.586
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\user32.lib
include \masm32\macros\macros.asm
include \masm32\macros\ucmacros.asm
ProtoDef typedef proto :dword,:dword,:dword
lpProc typedef ptr ProtoDef
.data
WSTR szFile,"C:\Windows\Explorer.exe"
.data?
SfcFileException lpProc ?
.code
Main proc
invoke LoadLibrary,SADD('SFC_OS.DLL')
invoke GetProcAddress,eax,5
mov SfcFileException,eax
invoke SfcFileException,0,offset szFile,-1
.if eax
invoke MessageBox,NULL,SADD('Err'),SADD('Err'),MB_OK
.else
invoke MessageBox,NULL,SADD('OK'),SADD('OK'),MB_OK
.endif
ret
Main endp
end Main
代码很简单,就不多说。
参考文献:
《Hacking Windows File Protection》——ddeK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0A6N6s2y4#2L8g2)9J5k6h3y4G2L8g2)9J5c8X3q4T1L8%4g2@1N6$3k6H3i4K6u0W2j5i4y4H3
里面有些不错的东西,建议看一下,英文的。
XP SP2测试通过,2K我没测试,你可以在《Hacking Windows File Protection》——cc1K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0A6N6s2y4#2L8g2)9J5k6h3y4G2L8g2)9J5c8X3q4T1L8%4g2@1N6$3k6H3i4K6u0W2j5i4y4H3
找找资料~~