我的代码箱

来源：互联网发布：手机淘宝怎么注册开店编辑：程序博客网时间：2024/05/01 03:30

以下代码已被废弃，特记录之

////NtCreateSession Part

//HANDLE hHandle = GetCurrentProcess();

//DuplicateHandle(hHandle,*SectionHandle,hHandle,&m_hSectionHandle,SECTION_MAP_WRITE|SECTION_MAP_READ,FALSE,0);

//CloseHandle(hHandle);

//测试是否为非系统DLL

// if ((DWORD)lpMap<0x70000000)

//{

// if (MessageBox(NULL,str,_T("Mabye Dll"),MB_ICONQUESTION|MB_OKCANCEL)!=IDOK)

// {

// CloseHandle(*SectionHandle);

// ret=STATUS_ACCESS_DENIED;

// }

//}

NtCreateThread Part

//#else

// LPVOID lpRemote;

// LPVOID RealEnter;

// lpRemote = MapViewOfFileEx(m_hSectionHandle,SECTION_MAP_WRITE|SECTION_MAP_READ,0,0,0,NULL);

// CloseHandle(m_hSectionHandle);

// m_hSectionHandle=NULL;

//#endif

   //HMODULE hModule;
   //if (GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,(LPCTSTR)lpMap,&hModule))
   // GetModuleBaseName(GetCurrentProcess,(HMODULE)lpMap,str,MAX_PATH);
   //else if (!
   // 针对Session 无效

///死循环测试

////B8 31 03 93 7C FF D0 ((FARPROC)(0x7c930331))();
//char ins[]={0xEB,0xFE,0xB8,0x31,0x03,0x93,0x7C,0xFF,0xD0};
//WriteProcessMemory(hProcess,(LPBYTE)lpRemote+sizeof(DWORD)*2,ins,9,&u_Written);