VB创建SYSTEM用户进程(第二种方法)
来源:互联网 发布:网络乱象 编辑:程序博客网 时间:2024/06/11 05:32
Attribute VB_Name = "modHook"
Private Declare Function NtCreateProcessEx Lib "NTDLL.DLL" (ByRef ProcessHandle As Long, ByVal AccessMask As Long, ByVal ObjectAttributes As Long, ByVal hParentProcess As Long, ByVal InheritHandles As Long, ByVal hSection As Long, ByVal hDebugPort As Long, ByVal hExceptionPort As Long, ByVal reserv As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long
Private Const PROCESS_QUERY_INFORMATION As Long = (&H400)
Private Const STANDARD_RIGHTS_REQUIRED As Long = &HF0000
Private Const SYNCHRONIZE As Long = &H100000
Private Const PROCESS_ALL_ACCESS As Long = (STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or &HFFF)
Private Type OBJECT_ATTRIBUTES
Length As Long
RootDirectory As Long
ObjectName As Long
Attributes As Long
SecurityDescriptor As Long
SecurityQualityOfService As Long
End Type
Public gclsHookInfo As clsHookInfo
Public glngProcess As Long
Public glngSystemHandle As Long
Public Function NtCreateProcessExCallback(ByRef ProcessHandle As Long, ByVal AccessMask As Long, ByVal ObjectAttributes As Long, ByVal hParentProcess As Long, ByVal InheritHandles As Long, ByVal hSection As Long, ByVal hDebugPort As Long, ByVal hExceptionPort As Long, ByVal reserv As Long) As Long
Dim hReturn As Long
'hParentProcess 指定为一个System用户进程的句柄,需要注意的是不要关闭此句柄
gclsHookInfo.HookStatus False
hReturn = NtCreateProcessEx(ProcessHandle, AccessMask, ObjectAttributes, glngSystemHandle, InheritHandles, hSection, hDebugPort, hExceptionPort, reserv)
gclsHookInfo.HookStatus True
NtCreateProcessExCallback = hReturn
End Function
Public Function GetFunAddr(lngFunAddr As Long) As Long
GetFunAddr = lngFunAddr
End Function
- VB创建SYSTEM用户进程(第二种方法)
- VB 创建SYSTEM用户进程
- VB创建SYSTEM用户进程(第一种方法)
- "SYSTEM"用户创建进程
- 在SYSTEM权限下创建用户进程方法
- 通过API HOOK 创建SYSTEM用户进程
- system 用户创建的进程创建当前用户(如Administrator)的进程。
- 创建SYSTEM进程
- 在服务程序中创建用户进程的方法
- 在服务程序中创建用户进程的方法(C++)
- 创建SYSTEM用户权限的进程
- system权限创建用户权限进程
- 进程创建system、exec、fork
- System进程的启动流程第二部分
- 创建多线程的第二种方法
- 创建特定用户的进程
- 浅析VB.NET方法创建
- MySQL创建用户的三种方法
- IDES学习――用采购订单进行公司间转储
- Visual Studio 2008 Beta 2
- 转:《Effective C#》Item 7:推荐使用不可改变的原子值类型
- google搜索参数
- 很无聊的东西
- VB创建SYSTEM用户进程(第二种方法)
- SATA硬盘常见问题
- Aqualogic Service Bus and Mule Flow Diagrame Comparation
- sql 查询结果随机排序
- VB编写病毒
- C++内存管理——C++内存分类
- 转:《Effective C#》Item 6:区分值类型和引用类型
- VB拷贝SAM文件
- 巧用spring配置常量