- 注册时间
- 2010-7-27
- 最后登录
- 2017-5-28
- 在线时间
- 6 小时
编程入门
- 魔鬼币
- 559
|
-
- HMODULE hNtDll = NULL;
- ZWQUERYSYSTEMINFORMATION pfnZwQuerySystemInformation = NULL;
- NTQUERYOBJECT pfnNtQueryObject = NULL;
- PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = NULL;
- POBJECT_ALL_INFORMATION pAllInfo =NULL;
- POBJECT_NAME_INFORMATION pNameInfo = NULL;
- ULONG nNumberHandle =0;
- NTSTATUS ntStatus = 0;
- ULONG ulSize,ulCount;
- char cBuffer[0x80000],cInfoBuffer[0x10000];
- hNtDll = GetModuleHandle(TEXT("ntdll.dll"));
- pfnZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
- pfnNtQueryObject = (NTQUERYOBJECT)GetProcAddress(hNtDll,"NtQueryObject");
- ntStatus = pfnZwQuerySystemInformation(SystemHandleInformation,cBuffer,0x80000,&ulSize);
- if(NT_SUCCESS(ntStatus))
- {
- DWORD n = ulSize/sizeof(SYSTEM_HANDLE_INFORMATION);
- nNumberHandle = *(PULONG)cBuffer;
- pSysHandleInfo = (PSYSTEM_HANDLE_INFORMATION)(cBuffer +4);
- ulCount = 0;
- for(ULONG i=0;i!=nNumberHandle;++i)
- {
- if(pSysHandleInfo.ProcessId != ProcessId) continue;
- ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo.Handle,ObjectAllInformation,cInfoBuffer,0x10000,&ulSize);
- ntStatus = pfnNtQueryObject((HANDLE)pSysHandleInfo.Handle,ObjectNameInformation,cInfoBuffer,0x10000,&ulSize);
- if(NT_SUCCESS(ntStatus))
- {
- pAllInfo = (POBJECT_ALL_INFORMATION)cInfoBuffer;
- pNameInfo = (POBJECT_NAME_INFORMATION)cInfoBuffer;
- if(_tcsstr(pNameInfo->NameBuffer,TEXT("QQGame_Mutex03/01/2003")) !=NULL)
- {
- return (HWND)pSysHandleInfo.Handle;
- }
- }
- }
- }
- return NULL;
- hMuTex = GetProcessKernelObject(GetCurrentProcessId());
- CloseHandle(hMuTex);
复制代码 原理,因为许多限制多开的软件都是利用命名内核对象来实现的,如果Create* 创建内核对象 返回 “以存在”那么就退出。
所以,先枚举进程中的所有内核对象,然后关闭他就好了~ 在R3下实现,用此方法可以多开大多数程序包括将来的。 |
|