最近又无聊了
听某兄弟说np又不能xx了

下载回来1份看看

测试版本
nProtect GameGuard Module
npggNT.des
87.0 KB (89,179 )
版本 2007, 8, 7, 1

nProtect Game Monitor
GameMon.des
2.46 MB (2,582,042 ֽ)

发现hook已经有了变化
SSDT hook 无
shadow 1个sendinput
inline +了KeSetProfileIrql

ntoskrnl.exe-->KeAttachProcess, Type: Inline - RelativeJump at address 0x804EC938 hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->KeStackAttachProcess, Type: Inline - RelativeJump at address 0x804F2743 hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->NtOpenProcess, Type: Inline - RelativeJump at address 0x80574C96 hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->NtProtectVirtualMemory, Type: Inline - RelativeJump at address 0x80575045 hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->NtDeviceIoControlFile, Type: Inline - RelativeJump at address 0x8057CF7B hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->NtReadVirtualMemory, Type: Inline - RelativeJump at address 0x8057F48E hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->NtWriteVirtualMemory, Type: Inline - RelativeJump at address 0x8057F5E0 hook handler located in [dump_wmimmc.sys]
ntoskrnl.exe-->KeSetProfileIrql, Type: Inline - RelativeCall at address 0x806A4116 hook handler located in [ntoskrnl.exe]

hook指向ntoskrnl.exe内部  不过偶只能比较肯定是np
测试机器是新ghost的系统 没有安装任何东西

r3的选择一个
[956]EXPLORER.EXE-->ntdll.dll-->NtDeviceIoControlFile, Type: Inline - RelativeJump at address 0x7C92D8E3 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtLoadDriver, Type: Inline - RelativeJump at address 0x7C92DB6E hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtOpenProcess, Type: Inline - RelativeJump at address 0x7C92DD7B hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump at address 0x7C92DEB6 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtQuerySystemInformation, Type: Inline - RelativeJump at address 0x7C92E1AA hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtReadVirtualMemory, Type: Inline - RelativeJump at address 0x7C92E2BB hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtSuspendProcess, Type: Inline - RelativeJump at address 0x7C92E83A hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtSuspendThread, Type: Inline - RelativeJump at address 0x7C92E84F hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtTerminateProcess, Type: Inline - RelativeJump at address 0x7C92E88E hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtTerminateThread, Type: Inline - RelativeJump at address 0x7C92E8A3 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump at address 0x7C92EA32 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->VirtualProtectEx, Type: Inline - RelativeJump at address 0x7C801A5D hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->VirtualProtect, Type: Inline - RelativeJump at address 0x7C801AD0 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->LoadLibraryExW, Type: Inline - RelativeJump at address 0x7C801AF1 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->ReadProcessMemory, Type: Inline - RelativeJump at address 0x7C8021CC hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->WriteProcessMemory, Type: Inline - RelativeJump at address 0x7C80220F hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->GetProcAddress, Type: Inline - RelativeJump at address 0x7C80AC28 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->MapViewOfFileEx, Type: Inline - RelativeJump at address 0x7C80B71E hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->MapViewOfFile, Type: Inline - RelativeJump at address 0x7C80B78D hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->CreateProcessInternalW, Type: Inline - RelativeJump at address 0x7C8191EB hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->OpenProcess, Type: Inline - RelativeJump at address 0x7C81E079 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->MoveFileW, Type: Inline - RelativeJump at address 0x7C839659 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->kernel32.dll-->DebugActiveProcess, Type: Inline - RelativeJump at address 0x7C859F0B hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->advapi32.dll-->CreateProcessWithLogonW, Type: Inline - RelativeJump at address 0x77DE5C9D hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->GetWindowThreadProcessId, Type: Inline - RelativeJump at address 0x77D18A80 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll+0x00008B80, Type: Inline - RelativeJump at address 0x77D18B80 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->PostMessageW, Type: Inline - RelativeJump at address 0x77D18CCB hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SendMessageW, Type: Inline - RelativeJump at address 0x77D1B8BA hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->PostMessageA, Type: Inline - RelativeJump at address 0x77D1CB85 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump at address 0x77D2E4AF hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SendInput, Type: Inline - RelativeJump at address 0x77D2F118 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SendInput, Type: Inline - RelativeJump at address 0x77D2F122 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SendMessageA, Type: Inline - RelativeJump at address 0x77D2F39A hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump at address 0x77D311E9 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->SetCursorPos, Type: Inline - RelativeJump at address 0x77D55E4B hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->mouse_event, Type: Inline - RelativeJump at address 0x77D662FD hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->user32.dll-->keybd_event, Type: Inline - RelativeJump at address 0x77D66341 hook handler located in [npggNT.des]
[956]EXPLORER.EXE-->gdi32.dll-->GetPixel, Type: Inline - RelativeJump at address 0x77EFB471 hook handler located in [npggNT.des]

基本上没有多少变化

notify已经只有1个process了

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)