feat image load

This commit is contained in:
2026-06-01 09:20:02 +08:00
parent 4bf9a42170
commit 93417ef728
6 changed files with 64 additions and 4 deletions
+10 -4
View File
@@ -7,7 +7,7 @@
namespace thread_notify_routine
{
//保护的进程ID
auto protect_id = ULongToHandle(3460);
auto protect_id = ULongToHandle(8976);
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
@@ -28,12 +28,18 @@ namespace thread_notify_routine
goto end;
auto cutor_process_id = PsGetCurrentProcessId();
if (HandleToLong(cutor_process_id) == 4)
goto end;
if (ProcessId != cutor_process_id)
{
DbgPrintEx(77, 0, "[!] 恶意远程线程检测!\n");
DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
}