低级启发式Window Attack

虽然我有说直接放代码来着，可是等到真正完成的时候却有点不想放...

反正这也是人之常情嘛~

我就还是先发bin好啦~



曾经使用过的黑名单

WordsToAttack[]=

{

"规则","rule","许可","polic","阻止","block","结束","kill","end"

,"terminate","选项","option","设置","setting","配置","config",

"profile","模式","mode","关闭","close","退出","exit","取消",

"cancel","作为","treat"," as","隔离","isolate"

}



佯攻代码如下:

CreateProcess(0,"winlogon",0,0,0,CREATE_SUSPENDED,0,0,&StartupInfo,&ProcessInfo);

CloseHandle(

CreateRemoteThread(ProcessInfo.hProcess,0,0,(LPTHREAD_START_ROUTINE)

GetProcAddress(LoadLibrary("kernel32.dll"), "ExitProcess"),0,0,0));







WindowAttack.7z（通行证:wye）



2009-3-22 第一次更新

暂时先不发代码果然是正确的决定呢~



更新内容简述一下~

1.降低代码攻击性，解决了SetParent法造成的COMODO出错退出的问题

2.增加了对手动HIPS的检测结果的显示



这回应该就没什么问题了吧~了吧~



2009-3-22 夜

代码更新，将黑名单法改为白名单法

问题越来越简单化了~

之前的一些小聪明也越来越没用了 - -

代码也越来越和平化、弱智化了...........

...

...

哎~

既然问题都变得如此好解决了，那我就吧代码稍微整理一下贴出来好了。

切，真不爽！

-----------宅人的分割线------------

Lucky Star追完了，彻底被 柊つかさ 给治愈了~



再度展开追逐~

食灵-零