SC_HANDLE WINAPI CreateService(
SC_HANDLE hSCManager, 00155D50
LPCTSTR lpServiceName, MSPDriver2
LPCTSTR lpDisplayName, MSPDriver2
DWORD dwDesiredAccess, 0F01FF
DWORD dwServiceType, 1
DWORD dwStartType, 3
DWORD dwErrorControl, 1
LPCTSTR lpBinaryPathName, C:\WINDOWS\system3\Drivers\MSPDriver2.sys
LPCTSTR lpLoadOrderGroup, 0 NULL
LPDWORD lpdwTagId, 0 NULL
LPCTSTR lpDependencies, 0 NULL
LPCTSTR lpServiceStartName, 0 NULL
LPCTSTR lpPassword 0 NULL
);
OpenServiceA(
Long hSCManager,
String lpServiceName,
Ulong dwDesiredAccess
);
StartServiceA(
Long hService,
Ulong dwNumServiceArgs,
String lpServiceArgVectors
);
CloseServiceHandle(
Long hService,
);
CreateFileA(
lpFileName As String, \\.\MSPDriver2
dwDesiredAccess As Long, C0000000
dwShareMode As Long, 3
lpSecurityAttributes As SECURITY_ATTRIBUTES, 0
dwCreationDisposition As Long, 3
dwFlagsAndAttributes As Long, 0
hTemplateFile As Long 0
);
DeviceIoControl(
hDevice As Long, [00459A08]=0000005C
dwIoControlCode As Long, C07FE000
lpInBuffer As Any, [004599E4]=B85DAA
nInBufferSize As Long, 20
lpOutBuffer As Any, [00459354]=459000
nOutBufferSize As Long, 4
lpBytesReturned As Long, [00459354]=0
lpOverlapped As OVERLAPPED 0
);
HidD_GetHidGuid ? 获取GUID信息
12
0
0
SetupDiGetClassDevsA(
ClassGuid As GUID, 0
Enumerator As String, ss:[00459A60]=00154B30
hwndParent As Long, ss:[00459A48]=00000000
Flags As Long ss:[00459A68]=00152B48
)
SetupDiEnumDeviceInterfaces(
DeviceInfoSet As Long, [00459A64]=00154CB8
DeviceInfoData As Long, [00459A68]=00152B48
InterfaceClassGuid As GUID, 0
MemberIndex As Long, 0
DeviceInterfaceData As SP_DEVICE_INTERFACE_DATA [00459A70]=0
)
SetupDiGetDeviceInterfaceDetail(
DeviceInfoSet As Long, [00459A64]=00154CB8
DeviceInterfaceData As SP_DEVICE_INTERFACE_DATA, [00459A68]=00152B48
DeviceInterfaceDetailData As Long, [00459A4C]=00162620
DeviceInterfaceDetailDataSize As Long, [00459A70]=00000057
RequiredSize As Long, [00459A54]=0
DeviceInfoData As Long 0
)
CreateFileA(
lpFileName As String, \\?\hid#vid_046d&pid_c018#6&31af0a38&0&0000#{4d1e55b2-f16f-11cf-88cb-001111000030
dwDesiredAccess As Long, C0000000
dwShareMode As Long, 0
lpSecurityAttributes As SECURITY_ATTRIBUTES, 0
dwCreationDisposition As Long, 3
dwFlagsAndAttributes As Long, 40000000
hTemplateFile As Long 0
);
跟到这里，不能创建了，就挂了
我试图JMP过那些，发现不太现实，能解释下吗 这CRACKME 是怎么打算了？
必须注册服务后才行吗，水平有限，问个浅浅的问题，这些和USB有关系吗？
