DWORD __stdcall sub_100212B(HDESK hDesktop, int a2, int a3){ unsigned int v3; // ebx@1 DWORD i; // edi@1 DWORD v5; // esi@2 int v6; // eax@3 v3 = 0; for ( i = 0; ; Sleep(i) ) { v5 = 0; v6 = a3 ? SwitchDesktopWithFade(hDesktop, a3) : SwitchDesktop(hDesktop); if ( v6 ) break; v5 = GetLastError(); if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 4 ) { if ( *((_BYTE *)off_103C144 + 25) >= 2u ) sub_1002A84(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 11, dword_1010308, v5, a3); } } if ( v3 >= 0xA ) { if ( !a2 ) return v5; } else { ++v3; i += 100; } } return v5;}
int __stdcall sub_102916D(int a1){ void *v1; // esi@1 int v3; // [sp+10h] [bp-B0h]@5 char Dst; // [sp+14h] [bp-ACh]@5 int v5; // [sp+18h] [bp-A8h]@18 int v6; // [sp+3Ch] [bp-84h]@18 __int16 v7; // [sp+40h] [bp-80h]@18 void *v8; // [sp+54h] [bp-6Ch]@21 HANDLE hObject; // [sp+58h] [bp-68h]@22 int v10; // [sp+64h] [bp-5Ch]@5 wchar_t *v11; // [sp+68h] [bp-58h]@18 int v12; // [sp+6Ch] [bp-54h]@9 wchar_t Dest; // [sp+70h] [bp-50h]@19 CPPEH_RECORD ms_exc; // [sp+A8h] [bp-18h]@5 v1 = off_103C144; if ( off_103C144 != &off_103C144 ) { if ( *((_DWORD *)off_103C144 + 7) & 0x100 ) { if ( *((_BYTE *)off_103C144 + 25) >= 4u ) { sub_1001838(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 160, dword_1001F40); v1 = off_103C144; } } } v3 = 0; memset(&Dst, 0, 0x40u); v10 = *(_DWORD *)(a1 + 4); ms_exc.disabled = 0; if ( v1 != &off_103C144 ) { if ( *((_BYTE *)v1 + 28) & 1 ) { if ( *((_BYTE *)v1 + 25) >= 5u ) sub_1001F55(*((_DWORD *)v1 + 4), *((_DWORD *)v1 + 5), 161, dword_1001F40, *(_DWORD *)(a1 + 24)); } } sub_1004BC9(L"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", L"DisableTaskMgr", 0, &v12); sub_1004BC9(L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", L"DisableTaskMgr", v12, &v12); if ( v12 ) { if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 1 ) { if ( *((_BYTE *)off_103C144 + 25) >= 4u ) sub_1001838(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 162, dword_1001F40); } } } else { if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 1 ) { if ( *((_BYTE *)off_103C144 + 25) >= 5u ) sub_1001838(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 163, dword_1001F40); } } v3 = 68; v6 = 1; v7 = 5; v5 = 0; v11 = 0; if ( *(_DWORD *)(a1 + 24) ) { if ( sub_1004D43(&Dest, 26, L"taskmgr.exe /%lu ", *(_DWORD *)(a1 + 24)) >= 0 ) v11 = &Dest; } if ( !sub_1008379(L"taskmgr.exe", v11, 0, &v3, &v8, 0) ) { CloseHandle(hObject); CloseHandle(v8); } } ms_exc.disabled = -2; sub_1029343(); return sub_1001D07(0, 0);}
winlogon!StateMachineRun+0x404winlogon!WinMain+0x13a3winlogon!I_WMsgkSendMessage+0x252kernel32!BaseThreadInitThunk+0xdntdll!RtlUserThreadStart+0x1d
USER32!SwitchDesktopwinlogon!ResilientSwitchDesktopWithFade+0x32winlogon!CSession::SwitchDesktop+0x2a2winlogon!WlAccessibilitySwitchDesktop+0x20winlogon!WLGeneric_InitiateLock_Execute+0xffwinlogon!StateMachineWorkerCallback+0x7fntdll!TppWorkpExecuteCallback+0xa4ntdll!TppWorkerThread+0x5ffkernel32!BaseThreadInitThunk+0xdntdll!RtlUserThreadStart+0x1d
USER32!SwitchDesktopwinlogon!ResilientSwitchDesktopWithFade+0x32winlogon!CSession::SwitchDesktop+0x2a2winlogon!WlAccessibilitySwitchDesktop+0x20winlogon!HandleSecurityOptions+0x51winlogon!WLGeneric_CAD_Execute+0x76winlogon!StateMachineWorkerCallback+0x7fntdll!TppWorkpExecuteCallback+0xa4ntdll!TppWorkerThread+0x5ffkernel32!BaseThreadInitThunk+0xdntdll!RtlUserThreadStart+0x1d
int __stdcall sub_1001C19(int a1, unsigned int a2, int a3, int a4, int a5, int a6){ void *v6; // eax@2 unsigned int v7; // eax@6 int v8; // ecx@6 int result; // eax@10 int v10; // esi@16 char v11; // al@22 signed int v12; // [sp+Ch] [bp-4h]@1 *(_DWORD *)a5 = -1; v12 = 0;//标记,设置为FALSE *(_DWORD *)a6 = 0; *(_DWORD *)(a6 + 4) = 0; *(_DWORD *)(a6 + 8) = 0; *(_DWORD *)(a6 + 12) = 0;LABEL_2: v6 = off_103C144;LABEL_3: if ( v6 != &off_103C144 ) { if ( *((_BYTE *)v6 + 28) & 2 ) { if ( *((_BYTE *)v6 + 25) >= 5u ) sub_1001838(*((_DWORD *)v6 + 4), *((_DWORD *)v6 + 5), 25, dword_1025A24); } } while ( 1 ) { RtlEnterCriticalSection(a1); v7 = 0; if ( a2 ) { v8 = a3; while ( 1 ) { *(_DWORD *)a5 = v7; if ( *(_DWORD *)(*(_DWORD *)(a1 + 32) + 4 * *(_DWORD *)v8) )\\这里有个ja跳转,nop掉,函数就不会出去 break; ++v7; v8 += 12; if ( v7 >= a2 ) goto LABEL_10; } v10 = *(_DWORD *)(a1 + 36) + 16 * *(_DWORD *)v8; v8 = 4 * *(_DWORD *)v8; *(_DWORD *)a6 = *(_DWORD *)v10; v10 += 4; *(_DWORD *)(a6 + 4) = *(_DWORD *)v10; v10 += 4; *(_DWORD *)(a6 + 8) = *(_DWORD *)v10; v12 = 1; //标记,设置TRUE *(_DWORD *)(a6 + 12) = *(_DWORD *)(v10 + 4); if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 2 ) { if ( *((_BYTE *)off_103C144 + 25) >= 5u ) sub_1001F55( *((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 26, dword_1025A24, *(_DWORD *)(*(_DWORD *)(a1 + 32) + v8)); } } }LABEL_10: result = RtlLeaveCriticalSection(v8, a1); if ( v12 )//这里判断标记,修改这里,把这里的跳转nop掉,函数照样也出不去 return result; if ( WaitForSingleObject(*(HANDLE *)(a1 + 24), 0xFFFFFFFFu) ) { v11 = GetLastError(); if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 2 ) { if ( *((_BYTE *)off_103C144 + 25) >= 2u ) sub_1001F55(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 27, dword_1025A24, v11); } } Sleep(0x3E8u); } v6 = off_103C144; if ( off_103C144 != &off_103C144 ) { if ( *((_BYTE *)off_103C144 + 28) & 2 && *((_BYTE *)off_103C144 + 25) >= 5u ) { sub_1001838(*((_DWORD *)off_103C144 + 4), *((_DWORD *)off_103C144 + 5), 28, dword_1025A24); goto LABEL_2; } goto LABEL_3; } }}
switch(快捷键ID){case Ctrl+Alt+Del://我们修改改ID,让程序无法执行该方法{ 打开桌面安全选项();}break;case Win+L://我们修改改ID,让程序无法执行该方法{ 锁定桌面();}break;case Ctrl+Shift+Esc://我们修改改ID,让程序无法执行该方法{ 打开任务管理器();}break;case Win+P://我们修改改ID,让程序无法执行该方法{ 切换窗口();}break;default://不做任何操作,让winlogon.exe最终走到这里{}
.text:00000001000170B0 cmp ebx, 4.text:00000001000170B3 jnz short loc_10001710B;不等于4跳转省略。。。.text:000000010001710B cmp ebx, 5.text:000000010001710E jnz short loc_10001713D;不等于5跳转省略。。。.text:000000010001713D cmp ebx, 6.text:0000000100017140 jnz short loc_10001717D;不等于6跳转省略。。。.text:000000010001717D cmp ebx, 7.text:0000000100017180 jnz short loc_1000171B0;不等于7跳转省略。。。.text:00000001000171B0 cmp ebx, 8.text:00000001000171B3 jnz short loc_1000171E3;不等于8跳转省略。。。text:00000001000171E3 cmp ebx, 9.text:00000001000171E6 jnz short loc_100017219;不等于9跳转省略。。。.text:0000000100017219 test ebx, ebx.text:000000010001721B jnz loc_1000173CA;不等于0跳转省略。。。
.text:0101621A cmp eax, 4.text:0101621D jz loc_101B779.text:01016223 cmp eax, 5.text:01016226 jz loc_101B7BA.text:0101622C cmp eax, 6.text:0101622F jz loc_101B7E6.text:01016235 cmp eax, 7.text:01016238 jz loc_101B810.text:0101623E cmp eax, 8.text:01016241 jz loc_101B83A.text:01016247 cmp eax, 9.text:0101624A jz loc_101B864.text:01016250 test eax, eax.text:01016252 jnz short loc_1016296
联系客服