过QQ游戏大厅的SX保护

早些时间看郁金香的教程，写过qq游戏练练看的挂，那时候CE附加QQ游戏大厅的时候貌似是没有任何保护的，昨天舍友让做个斗地主的记牌器，但是，我用CE附加的时候，被检测到了，其实不附加也会被检测，所以猜测可能只是检测窗口进程或是模块名称啥的吧，被检测到的时候主程序会退出，但是那个对话框还在，就是那个SX什么什么的，所以如果是QQgame启动了某个线程来检测非法的话，在主程序退出其他线程对象都释放掉的时候，那个检测的线程对象还是存在的（提示SX非法的对话框别关掉！）。借助pt很容易就找到了这个线程。

未开CE前线程状态：



开了CE被检测到后的线程状态：



然后该怎么办就不用说了吧，干掉这个线程就OK了。

若是嫌麻烦每次都要开pt找线程的话，可以写个结束这个模块内线程的程序

[cpp] view
plaincopy

#include "stdafx.h"

#include "windows.h"

#include "TlHelp32.h"

const TCHAR QQ_GAME[] = _T("QQGame.exe");

const TCHAR QQ_THREAD_DLL[] = _T("TenSLX.dll");

typedef enum _THREADINFOCLASS {

ThreadBasicInformation,

ThreadTimes,

ThreadPriority,

ThreadBasePriority,

ThreadAffinityMask,

ThreadImpersonationToken,

ThreadDescriptorTableEntry,

ThreadEnableAlignmentFaultFixup,

ThreadEventPair_Reusable,

ThreadQuerySetWin32StartAddress,

ThreadZeroTlsCell,

ThreadPerformanceCount,

ThreadAmILastThread,

ThreadIdealProcessor,

ThreadPriorityBoost,

ThreadSetTlsArrayAddress,

ThreadIsIoPending,

ThreadHideFromDebugger,

ThreadBreakOnTermination,

MaxThreadInfoClass

} THREADINFOCLASS;

typedef LONG (__stdcall *_pfnZwQueryInformationThread) (

IN HANDLE ThreadHandle,

IN THREADINFOCLASS ThreadInformationClass,

OUT PVOID ThreadInformation,

IN ULONG ThreadInformationLength,

OUT PULONG ReturnLength OPTIONAL

);

HANDLE m_GameProcessHandle;

//记录QQ_THREAD_DLL信息

BYTE * m_pmodBaseAddr;

DWORD m_dwmodBaseSize;

_pfnZwQueryInformationThread m_pfnZwQueryInformationThread;

BOOL StartPatch();//PATCHQQ主函数

DWORD EnablePrivilege (LPCTSTR name);//提权函数

BOOL ListProcessModules(DWORD dwPID);//枚举指定进程的模块

BOOL ListProcessThreads( DWORD dwOwnerPID);//枚举指定进程创建的线程，并结束掉QQ保护线程

PVOID ShowThreadInfo(DWORD tid);//获取线程的起始地址

int _tmain(int argc, _TCHAR* argv[])

{

m_pfnZwQueryInformationThread =(_pfnZwQueryInformationThread)\

GetProcAddress (LoadLibrary(_T("ntdll.dll")),"ZwQueryInformationThread");

if (StartPatch())

{

printf("可以CE附加QQ游戏大厅了\n");

}

else

printf("失败！\n");

return 0;

}

BOOL StartPatch()

{

if(0!=EnablePrivilege (SE_DEBUG_NAME))

{

return FALSE;

}

HANDLE hProcessSnap;

PROCESSENTRY32 pe32;

hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );

if( hProcessSnap == INVALID_HANDLE_VALUE )

{

return FALSE;

}

pe32.dwSize = sizeof( PROCESSENTRY32 );

if( !Process32First( hProcessSnap, &pe32 ) )

{

CloseHandle( hProcessSnap );

return FALSE;

}

BOOL bStartGame = FALSE;

do

{

if (_tcscmp(pe32.szExeFile, QQ_GAME) == 0)

{

bStartGame = TRUE;

m_GameProcessHandle = OpenProcess(PROCESS_VM_WRITE|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION,\

FALSE, pe32.th32ProcessID);

if (m_GameProcessHandle == NULL)

{

return FALSE;

}

for (int i=0; i<5;i++)

{

if (!ListProcessModules(pe32.th32ProcessID))

{

return FALSE;

}

}

if (!ListProcessThreads(pe32.th32ProcessID))

{

return FALSE;

}

}

} while( Process32Next( hProcessSnap, &pe32 ) );

if (!bStartGame)

{

MessageBox(NULL,_T("运行QQ大厅后才能使用"),_T("提示"),MB_OK);

return FALSE;

}

CloseHandle( hProcessSnap );

return TRUE;

}

DWORD EnablePrivilege (LPCTSTR name)

{

HANDLE hToken;

BOOL rv;

//设置结构

TOKEN_PRIVILEGES priv = { 1, {0, 0, SE_PRIVILEGE_ENABLED} };

// 查找权限值

LookupPrivilegeValue (

0,

name,

&priv.Privileges[0].Luid

);

// 打开本进程Token

OpenProcessToken(

GetCurrentProcess (),

TOKEN_ADJUST_PRIVILEGES,

&hToken

);

// 提权

AdjustTokenPrivileges (

hToken,

FALSE,

&priv,

sizeof priv,

0,

0

);

// 返回值，错误信息，如果操作成功，则应为ERROR_SUCCESS，为O

rv = GetLastError();

// 关闭Token

CloseHandle (hToken);

return rv;

}

BOOL ListProcessModules(DWORD dwPID)

{

HANDLE hModuleSnap = INVALID_HANDLE_VALUE;

MODULEENTRY32 me32;

hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID );

if( hModuleSnap == INVALID_HANDLE_VALUE )

{

return( FALSE );

}

me32.dwSize = sizeof( MODULEENTRY32 );

if( !Module32First( hModuleSnap, &me32 ) )

{

CloseHandle( hModuleSnap );

return( FALSE );

}

do

{

if (_tcscmp(me32.szModule, QQ_THREAD_DLL) == 0)

{

m_pmodBaseAddr = me32.modBaseAddr;

m_dwmodBaseSize = me32.modBaseSize;

}

}while( Module32Next( hModuleSnap, &me32 ));

CloseHandle( hModuleSnap );

return( TRUE );

}

BOOL ListProcessThreads( DWORD dwOwnerPID)

{

HANDLE hThreadSnap = INVALID_HANDLE_VALUE;

THREADENTRY32 te32;

PVOID addr;

hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );

if( hThreadSnap == INVALID_HANDLE_VALUE )

return( FALSE );

te32.dwSize = sizeof(THREADENTRY32 );

if( !Thread32First( hThreadSnap, &te32 ) )

{

CloseHandle( hThreadSnap );

return( FALSE );

}

do

{

if( te32.th32OwnerProcessID == dwOwnerPID )

{

addr = ShowThreadInfo(te32.th32ThreadID);

if(((DWORD)addr>(DWORD)m_pmodBaseAddr)&&((DWORD)addr<\

((DWORD)m_pmodBaseAddr+(DWORD)m_dwmodBaseSize)))

{

HANDLE oth=OpenThread(THREAD_ALL_ACCESS,FALSE,te32.th32ThreadID);

//关闭这个线程

TerminateThread(oth, 0);

}

}

} while( Thread32Next(hThreadSnap, &te32 ) );

CloseHandle( hThreadSnap );

return( TRUE );

}

PVOID ShowThreadInfo(DWORD tid)

{

PVOID startaddr;

HANDLE thread;

//thread = m_pfnOpenThread_ex(THREAD_ALL_ACCESS,FALSE,tid);

thread=OpenThread(THREAD_ALL_ACCESS,FALSE,tid);

if (thread == NULL)

return FALSE;

m_pfnZwQueryInformationThread(thread,

ThreadQuerySetWin32StartAddress,

&startaddr,

sizeof(startaddr),

NULL);

CloseHandle (thread);

return startaddr;

}