楼主: xiaozhu009
收起左侧

[病毒样本] 银狐1x

[复制链接]
啊松
发表于 2026-3-3 10:39:15 | 显示全部楼层
wowocock 发表于 2026-3-3 10:27
if ( (unsigned int)sub_140002990(argc, argv, envp) )

__int64 sub_140002990()

这是360的什么软件的?一个安全厂商居然能被木马利用有够丢人的
wowocock
发表于 2026-3-3 10:40:57 | 显示全部楼层
啊松 发表于 2026-3-3 10:39
这是360的什么软件的?一个安全厂商居然能被木马利用有够丢人的

C:\vmagent_new\bin\joblist\889936\out\Release\AISafeSDKTest_vc201764.pdb
wwwab
发表于 2026-3-3 12:25:24 | 显示全部楼层
wowocock 发表于 2026-3-3 10:27
if ( (unsigned int)sub_140002990(argc, argv, envp) )

__int64 sub_140002990()

那火绒的dll是怎么加载的
yg03qwq
发表于 2026-3-3 13:24:51 | 显示全部楼层
PYAS Kill Dll


本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
wowocock
发表于 2026-3-3 14:16:00 | 显示全部楼层
wwwab 发表于 2026-3-3 12:25
那火绒的dll是怎么加载的

DLL都改为延迟加载或动态加载,DLL加载之前都会验证下火绒签名,不符合则禁止加载,或直接退出进程。
superLYT
发表于 2026-3-3 14:47:55 | 显示全部楼层
BDTS右键kill

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
wowocock
发表于 2026-3-3 15:52:20 | 显示全部楼层
木马会利用组策略禁止一堆安全软件,同时写入计划任务启动回写。需要清除注册表和木马计划任务文件。
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{01d2e4f7-f182-4e34-ba78-d54dcdc18107}]
"Description"=""
"ItemData"="C:\\Program Files\\ESET"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{05ba51c5-eb80-4c10-a6c4-20e0f0500cd8}]
"Description"=""
"ItemData"="C:\\ProgramData\\Tencent\\Yuanbao"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{0627e59d-22a8-4a24-8949-a4acf3fa4bc1}]
"Description"=""
"ItemData"="C:\\Program Files\\Windows Defender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{08532edc-b3ce-4a3f-ba5c-299ced063f49}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Mcafee"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{0baf0d3b-5789-4fc6-8e56-1f7012909ef5}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\360\\360sd"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{0d307d67-0a02-4683-9bba-019b1cb3b9cd}]
"Description"=""
"ItemData"="C:\\Program Files\\Symantec"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{16a09230-3c62-4eb7-8a04-397c52471420}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\ESET"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{1f20bb85-63b1-4816-a9e2-ebc252f814ab}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360huabao"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{215a934a-5625-4a8c-ad03-4fde51b69a82}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Avast Software"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{2f97115e-29c0-4f9a-b3eb-da0372ed51ba}]
"Description"=""
"ItemData"="C:\\Program Files\\Avast Software\\Avast Software"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{32fc2c38-0460-4f14-b3c2-2610168af6fe}]
"Description"=""
"ItemData"="C:\\ProgramData\\Tencent\\QQPCMgr"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{36fd7d06-5da0-4c63-b4dd-12ff1a5d0994}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Symantec"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{3ceba8c4-16a2-4cc7-bb35-1270f6df4c50}]
"Description"=""
"ItemData"="C:\\Program Files\\Kingsoft"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{41a2b9a5-801a-4671-bf8c-b1fb6259dab3}]
"Description"=""
"ItemData"="C:\\Program Files\\Tencent\\Yuanbao"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{43e175fc-fa6d-409f-accd-6181e5e17b11}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Windows Defender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{4e587f4d-e896-47e0-a9bf-9f5dabd819d9}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Kingsoft"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{65dd609b-86bc-4718-a3f9-b923c42f1211}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Kaspersky Lab"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{6a0a2fd4-747e-437c-94ae-5f659db59246}]
"Description"=""
"ItemData"="C:\\Program Files\\AVG"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{6fec81fb-7251-4e2a-89ed-125dd35a3ffd}]
"Description"=""
"ItemData"="C:\\ProgramData\\Bitdefender Agent"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{70792552-3519-49bc-aabd-28b2e33c72bc}]
"Description"=""
"ItemData"="C:\\Program Files\\Mcafee"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{72edded5-a0bc-45a2-a986-300d444d9083}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\AVG"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{74e42d5f-54b7-4e4d-8793-2446313c0752}]
"Description"=""
"ItemData"="C:\\Program Files\\Bitdefender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{77ff0f96-8911-490e-8a69-f50d9dfcee0a}]
"Description"=""
"ItemData"="C:\\Program Files\\Avast Software"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{7916f23a-70df-4288-baa7-ac3e041c0830}]
"Description"=""
"ItemData"="C:\\Program Files\\Kaspersky Lab"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{79ce2e69-3c22-4d09-a2c0-9bafbce8710e}]
"Description"=""
"ItemData"="C:\\Program Files\\Tencent\\QQPCMgr"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{82e81c15-a2b2-47da-98bd-848c9bd8f660}]
"Description"=""
"ItemData"="C:\\Program Files\\360\\360Safe"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{8ac73a53-9de6-4bc2-96a0-b6daafa6911d}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360Login"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{8be9c97d-269f-459e-bf1e-dabf5ed640c6}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Common Files\\Bitdefender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{8cc95fb9-da2e-413f-a239-dfddb0ba5650}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Tencent\\Yuanbao"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{8ed0cb1e-0eb3-4380-8ba0-d592287b51b2}]
"Description"=""
"ItemData"="C:\\Program Files\\Norton"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{9882c312-10b5-4d9b-b995-d1d5f45bbf08}]
"Description"=""
"ItemData"="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{9a030980-ec1f-4e69-a22c-533b085cd355}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\2345Soft"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{9d37c916-5fc9-4f35-a06b-4169fad4b298}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Bitdefender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{9e3f17d5-423c-4969-94fc-6db007e7a2a2}]
"Description"=""
"ItemData"="C:\\Program Files\\Huorong"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{aa5518f9-005b-4404-ac98-c759b8e6830d}]
"Description"=""
"ItemData"="C:\\Program Files\\360\\360sd"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{acd879ca-e7e3-47f9-9445-119d248d221b}]
"Description"=""
"ItemData"="C:\\ProgramData\\Bitdefender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{b1934063-d968-4f66-bd80-1f0aa33bd87f}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360DesktopLite"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{c1977f4d-bb5f-42e3-98cf-30bf8029177c}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Huorong"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{c50aacd2-1539-4205-bb36-32020f2a2bf1}]
"Description"=""
"ItemData"="C:\\Program Files\\Common Files\\Bitdefender"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{ce390006-2a13-4b66-b342-f4d4fe00da96}]
"Description"=""
"ItemData"="C:\\Program Files\\2345Soft"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{ceeaf4bb-0f04-4557-8d11-153a0a0034fa}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360mobilemgr"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{cf225d56-4433-451b-b15a-755256fded22}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360Safe"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{d46bb673-5384-4b6f-9e7a-5711baf52e95}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Norton"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{d6786ddd-9a2c-4bd6-91d0-fd1429820c53}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\360\\360Safe"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{da9e09e1-c81e-47b9-b1d5-2c6cd44f4a88}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Trend Micro"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{ebd993a0-9e9b-40a6-b77d-a69818bb5cb3}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Tencent\\QQPCMgr"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{f2152564-1302-4d4a-bbe2-61a48febfeaf}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360Game5"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{f37e25e0-fd35-43bd-b7c4-59d2020fa0a1}]
"Description"=""
"ItemData"="C:\\Program Files (x86)\\Avast Software\\Avast Software"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{f874f1a8-a347-40c8-9cce-c3f66fd86d3e}]
"Description"=""
"ItemData"="C:\\Program Files\\Trend Micro"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{fe270cc8-0644-468b-b798-8d5809d3ab2f}]
"Description"=""
"ItemData"="C:\\ProgramData\\Kingsoft"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{ff52411a-fb92-43bd-bdab-1daef5a866c4}]
"Description"=""
"ItemData"="C:\\Users\\yhg\\AppData\\Roaming\\360Quarant"
"LastModified"=hex(b):1d,41,a6,69,00,00,00,00
"SaferFlags"=dword:00000000

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
WGC_ZY
发表于 2026-3-3 15:57:50 | 显示全部楼层
wowocock 发表于 2026-3-3 15:52
木马会利用组策略禁止一堆安全软件,同时写入计划任务启动回写。需要清除注册表和木马计划任务文件。
Wind ...

这把主流厂商全都给到了
wwwab
发表于 2026-3-3 23:02:14 | 显示全部楼层
本帖最后由 wwwab 于 2026-3-3 23:05 编辑
wowocock 发表于 2026-3-3 14:16
DLL都改为延迟加载或动态加载,DLL加载之前都会验证下火绒签名,不符合则禁止加载,或直接退出进程。

真的吗?





2024-11~2025.02

int WinMain(){
LoadLibraryW = LoadLibraryW(L"CrashHandler.dll");
SetCrashHandle = GetProcAddress(LoadLibraryW, "CrashHandler");
}






我反馈加载方式不安全之后
2025-02~至今

int WinMain(){
  v4 = (HMODULE)sub_14000BBD0(hInstance, hPrevInstance, lpCmdLine, nShowCmd);
  SetCrashHandle = GetProcAddress(v4, "SetCrashHandle");
}

HMODULE sub_14000BBD0()
{
  wchar_t *v0; // rax
  WCHAR Filename[264]; // [rsp+20h] [rbp-228h] BYREF

  memset(Filename, 0, 0x208ui64);
  if ( GetModuleFileNameW(0i64, Filename, 0x104u) - 1 > 0x102 )
    return 0i64;
  v0 = wcsrchr(Filename, 0x5Cu);
  if ( !v0 )
    return 0i64;
  v0[1] = 0;
  wcscat_s(Filename, 0x104ui64, L"CrashHandler.dll");
  return LoadLibraryW(Filename);
}
随便找了三对:
1.



2.



3.






反馈之后才达到360现在的这个加载方式,有进步(至少不会隔空从PATH目录里找dll加载了

应该是涉及基础公共组件,还好我反馈得早——火绒程序里很多相似的公共逻辑会被固化,一堆组件里都一样写法,估计开发也不敢自己改——到时候全是在WinMain里GetProcAddress(LoadLibraryW(L"CrashHandler.dll"), "CrashHandler");就好玩儿了

感觉我发完可能会有些危险,希望某客服主管看到之后不要来找我,上次看到火绒强力卸载工具里写的一堆LibraryA = LoadLibraryA("InstMon.dll"); v43 = LoadLibraryA("fuModule.dll");之后在火绒官方论坛发了个帖子就被约谈了[:01:] 没事,欢迎他继续来约谈我





在dll加载这块,火绒开发干过的花活可太多了(大部分帖子都设置255权限了)
拓展阅读:
https://bbs.kafan.cn/thread-2247769-1-1.html
https://bbs.huorong.cn/thread-139892-1-1.html
https://bbs.huorong.cn/thread-146820-1-1.html
https://bbs.huorong.cn/thread-148519-1-1.html & https://bbs.huorong.cn/thread-152399-1-1.html
https://bbs.huorong.cn/thread-158671-1-1.html

本帖子中包含更多资源

您需要 登录 才可以下载或查看,没有帐号?快速注册

x
wowocock
发表于 2026-3-4 09:32:11 | 显示全部楼层

后续会慢慢改,你也可以多反馈。毕竟现在很多开发都没有安全经验。
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2026-4-23 16:54 , Processed in 2.216519 second(s), 3 queries , Redis On.

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表