{"id":290,"date":"2022-04-23T19:15:19","date_gmt":"2022-04-24T03:15:19","guid":{"rendered":"http:\/\/www.qiuqiuren.club\/?p=290"},"modified":"2024-08-02T21:17:03","modified_gmt":"2024-08-03T05:17:03","slug":"windows%e5%b8%b8%e7%94%a8%e5%85%a5%e5%8f%a3%e7%82%b9","status":"publish","type":"post","link":"https:\/\/www.qiuqiuren.club\/?p=290","title":{"rendered":"Windows\u5e38\u7528\u5165\u53e3\u70b9"},"content":{"rendered":"<h1>Windows\u5e38\u7528\u5165\u53e3\u70b9<\/h1>\n<p>\u5206\u6790\u4fdd\u62a4\u65b9\u6848\u65f6\u5e38\u7528\u7684\u4e00\u4e9b\u5165\u53e3\u70b9<\/p>\n<ol>\n<li>\u7ebf\u7a0b\u8d77\u59cb\u70b9\uff1a<code>ntdll.RtlUserThreadStart<\/code>\uff0c\u5176\u7b2c\u4e00\u4e2a\u53c2\u6570\u662f\u7528\u6237\u6307\u5b9a\u7684\u903b\u8f91\u5165\u53e3\u70b9\u3002\u4f8b\u5982\u5f53\u6211\u7528CreateRemoteThread + LoadLibraryW\u65f6\uff1a<\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"http:\/\/www.qiuqiuren.club\/wp-content\/uploads\/2022\/04\/6264c0b815b48.png\" alt=\"file\" \/><\/p>\n<p>\u5b83\u4e5f\u4f1a\u8c03\u7528kernel32.BaseThreadInitThunk<\/p>\n<ol start=\"2\">\n<li>APC\u5165\u53e3\u70b9  <code>ntdll.KiUserAPCDispatcher<\/code><\/li>\n<\/ol>\n<p><img decoding=\"async\" src=\"http:\/\/www.qiuqiuren.club\/wp-content\/uploads\/2022\/04\/6264c22099de2.png\" alt=\"file\" \/><\/p>\n<p><img decoding=\"async\" src=\"http:\/\/www.qiuqiuren.club\/wp-content\/uploads\/2022\/04\/6264c23b47a7d.png\" alt=\"file\" \/><\/p>\n<ol start=\"3\">\n<li>\u8c03\u8bd5\u5668\u5165\u53e3\u70b9<\/li>\n<\/ol>\n<p>DbgUiRemoteBreakin \u8c03\u8bd5\u5668\u9644\u52a0\u65f6\u4f1a\u6267\u884c<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows\u5e38\u7528\u5165\u53e3\u70b9 \u5206\u6790\u4fdd\u62a4\u65b9\u6848\u65f6\u5e38\u7528\u7684\u4e00\u4e9b\u5165\u53e3\u70b9 \u7ebf\u7a0b\u8d77\u59cb\u70b9\uff1antdll.RtlUserThreadS<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-290","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=\/wp\/v2\/posts\/290"}],"collection":[{"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=290"}],"version-history":[{"count":0,"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=\/wp\/v2\/posts\/290\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.qiuqiuren.club\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}