首页 > 代码库 > x64windows安全机制进程_线程_模块加载回调摘要
x64windows安全机制进程_线程_模块加载回调摘要
x64上面的每个回调都会对应一个count计数。注册表回调也会有。保存PspNotifyEnableMask标志，每个位分别代表相应的回调是否存在。
对应的位和相应的汇编代码如下。即使这个回调已经被杀毒软件注册了，我们通过定位相应的count并将其清0或者将相应的标志位置为0就可以让相应的回调得不到执行。
从而禁用掉杀软的安全机制。
PspNotifyEnableMask 1 1 1 1=fthread processex process image回调xp count 清零攻击nt!PspCreateProcessNotifyRoutineCount PspCreateThread PspExitProcess PsSetCreateProcessNotifyRoutinePAGE:83FCC97B B8 E4 AD F7 83 mov eax, offset _PspCreateProcessNotifyRoutineCountPAGE:83FCC980 F0 0F C1 08 lock xadd [eax], ecxPAGE:83FCC984 A1 78 AB F7 83 mov eax, _PspNotifyEnableMaskPAGE:83FCC989 A8 02 test al, 2 //10PAGE:83FCC98B 0F 85 70 FF FF FF jnz loc_83FCC901PAGE:83FCC991 B8 78 AB F7 83 mov eax, offset _PspNotifyEnableMaskPAGE:83FCC996 F0 0F BA 28 01 lock bts dword ptr [eax], 1nt!PspCreateProcessNotifyRoutineExCount PspCreateThread PspExitProcess PsSetCreateProcessNotifyRoutineExPAGE:83FCC9A0 B8 E0 AD F7 83 mov eax, offset _PspCreateProcessNotifyRoutineExCountPAGE:83FCC9A5 F0 0F C1 08 lock xadd [eax], ecxPAGE:83FCC9A9 A1 78 AB F7 83 mov eax, _PspNotifyEnableMaskPAGE:83FCC9AE A8 04 test al, 4 //100nt!PspCreateThreadNotifyRoutineCount PspCreateThread PspExitThread PsSetCreateThreadNotifyRoutinePAGE:840A07C1 E8 48 F3 FF FF call _EtwTraceThread@12 ; EtwTraceThread(x,x,x)PAGE:840A07C6 A1 78 AB F7 83 mov eax, _PspNotifyEnableMaskPAGE:840A07CB A8 08 test al, 8 //1000nt!PspLoadImageNotifyRoutineCount _PsImageNotifyEnabled PsSetLoadImageNotifyRoutinePAGE:83FFDF16 E8 41 06 00 00 call _MiObtainSectionForDriver@20 ; MiObtainSectionForDriver(x,x,x,x,x)PAGE:83FFDF1B 33 DB xor ebx, ebxPAGE:83FFDF1D 89 44 24 0C mov [esp+60h+var_54], eaxPAGE:83FFDF21 39 5C 24 14 cmp [esp+60h+var_4C], ebxPAGE:83FFDF25 0F 84 B7 00 00 00 jz loc_83FFDFE2PAGE:83FFDF2B A1 78 AB F7 83 mov eax, _PspNotifyEnableMaskPAGE:83FFDF30 8B 4C 24 14 mov ecx, [esp+60h+var_4C]PAGE:83FFDF34 A8 01 test al, 1//1win7 PspNotifyEnableMask 统管这4个0111=7
x64windows安全机制进程_线程_模块加载回调摘要
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。