首页
社区
课程
招聘
[求助]监控一些诸如BHO之类的ActiveX的安装,麻烦给个提示。
发表于: 2009-3-28 03:17 5328

[求助]监控一些诸如BHO之类的ActiveX的安装,麻烦给个提示。

2009-3-28 03:17
5328
最近要做一个这方面的东西,查了几天资料了,有一点点头绪。

我自己的想法:
1..这类控件要安装注册,会用到regsvr32等一些操作,注册DLL,但是不知道调用的底层API是什么,我想可以通过HOOK这个(这些)API来监控;

2..这类控件的安装都会往注册表的某些位置写入东西,可以监控注册表达到效果,但感觉需要HOOK很多地方,有没有比较全面一点的概括所有键值的资料.

另外,枚举已经安装的插件,我只想到了在注册表中找,有没有其他方法

希望大牛们来点提示.

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

收藏
免费 0
支持
分享
最新回复 (5)
雪    币: 0
活跃值: (954)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
2
拦截通过命令行注册,既可!

比如拦截 regsvr32
2009-3-28 11:33
0
雪    币: 412
活跃值: (30)
能力值: ( LV5,RANK:70 )
在线值:
发帖
回帖
粉丝
3
拦截命令行?不太懂
再说也不一定都是通过命令行去注册的,网上我找到的注册方法就有好几种.
2009-3-28 12:25
0
雪    币: 202
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
拦截RegSetValueExW 即可
2009-3-28 13:04
0
雪    币: 370
活跃值: (15)
能力值: ( LV9,RANK:170 )
在线值:
发帖
回帖
粉丝
5
About COMView
COMView has the following functions included:

shows COM related entries in registry
allows modification of these entries
shows type library information
COMView is able to generate ASM include files from type libraries
"dispatch helper" includes may be generated to simplify calling dispatchonly interfaces and implementing events sinks.
COM objects can be created, supported interfaces are shown
Verification of registry information is included
OLE container is implemented allowing OLE controls to be viewed and "in-place-activated"
Object properties may be edited and methods be executed.
Object model exposed by an application/control may be walked.
may connect to source interfaces and display incoming events

Some of the functions are described in this help file in more detail. But no introduction into COM is given here. So if you are new to COM you possibly may find some explanations a bit confusing and not very helpful. In this case search for more basic sources in the net, which should be no problem at all.

WARNING : Use COMView with great care! With COMView you may easily modify critical registry entries. And creating objects, changing properties or executing methods may cause severe data losses! If you don't know what you are doing, you may easily get your computer to act "strange" (to say the least). In any case save your work before starting this app!


This version of COMView is 2.9.8.
Download current version from http://www.japheth.de/Download/comview.zip

Send emails to mail@japheth.de.
Home page is http://www.japheth.de.

COMView is written in Assembler (MASM) of course.


没有用过,不知道对你有用否
2009-3-28 17:32
0
雪    币: 412
活跃值: (30)
能力值: ( LV5,RANK:70 )
在线值:
发帖
回帖
粉丝
6
这个东西还不错,就是COMView这个东西没源码
下了很多这方面的东西,难道都要我去逆不成?
2009-3-28 19:05
0
游客
登录 | 注册 方可回帖
返回
//