-
-
[求助]使用VirtualAllocEx等API导致金山毒霸显示系统防御对话框的问题
-
发表于:
2012-4-30 03:05
4604
-
[求助]使用VirtualAllocEx等API导致金山毒霸显示系统防御对话框的问题
// 枚举获取托盘图标区域位置
BOOL CTrayIcon::EnumNotifyWindow(HWND hWnd, RECT &rect)
{
BOOL bSuc = FALSE;
DWORD dwProcessId = 0, dwThreadId = 0, dwDesiredAccess;
HANDLE hProcess;
LPVOID lpBuffer;
int nButtons;
HWND hOwnerWnd = NULL;
if (NULL == hWnd)
return FALSE;
dwThreadId = ::GetWindowThreadProcessId(hWnd, &dwProcessId);
if (0 == dwProcessId || 0 == dwThreadId)
return FALSE;
dwDesiredAccess = PROCESS_ALL_ACCESS|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE;
hProcess = ::OpenProcess(dwDesiredAccess, 0, dwProcessId);
if (NULL == hProcess)
return FALSE;
lpBuffer = ::VirtualAllocEx(hProcess, 0, 1024, MEM_COMMIT, PAGE_READWRITE);
if (lpBuffer != NULL)
{
nButtons = ::SendMessage(hWnd, TB_BUTTONCOUNT, 0, 0); // 获取托盘图标数量
for (int i = 0; i < nButtons; i++)
{
RECT rc = {0};
TBBUTTON stButton = {0};
TRAYDATA stTrayData = {0};
::SendMessage(hWnd, TB_GETBUTTON, i, (LPARAM)lpBuffer); // 获取第i个托盘图标信息
BOOL bRet = ::ReadProcessMemory(hProcess, lpBuffer, &stButton, sizeof(TBBUTTON), 0);
bRet = ::ReadProcessMemory(hProcess, (LPVOID)stButton.dwData, &stTrayData, sizeof(TRAYDATA), 0);
if (bRet != 0 && stTrayData.hwnd == m_stNotifyIconData.hWnd)
{
::SendMessage(hWnd, TB_GETITEMRECT, (WPARAM)i, (LPARAM)lpBuffer); // 获取第i个托盘图标区域
bRet = ::ReadProcessMemory(hProcess, lpBuffer, &rc, sizeof(rc),0); // 读取托盘图标区域
if (bRet != 0)
{
::ClientToScreen(hWnd, (LPPOINT)&rc);
::ClientToScreen(hWnd, ((LPPOINT)&rc)+1);
rect = rc;
}
bSuc = TRUE;
break;
}
}
}
if (lpBuffer != NULL)
::VirtualFreeEx(hProcess, lpBuffer, 0, MEM_RELEASE);
::CloseHandle(hProcess);
return bSuc;
}
代码如上，功能只是想获取一下托盘图标区域位置。
在鼠标移到托盘图标上时弹出一个窗口，启动一个计时器，获取鼠标当前位置，获取托盘图标区域位置，检测鼠标是否已离开托盘图标区域位置，是则关闭窗口。具体类似QQ来消息时鼠标移到QQ图标上面显示的消息盒子窗口。
如何修改代码避免金山毒霸的主动防御提示？
699K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0T1M7#2)9J5k6h3y4G2k6r3g2Q4x3X3g2A6K9X3W2F1M7$3S2S2L8W2)9J5k6h3y4G2L8g2)9J5c8X3q4@1N6r3q4U0K9r3#2W2L8Y4c8K6i4K6u0r3L8h3!0F1N6r3S2Q4y4h3j5I4x3U0l9@1i4K6u0r3x3e0t1H3y4o6x3H3x3o6t1#2z5r3j5^5x3$3x3H3k6U0m8T1x3$3x3I4x3h3x3#2j5e0m8Q4x3X3g2B7M7r3M7`.
4f8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0T1M7#2)9J5k6h3y4G2k6r3g2Q4x3X3g2A6K9X3W2F1M7$3S2S2L8W2)9J5k6h3y4G2L8g2)9J5c8X3q4@1N6r3q4U0K9r3#2W2L8Y4c8K6i4K6u0r3L8h3!0F1N6r3S2Q4y4h3j5I4x3U0l9@1i4K6u0r3x3e0t1H3y4o6x3H3x3o6x3H3x3o6g2T1k6e0f1J5x3U0S2X3x3r3f1&6z5r3f1&6k6r3u0Q4x3X3g2B7M7r3M7`.
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
