美文网首页
利用 Blackbone 做进程保护

利用 Blackbone 做进程保护

作者: wyrover | 来源:发表于2017-01-13 18:31 被阅读1453次

    BlackboneWindows memory hacking library
    [

    ](https://github.com/DarthTon/Blackbone#features)Features
    x86 and x64 support

    Process interaction
    Manage PEB32/PEB64
    Manage process through WOW64 barrier

    Process Memory
    Allocate and free virtual memory
    Change memory protection
    Read/Write virtual memory

    Process modules
    Enumerate all (32/64 bit) modules loaded. Enumerate modules using Loader list/Section objects/PE headers methods.
    Get exported function address
    Get the main module
    Unlink module from loader lists
    Inject and eject modules (including pure IL images)
    Inject 64bit modules into WOW64 processes
    Manually map native PE images

    Threads
    Enumerate threads
    Create and terminate threads. Support for cross-session thread creation.
    Get thread exit code
    Get main thread
    Manage TEB32/TEB64
    Join threads
    Suspend and resume threads
    Set/Remove hardware breakpoints

    Pattern search
    Search for arbitrary pattern in local or remote process

    Remote code execution
    Execute functions in remote process
    Assemble own code and execute it remotely
    Support for cdecl/stdcall/thiscall/fastcall conventions
    Support for arguments passed by value, pointer or reference, including structures
    FPU types are supported
    Execute code in new thread or any existing one

    Remote hooking
    Hook functions in remote process using int3 or hardware breakpoints
    Hook functions upon return

    Manual map features
    x86 and x64 image support
    Mapping into any arbitrary unprotected process
    Section mapping with proper memory protection flags
    Image relocations (only 2 types supported. I haven't seen a single PE image with some other relocation types)
    Imports and Delayed imports are resolved
    Bound import is resolved as a side effect, I think
    Module exports
    Loading of forwarded export images
    Api schema name redirection
    SxS redirection and isolation
    Activation context support
    Dll path resolving similar to native load order
    TLS callbacks. Only for one thread and only with PROCESS_ATTACH/PROCESS_DETACH reasons.
    Static TLS
    Exception handling support (SEH and C++)
    Adding module to some native loader structures(for basic module api support: GetModuleHandle, GetProcAdress, etc.)
    Security cookie initialization
    C++/CLI images are supported
    Image unloading
    Increase reference counter for import libraries in case of manual import mapping
    Cyclic dependencies are handled properly

    Driver features

    Allocate/free/protect user memory
    Read/write user and kernel memory
    Disable permanent DEP for WOW64 processes
    Change process protection flag
    Change handle access rights
    Remap process memory
    Hiding allocated user-mode memory
    User-mode dll injection and manual mapping
    Manual mapping of drivers

    [

    ](https://github.com/DarthTon/Blackbone#license)License
    Blackbone is licensed under the MIT License. Dependencies are under their respective licenses.

    相关文章

      网友评论

          本文标题:利用 Blackbone 做进程保护

          本文链接:https://www.haomeiwen.com/subject/aqvsbttx.html