feat image load
This commit is contained in:
@@ -7,7 +7,7 @@
|
||||
namespace thread_notify_routine
|
||||
{
|
||||
//保护的进程ID
|
||||
auto protect_id = ULongToHandle(3460);
|
||||
auto protect_id = ULongToHandle(8976);
|
||||
|
||||
|
||||
void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
|
||||
@@ -28,12 +28,18 @@ namespace thread_notify_routine
|
||||
goto end;
|
||||
|
||||
auto cutor_process_id = PsGetCurrentProcessId();
|
||||
if (HandleToLong(cutor_process_id) == 4)
|
||||
goto end;
|
||||
|
||||
if (ProcessId != cutor_process_id)
|
||||
{
|
||||
DbgPrintEx(77, 0, "[!] 恶意远程线程检测!\n");
|
||||
DbgPrintEx(77, 0, "[!] 目标进程: %d\n", ProcessId);
|
||||
DbgPrintEx(77, 0, "[!] 被创建线程: %d\n", ThreadId);
|
||||
DbgPrintEx(77, 0, "[!] 创建者进程: %d\n", cutor_process_id);
|
||||
|
||||
DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);
|
||||
|
||||
DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);
|
||||
|
||||
DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
|
||||
}
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user