保存的crackmeapp的PID的值，让crackmeapp不被保护)->
ring3下面
OpenProcess(打开crackmeapp进程)
TerminateProcess(关掉进程)
07
ObReferenceObjectByName(得到crackme DRIVER_OBJECT)->
(修改crackme.sys内HookNtOpenProcess函数内部的关键跳转，爆破成功)->
ring3下面
OpenProcess(打开crackmeapp进程)
TerminateProcess(关掉进程)
08
FindWindow(得到窗口句柄)->SetForegroundWindow(把窗口提到前端)->keybd_event(模拟键盘输入Alt+Space)->keybd_event(模拟键盘输入C)
09
得到NtOpenProcess真实地址->
NtQuerySystemInformation(得到crackmeapp的pid)->
(真实的)NtOpenProcess(打开crackmeapp进程)->
ZwTerminateProcess(关掉进程)
10
FindWindow(得到窗口句柄)->SetForegroundWindow(把窗口提到前端)->
GetWindowRect(得到窗口位置)->SetCursorPos(把鼠标移动到窗口左上角地方)->
mouse_event(模拟鼠标双击左键)
11
FindWindow(得到窗口句柄)->SetForegroundWindow(把窗口提到前端)->
GetWindowRect(得到窗口位置)->SetCursorPos(把鼠标移动到窗口左上角地方)->
mouse_event(模拟鼠标单击击左键)->
keybd_event(模拟键盘按键C)
12
FindWindow(得到窗口句柄)->SetForegroundWindow(把窗口提到前端)->keybd_event(模拟键盘输入ESC)
13
NtQuerySystemInformation(得到所有crackmeapp进程的文件句柄)->
DuplicateHandle(把crackmeapp的句柄转换成自己进程的句柄)->
CloseHandle(关闭文件句柄)->
卸载crackme驱动->
OpenProcess(打开crackmeapp)->
TerminateProcess(关闭进程)
14
FindWindow(得到窗口句柄)->PostMessage(发送WM_NCDESTROY消息)
15
FindWindow(得到窗口句柄)->PostMessage(发送WM_SYSCOMMAND消息WPARAM=SC_CLOSE)
16
OpenProcess(用PROCESS_VM_OPERATION方式打开)->
VirtualProtectEx(把crackmeapp的kernel32.dll进程空间设置为PAGE_NOACCESS)
17
NtQuerySystemInformation(得到所有crackmeapp进程的文件句柄)->
DuplicateHandle(把crackmeapp的句柄转换成自己进程的句柄)->
CloseHandle(关闭文件句柄)->
卸载crackme驱动->
OpenProcess(打开crackmeapp)->
WriteProcessMemory(修改默认的窗口回调函数jmp到ExitProcess)
18
ObReferenceObjectByName(得到crackme DRIVER_OBJECT)->
(计算crackme内部unhook函数地址)->
调用crackme内部的unhook卸载ssdt hook->
ring3下面
OpenProcess(打开crackmeapp)->
WriteProcessMemory(修改默认的窗口回调函数jmp到ExitProcess)
19
FindWindow(得到窗口句柄)->PostMessage(发送WM_QUIT消息)
20
ExitWindowsEx(重启)
