1.物理Section Map到用户空间 解析物理地址操作内存
2.修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下RetainAccess为0x1fffff
无视抹权限 原理见ObpPreInterceptHandleCreate

ObpPreInterceptHandleCreate(PVOID Object, unsigned __int8 bIsKernelHandle, PACCESS_MASK AccessMask, PVOID bNeedCallPost?)

ObpCallPreOperationCallbacks(POBJECT_TYPE pObjectType, POB_PRE_OPERATION_INFORMATION OperationInformation, PVOID bNeedCallPost?)
效果:任意权限打开进程都是满权限
3.修改调用线程的Ethread下的PreviousMode为kernelMode 此时需注意调用创建线程会造成和创建进程会蓝屏 需要全部初始化之后在修改 另外参数需要自己检验.
修改完之后已任意权限打开进程 无视进程权限进程内存操作 包括EnumProcessModulesEx and GetModuleFileNameExA
4.注册两个obregistercallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去
5.遍历EPROCESS->HandleTable 修改GransAccess为0x1fffff
6.PsProcessType PsThreadType >> SupportsObjectCallbacks 置0 (win10 pg)
7.PsProcessType PsThreadType >> CallbackList Fink和bink改完同一个数(win10 pg maybe)
8.遍历CallbacksList替换或修改Pre Post函数
9.注入cssrss.exe lsass.exe等进程 用现有有效句柄操作内存
10.注入cssrss.exe lsass.exe 或xx进程创建进程继承句柄(创建进程的dup是ExDupHandle不走Obregistercallbacks流程) （d1fK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6e0j5$3S2F1L8$3y4C8k6i4u0Q4x3V1k6t1e0r3g2S2K9$3g2J5i4@1g2r3i4@1u0o6i4K6R3&6
11.dup句柄(有些可以 有些不可能) （2c9K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6e0j5$3S2F1L8$3y4C8k6i4u0Q4x3V1k6t1e0r3g2S2K9$3g2J5i4@1g2r3i4@1u0o6i4K6R3&6
12.hook ObReferenceObjectByHandle 或ObReferenceObjectByHandleWithTag(pg)
13.遍历CallbacksList UnRegistercallbacks
14.修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下GenericMapping->GenericExecute 为0x1fffff然后Open时第一个参数填入GENERIC_EXECUTE
(0x121001 (Query limited information, Terminate, Synchronize, Read control)) （无用 只做学习使用）
15.注册表无视句柄权限注入调试dll （1dcK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6o6P5h3u0W2L8r3I4#2L8g2)9J5c8V1c8G2N6h3u0D9k6f1q4Y4k6h3&6@1i4@1g2r3i4@1u0o6i4K6R3&6

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课