过QQ游戏大厅的SX保护

早些时间看郁金香的教程，写过qq游戏练练看的挂，那时候CE附加QQ游戏大厅的时候貌似是没有任何保护的，昨天舍友让做个斗地主的记牌器，但是，我用CE附加的时候，被检测到了，其实不附加也会被检测，所以猜测可能只是检测窗口进程或是模块名称啥的吧，被检测到的时候主程序会退出，但是那个对话框还在，就是那个SX什么什么的，所以如果是QQgame启动了某个线程来检测非法的话，在主程序退出其他线程对象都释放掉的时候，那个检测的线程对象还是存在的（提示SX非法的对话框别关掉！）。借助pt很容易就找到了这个线程。

未开CE前线程状态：

开了CE被检测到后的线程状态：

然后该怎么办就不用说了吧，干掉这个线程就OK了。

若是嫌麻烦每次都要开pt找线程的话，可以写个结束这个模块内线程的程序

 #include "stdafx.h"
 #include "windows.h"
 #include "TlHelp32.h"
 const TCHAR QQ_GAME[] = _T("QQGame.exe");
 const TCHAR QQ_THREAD_DLL[] = _T("TenSLX.dll");


 typedef   enum   _THREADINFOCLASS   {
     ThreadBasicInformation,
     ThreadTimes,
     ThreadPriority,
     ThreadBasePriority,
     ThreadAffinityMask,
     ThreadImpersonationToken,
     ThreadDescriptorTableEntry,
     ThreadEnableAlignmentFaultFixup,
     ThreadEventPair_Reusable,
     ThreadQuerySetWin32StartAddress,
     ThreadZeroTlsCell,
     ThreadPerformanceCount,
     ThreadAmILastThread,
     ThreadIdealProcessor,
     ThreadPriorityBoost,
     ThreadSetTlsArrayAddress,
     ThreadIsIoPending,
     ThreadHideFromDebugger,
     ThreadBreakOnTermination,
     MaxThreadInfoClass
 }   THREADINFOCLASS;

 typedef LONG (__stdcall *_pfnZwQueryInformationThread) (
     IN   HANDLE   ThreadHandle,
     IN   THREADINFOCLASS   ThreadInformationClass,
     OUT   PVOID   ThreadInformation,
     IN   ULONG   ThreadInformationLength,
     OUT   PULONG   ReturnLength   OPTIONAL
     );

 HANDLE m_GameProcessHandle;
 //记录QQ_THREAD_DLL信息
 BYTE  * m_pmodBaseAddr;
 DWORD   m_dwmodBaseSize;
 _pfnZwQueryInformationThread m_pfnZwQueryInformationThread;

 BOOL StartPatch();//PATCHQQ主函数
 DWORD EnablePrivilege (LPCTSTR name);//提权函数
 BOOL ListProcessModules(DWORD dwPID);//枚举指定进程的模块
 BOOL ListProcessThreads( DWORD dwOwnerPID);//枚举指定进程创建的线程，并结束掉QQ保护线程
 PVOID ShowThreadInfo(DWORD tid);//获取线程的起始地址

 int _tmain(int argc, _TCHAR* argv[])
 {
     m_pfnZwQueryInformationThread =(_pfnZwQueryInformationThread)\
         GetProcAddress   (LoadLibrary(_T("ntdll.dll")),"ZwQueryInformationThread");

     if (StartPatch())
     {
         printf("可以CE附加QQ游戏大厅了\n");
     }
     else
         printf("失败！\n");
     return 0;
 }

 BOOL StartPatch()
 {
     if(0!=EnablePrivilege (SE_DEBUG_NAME))
     {
         return FALSE;
     }
     HANDLE hProcessSnap;
     PROCESSENTRY32 pe32;

     hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
     if( hProcessSnap == INVALID_HANDLE_VALUE )
     {
         return FALSE;
     }

     pe32.dwSize = sizeof( PROCESSENTRY32 );

     if( !Process32First( hProcessSnap, &pe32 ) )
     {
         CloseHandle( hProcessSnap );
         return FALSE;
     }

     BOOL bStartGame = FALSE;
     do
     {
         if (_tcscmp(pe32.szExeFile, QQ_GAME) == 0)
         {
             bStartGame = TRUE;
             m_GameProcessHandle = OpenProcess(PROCESS_VM_WRITE|PROCESS_CREATE_THREAD|PROCESS_VM_OPERATION,\
                 FALSE, pe32.th32ProcessID);
             if (m_GameProcessHandle == NULL)
             {
                 return FALSE;
             }
             for (int i=0; i<5;i++)
             {
                 if (!ListProcessModules(pe32.th32ProcessID))
                 {
                     return FALSE;
                 }

             }
             if (!ListProcessThreads(pe32.th32ProcessID))
             {
                 return FALSE;
             }
         }

     } while( Process32Next( hProcessSnap, &pe32 ) );

     if (!bStartGame)
     {
         MessageBox(NULL,_T("运行QQ大厅后才能使用"),_T("提示"),MB_OK);
         return FALSE;
     }
     CloseHandle( hProcessSnap );
     return TRUE;
 }
 DWORD EnablePrivilege (LPCTSTR name)
 {
     HANDLE hToken;
     BOOL rv;
     //设置结构
     TOKEN_PRIVILEGES priv = { 1, {0, 0, SE_PRIVILEGE_ENABLED} };
     // 查找权限值
     LookupPrivilegeValue (
         0,
         name,
         &priv.Privileges[0].Luid
         );
     // 打开本进程Token
     OpenProcessToken(
         GetCurrentProcess (),
         TOKEN_ADJUST_PRIVILEGES,
         &hToken
         );
     // 提权
     AdjustTokenPrivileges (
         hToken,
         FALSE,
         &priv,
         sizeof priv,
         0,
         0
         );
     // 返回值，错误信息，如果操作成功，则应为ERROR_SUCCESS，为O
     rv = GetLastError();
     // 关闭Token
     CloseHandle (hToken);
     return rv;
 }
 BOOL ListProcessModules(DWORD dwPID)
 {
     HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
     MODULEENTRY32 me32;

     hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID );
     if( hModuleSnap == INVALID_HANDLE_VALUE )
     {
         return( FALSE );
     }

     me32.dwSize = sizeof( MODULEENTRY32 );
     if( !Module32First( hModuleSnap, &me32 ) )
     {
         CloseHandle( hModuleSnap );
         return( FALSE );
     }
     do
     {
         if (_tcscmp(me32.szModule, QQ_THREAD_DLL) == 0)
         {
             m_pmodBaseAddr = me32.modBaseAddr;
             m_dwmodBaseSize = me32.modBaseSize;

         }

     }while( Module32Next( hModuleSnap, &me32 ));

     CloseHandle( hModuleSnap );
     return( TRUE );

 }
 BOOL ListProcessThreads( DWORD dwOwnerPID)
 {
     HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
     THREADENTRY32 te32;
     PVOID addr;

     hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
     if( hThreadSnap == INVALID_HANDLE_VALUE )
         return( FALSE );

     te32.dwSize = sizeof(THREADENTRY32 );


     if( !Thread32First( hThreadSnap, &te32 ) )
     {
         CloseHandle( hThreadSnap );
         return( FALSE );
     }

     do
     {
         if( te32.th32OwnerProcessID == dwOwnerPID )
         {
             addr = ShowThreadInfo(te32.th32ThreadID);
             if(((DWORD)addr>(DWORD)m_pmodBaseAddr)&&((DWORD)addr<\
                 ((DWORD)m_pmodBaseAddr+(DWORD)m_dwmodBaseSize)))
             {

                 HANDLE oth=OpenThread(THREAD_ALL_ACCESS,FALSE,te32.th32ThreadID);
                 //关闭这个线程
                 TerminateThread(oth, 0);
             }
         }
     } while( Thread32Next(hThreadSnap, &te32 ) );

     CloseHandle( hThreadSnap );
     return( TRUE );
 }
 PVOID ShowThreadInfo(DWORD tid)
 {

     PVOID                    startaddr;
     HANDLE                   thread;
     //thread = m_pfnOpenThread_ex(THREAD_ALL_ACCESS,FALSE,tid);
     thread=OpenThread(THREAD_ALL_ACCESS,FALSE,tid);
     if   (thread   ==   NULL)
         return   FALSE;

     m_pfnZwQueryInformationThread(thread,
         ThreadQuerySetWin32StartAddress,
         &startaddr,
         sizeof(startaddr),
         NULL);

     CloseHandle   (thread);
     return   startaddr;
 }