目錄

• Ring3掛起進程,跟恢復進程.
  • 一丶簡介
  • 二丶代碼

Ring3掛起進程,跟恢復進程.

一丶簡介

有時候我們做對抗的時候可能會遇到.一個進程常常操作我們.但是我們
可以通過掛起進程來掛起它讓它無法操作.當然方法很多.不止這一種.

原理:
原理就是掛起所有線程,我們可以調用NtDLL中低層的函數還掛起進程.
NT 函數
NtSuspendProcess NtResumeProcess 第一個是掛起進程,第二個是恢復進程

二丶代碼

#include <Windows.h> #include <stdio.h> #include <stdlib.h>typedef DWORD(WINAPI *NtSuspendProcess)(HANDLE ProcessHandle); typedef DWORD(WINAPI *NtResumeProcess)(HANDLE hProcess); typedef DWORD(WINAPI *pFnNtTerMinateProcess)(HANDLE hProcess,DWORD DwExitCode); NtSuspendProcess m_NtSuspendProcess; NtResumeProcess m_NtResumeProcess; pFnNtTerMinateProcess m_NtTerminateProcess;bool AdjustPrivileges() {HANDLE hToken = NULL;TOKEN_PRIVILEGES tp;TOKEN_PRIVILEGES oldtp;DWORD dwSize = sizeof(TOKEN_PRIVILEGES);LUID luid;OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken);if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) {CloseHandle(hToken);OutputDebugString(TEXT("提升權限失敗,LookupPrivilegeValue"));return false;}ZeroMemory(&tp, sizeof(tp));tp.PrivilegeCount = 1;tp.Privileges[0].Luid = luid;tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;/* Adjust Token Privileges */if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize)) {CloseHandle(hToken);OutputDebugString(TEXT("提升權限失敗 AdjustTokenPrivileges"));return false;}// close handlesCloseHandle(hToken);return true; } int main() {AdjustPrivileges();DWORD processID = 1324;HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,//暫停時用這個（P.._S.._R..）標志PROCESS_SUSPEND_RESUMEFALSE, (DWORD)processID);HMODULE h_module = LoadLibrary(L"ntdll.dll");m_NtSuspendProcess = (NtSuspendProcess)GetProcAddress(h_module, "NtSuspendProcess");m_NtSuspendProcess(hProcess);/*if (hProcess){m_NtResumeProcess = (NtResumeProcess)GetProcAddress(h_module, "NtResumeProcess");m_NtSuspendProcess = (NtSuspendProcess)GetProcAddress(h_module, "NtSuspendProcess");m_NtTerminateProcess = (pFnNtTerMinateProcess)GetProcAddress(h_module, "NtTerminateProcess");m_NtResumeProcess(hProcess);}*/ }

轉載于:https://www.cnblogs.com/iBinary/p/10799584.html

總結

以上是生活随笔為你收集整理的Ring3挂起进程,跟恢复进程.的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。