reconstruct function fastcall
Bài đăng
Tránh tràn ram máy tính
Tat hoan toan may tinh tranh tran ram, cham may Shift + shutdown Shutdown binh thuong chi tat phan co cua may tinh
Code Service CPP
wmain-> StartServicecCtrlDispatcher -> ------------ sc queryex <name> taskkill /PID <pid> /F ==== Tool dùng để tấn công các công ty eco :DD Bypass UAC và đăng kí service thôi :3 #define _CRT_SECURE_NO_WARNINGS #include "Windows.h" #include "stdio.h" #include "log.h" #define SERVICE_NAME L"Meo" SERVICE_STATUS svstatus; SERVICE_STATUS_HANDLE svstatus_handle; void WINAPI HandleFunction(DWORD Control) { switch (Control) { case 2: svstatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus(svstatus_handle, &svstatus); } } void WINAPI ServiceMain(DWORD dwNumServicesArgs, LPWSTR* lpServiceArgVectors) { svstatus_handle = RegisterServiceCtrlHandlerW(SERVICE_NAME, HandleFunction); // luồng logic chính //** start svstatus.dwCurrentState = SERVICE_RUNNING; svstatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS; svstatus.dwControlsAccepted = SERVICE_ACCEPT_STOP; SetServiceStatus(svstatus_handle, &svstatus); ...
Hướng dẫn debug kernel trong vmware
cai windebug attacker vo kernel thi chu y chu y secure boot tat chua, neu chua vo thi de disable bcdedit /debug on bcdedit /dbgsettings serial debugport:1 baudrate:115200 msconfig nen nho, chi attach khi boot -> nen chay windbg truoc khi khoi dong vmware ========================== !process 0 0: Liệt kê các process đang chạy bp nt!NtWriteFile: dat breakpoint tai NtWriteFile trong nt.dll bl: list breakpoint bc 1: xoa breakpoint 1 g: go(continue) k: call stack !process 0 0 notepad.exe bp /p ffff920bda2890c0 nt!NtWriteFile: đặt breakpoint tại hàm NtWriteFile được dùng bởi nt.dll trong địa chỉ fff... !handle @rcx
In process CPP
#include <windows.h> #include <stdio.h> #include <tlhelp32.h> int main() { PROCESSENTRY32W pe; pe.dwSize = sizeof(PROCESSENTRY32W); HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hSnapshot == INVALID_HANDLE_VALUE) { printf("Cant get snapshot\n"); return 1; } if (!Process32FirstW(hSnapshot, &pe)) { printf("Process32First failed: %lu\n", GetLastError()); CloseHandle(hSnapshot); return 1; } do { wprintf(L"%ls\n", pe.szExeFile); } while (Process32NextW(hSnapshot, &pe)); CloseHandle(hSnapshot); return 0; }
Kiểu dữ liệu WINAPI
Bảng nhanh (hay dùng trong WinAPI) WinAPI type C type printf DWORD unsigned long %lu WORD unsigned short %hu BYTE unsigned char %u BOOL int %d HANDLE pointer %p LPVOID pointer %p