2017年1月23日
小试X64 inline HOOK,hook explorer.exe--->CreateProcessInternalW监视进程创建
原始函数是这样的 [cpp] view plain copy kernel32!CreateProcessInternalW: 00000000`7738e750 4c8bdc mov r11,rsp 00000000`7738e753 53 push rbx 00000000`7738e754 5 Read More
posted @ 2017-01-23 22:12 findumars Views(1596) Comments(0) Diggs(0)
RtlAdjustPrivilege进程提权,权限ID对照表
[cpp] view plain copy [cpp] view plain copy http://blog.csdn.net/zwfgdlc/article/details/52794551 Read More
posted @ 2017-01-23 22:08 findumars Views(1062) Comments(0) Diggs(0)
x64内联汇编调用API(需intel编译器,vc不支持x64内联汇编)
[cpp] view plain copy [cpp] view plain copy http://blog.csdn.net/zwfgdlc/article/details/17467453 Read More
posted @ 2017-01-23 21:58 findumars Views(1558) Comments(0) Diggs(0)
屏蔽按CapsLock键切换到大写时,编辑框自动弹出的提示（UnregisterClass(TOOLTIPS_CLASS)后，重新设置WndProc并注意返回值）
[cpp] view plain copy [cpp] view plain copy http://blog.csdn.net/zwfgdlc/article/details/49591315 Read More
posted @ 2017-01-23 21:56 findumars Views(879) Comments(0) Diggs(0)
非常简单的利用CreateProcess注入DLL的方法
[cpp] view plain copy [cpp] view plain copy http://blog.csdn.net/zwfgdlc/article/details/8827116 Read More
posted @ 2017-01-23 21:53 findumars Views(2125) Comments(0) Diggs(0)