int main(int argc,char *argv[])
 {
     if(argc != 4)
         puts("usage ccon csrss.pid prmd.handle hooksys.handle");
     else
     {
         int pid = atoi(argv[1]);
         int hprmd = atoi(argv[2]);
         int hobj = atoi(argv[3]);

         if(!SetDebugPrivilege(true))
             puts("SetDebugPrivilege Failed!");
         HANDLE hcs = OpenProcess(PROCESS_ALL_ACCESS,false,pid);
         if(!hcs)
         {
             puts("Open Csrss.exe Failed");
             PrintErr(GetLastError());
         }
         else //直接打开RavMonD进程会失败的，so采用迂回战术
         {
             HANDLE hprmd_loc;
             if(!DuplicateHandle(hcs,(HANDLE)hprmd,GetCurrentProcess(),\
                 &hprmd_loc,PROCESS_ALL_ACCESS,false,0))
             {
                 puts("Get hprmd_loc Failed!");
                 PrintErr(GetLastError());
             }
             else //关闭hooksys的句柄，打破其与内核的联系
             {
                 HANDLE hobj_loc;
                 if(!DuplicateHandle(hprmd_loc,(HANDLE)hobj,\
                     GetCurrentProcess(),&hobj_loc,0,false,\
                     DUPLICATE_CLOSE_SOURCE | DUPLICATE_SAME_ACCESS))
                 {
                     puts("Get hobj_loc Failed!");
                     PrintErr(GetLastError());
                 }
                 else
                 {
                     if(!CloseHandle(hobj_loc))
                     {
                         puts("Close hobj_loc Failed");
                     }
                     else
                         puts("We Success Finally!!!");
                 }
             }
         }
     }
     return 0;
 }       

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法