当前位置:网站首页>记录一下逆向任务管理器的过程
记录一下逆向任务管理器的过程
2022-07-06 03:12:00 【宇龍_】
关键字:
任务管理器,逆向,WdcSafeOpenProcess,ResolveImagePath_Desktop,OpenProcess
前言
记录一下本次逆向任务管理器的过程,整个过程相对愉悦轻松。
这里不详细分析任务管理器的各个功能实现,在本次逆向中,只关注一个功能点——任务管理器是如何获取进程id为4的system的相关信息的?因为做过Windows进程相关编程的都清楚,微软提供的API函数除了获取System的进程名及pid外,其他信息(如路径、命令行等)是获取不到的。
正文
我们看一下任务管理器的展示情况:
这个进程的描述信息是哪儿来的? 我们甚至能右键打开文件所在位置...
首先,打开IDA,先来一波静态分析:
从导入表看起,看看任务管理器是如何获取进程句柄的(猜想难道在这里有特殊处理?)
我们看到导入表中有OpenProcess函数,看一下在任务管理器里是如何调用的,查看该函数的交叉引用
边栏推荐
- ERA5再分析资料下载攻略
- . Net 6 and Net core learning notes: Important issues of net core
- 【Kubernetes 系列】一文学会Kubernetes Service安全的暴露应用
- Game theory matlab
- 华为、H3C、思科命令对比,思维导图形式从基础、交换、路由三大方向介绍【转自微信公众号网络技术联盟站】
- NR modulation 1
- Tidb ecological tools (backup, migration, import / export) collation
- Deep parsing pointer and array written test questions
- mysqldump数据备份
- BUUCTF刷题笔记——[极客大挑战 2019]EasySQL 1
猜你喜欢
My C language learning records (blue bridge) -- files and file input and output
The real machine cannot access the shooting range of the virtual machine, and the real machine cannot Ping the virtual machine
How to do function test well
Is there a completely independent localization database technology
Apt installation ZABBIX
NR modulation 1
mysqldump数据备份
Reverse repackaging of wechat applet
Microsoft Research, UIUC & Google research | antagonistic training actor critic based on offline training reinforcement learning
蓝色样式商城网站页脚代码
随机推荐
[padding] an error is reported in the prediction after loading the model weight attributeerror: 'model' object has no attribute '_ place‘
mysqldump数据备份
[Chongqing Guangdong education] higher mathematics I reference materials of Southwest Petroleum University
Add one to non negative integers in the array
Recommended foreign websites for programmers to learn
继承day01
微服务间通信
1. Dynamic parameters of function: *args, **kwargs
What is the investment value of iFLYTEK, which does not make money?
Buuctf question brushing notes - [geek challenge 2019] easysql 1
Web security SQL injection vulnerability (1)
Advanced learning of MySQL -- Fundamentals -- isolation level of transactions
Is there a completely independent localization database technology
jsscript
JS regular filtering and adding image prefixes in rich text
February 14, 2022 Daily: Google long article summarizes the experience of building four generations of TPU
Polymorphic day02
[concept] Web basic concept cognition
How does yyds dry inventory deal with repeated messages in the consumption process?
codeforces每日5題(均1700)-第六天