【求助】钩住了ZwCreateProcessEx,拦不住ShellExecute?
XP下SSDT钩住了ZwCreateProcessEx (2K下ZwCreateProcess),
点击打开的进程可以监控
拦不住程序中ShellExecute创建的进程。
已解决, 是可以拦住ShellExecute, 挥泪感谢各位大侠的提点!!
看到这个帖子的回复,感觉很温暖,谢谢!
下边是ShellExecute简单流程:
ShellExecute->ShellExecuteEx->ShellExecuteExA->ShellExecuteExW->ShellExecuteNormal->SHELL32!CShellExecute::ExecuteNormal->SHELL32!CShellExecute::_TryInvokeApplication->SHELL32!CShellExecute::_DoExecCommand->SHELL32!_SHCreateProcess->SHELL32!_imp__CreateProcessW
ShellExecute:
7D610F40 > 8BFF mov edi, edi
7D610F42 55 push ebp
7D610F43 8BEC mov ebp, esp
7D610F45 83EC 3C sub esp, 3C
7D610F48 8B45 08 mov eax, dword ptr [ebp+8]
7D610F4B 8365 E4 00 and dword ptr [ebp-1C], 0
7D610F4F 8945 CC mov dword ptr [ebp-34], eax
7D610F52 8B45 0C mov eax, dword ptr [ebp+C]
7D610F55 8945 D0 mov dword ptr [ebp-30], eax
7D610F58 8B45 10 mov eax, dword ptr [ebp+10]
7D610F5B 8945 D4 mov dword ptr [ebp-2C], eax
7D610F5E 8B45 14 mov eax, dword ptr [ebp+14]
7D610F61 56 push esi
7D610F62 8945 D8 mov dword ptr [ebp-28], eax
7D610F65 8B45 18 mov eax, dword ptr [ebp+18]
7D610F68 57 push edi
7D610F69 8945 DC mov dword ptr [ebp-24], eax
7D610F6C 8B45 1C mov eax, dword ptr [ebp+1C]
7D610F6F 6A 06 push 6
7D610F71 8945 E0 mov dword ptr [ebp-20], eax
7D610F74 59 pop ecx
7D610F75 33C0 xor eax, eax
7D610F77 8D7D E8 lea edi, dword ptr [ebp-18]
7D610F7A BE 00020000 mov esi, 200
7D610F7F C745 C4 3C00000>mov dword ptr [ebp-3C], 3C
7D610F86 F3:AB rep stos dword ptr es:[edi]
7D610F88 56 push esi
7D610F89 BF 00140000 mov edi, 1400
7D610F8E FF15 DC1B597D call dword ptr [<&SHLWAPI.#461>] ; SHLWAPI.#461
7D610F94 85C6 test esi, eax
7D610F96 75 05 jnz short 7D610F9D
7D610F98 BF 00150000 mov edi, 1500
7D610F9D 8D45 C4 lea eax, dword ptr [ebp-3C]
7D610FA0 50 push eax
7D610FA1 897D C8 mov dword ptr [ebp-38], edi
7D610FA4 E8 6CFCFFFF call ShellExecuteExA <<<<-----
7D610FA9 8B45 E4 mov eax, dword ptr [ebp-1C]
7D610FAC 5F pop edi
7D610FAD 5E pop esi
7D610FAE C9 leave
7D610FAF C2 1800 retn 18
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课