如有错误，还请指出。
1.物理Section Map到用户空间 解析物理地址操作内存(e44K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K9K9s2g2t1N6h3W2n7k6h3W2e0K9r3q4p5K9h3q4G2i4K6u0r3g2i4y4W2M7V1#2W2L8h3!0J5P5f1!0H3k6i4u0S2N6r3W2G2L8U0j5@1i4K6t1&6
2.修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下RetainAccess为0x1fffff
无视抹权限 原理见ObpPreInterceptHandleCreate
ObpPreInterceptHandleCreate(PVOID Object, unsigned __int8 bIsKernelHandle, PACCESS_MASK AccessMask, PVOID bNeedCallPost?)
ObpCallPreOperationCallbacks(POBJECT_TYPE pObjectType, POB_PRE_OPERATION_INFORMATION OperationInformation, PVOID bNeedCallPost?)
效果:任意权限打开进程都是满权限
3.修改调用线程的Ethread下的PreviousMode为kernelMode 此时需注意调用创建线程会造成和创建进程会蓝屏 需要全部初始化之后在修改 另外参数需要自己检验.
修改完之后已任意权限打开进程 无视进程权限进程内存操作 包括EnumProcessModulesEx and GetModuleFileNameExA(副作用太大了)
4.注册两个obregistercallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去(003K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K9K9s2g2t1N6h3W2n7k6h3W2e0K9r3q4p5K9h3q4G2i4K6u0r3e0$3u0d9k6h3N6A6M7%4c8W2M7V1y4S2L8r3I4n7j5h3y4C8M7@1u0&6f1r3q4K6M7#2)9J5z5b7`.`.
5.遍历EPROCESS->HandleTable 修改GransAccess为0x1fffff
6.PsProcessType PsThreadType >> SupportsObjectCallbacks 置0 (win10 pg)
7.PsProcessType PsThreadType >> CallbackList Fink和bink改完同一个数(win10 pg maybe)
8.遍历CallbacksList替换或修改Pre Post函数
9.注入cssrss.exe lsass.exe等进程 用现有有效句柄操作内存
10.注入cssrss.exe lsass.exe 或xx进程创建进程继承句柄(创建进程的dup是ExDupHandle不走Obregistercallbacks流程) （946K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6e0j5$3S2F1L8$3y4C8k6i4u0Q4x3V1k6t1e0r3g2S2K9$3g2J5i4@1g2r3i4@1u0o6i4K6R3&6
11.dup句柄(有些可以 有些不可能) （155K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6e0j5$3S2F1L8$3y4C8k6i4u0Q4x3V1k6t1e0r3g2S2K9$3g2J5i4@1g2r3i4@1u0o6i4K6R3&6
12.hook ObReferenceObjectByHandle 或ObReferenceObjectByHandleWithTag(pg)
13.遍历CallbacksList UnRegistercallbacks
14.修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下GenericMapping->GenericExecute 为0x1fffff然后Open时第一个参数填入GENERIC_EXECUTE
(0x121001 (Query limited information, Terminate, Synchronize, Read control)) （无用 只做学习使用）
15.注册表无视句柄权限注入调试dll （1b3K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6o6P5h3u0W2L8r3I4#2L8g2)9J5c8V1c8G2N6h3u0D9k6f1q4Y4k6h3&6@1i4@1g2r3i4@1u0o6i4K6R3&6
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
