利用|利用 Blackbone 做进程保护利用Blackbone做进程保护

BlackboneWindows memory hacking library
[
](https://github.com/DarthTon/Blackbone#features)Features
x86 and x64 support
Process interaction
Manage PEB32/PEB64
Manage process through WOW64 barrier
Process Memory
Allocate and free virtual memory
Change memory protection
Read/Write virtual memory
Process modules
Enumerate all (32/64 bit) modules loaded. Enumerate modules using Loader list/Section objects/PE headers methods.
Get exported function address
Get the main module
Unlink module from loader lists
Inject and eject modules (including pure IL images)
Inject 64bit modules into WOW64 processes
Manually map native PE images
Threads
Enumerate threads
Create and terminate threads. Support for cross-session thread creation.
Get thread exit code
Get main thread
Manage TEB32/TEB64
Join threads
Suspend and resume threads
Set/Remove hardware breakpoints
Pattern search
Search for arbitrary pattern in local or remote process
Remote code execution
Execute functions in remote process
Assemble own code and execute it remotely
Support for cdecl/stdcall/thiscall/fastcall conventions
Support for arguments passed by value, pointer or reference, including structures
FPU types are supported
Execute code in new thread or any existing one
Remote hooking
Hook functions in remote process using int3 or hardware breakpoints
Hook functions upon return
Manual map features
x86 and x64 image support
Mapping into any arbitrary unprotected process
Section mapping with proper memory protection flags
Image relocations (only 2 types supported. I haven't seen a single PE image with some other relocation types)
Imports and Delayed imports are resolved
Bound import is resolved as a side effect, I think
Module exports
Loading of forwarded export images
Api schema name redirection
SxS redirection and isolation
Activation context support
Dll path resolving similar to native load order
TLS callbacks. Only for one thread and only with PROCESS_ATTACH/PROCESS_DETACH reasons.
Static TLS
Exception handling support (SEH and C++)
Adding module to some native loader structures(for basic module api support: GetModuleHandle, GetProcAdress, etc.)
Security cookie initialization
C++/CLI images are supported
Image unloading
Increase reference counter for import libraries in case of manual import mapping
Cyclic dependencies are handled properly
Driver features
Allocate/free/protect user memory
Read/write user and kernel memory
Disable permanent DEP for WOW64 processes
Change process protection flag
Change handle access rights
Remap process memory
Hiding allocated user-mode memory
User-mode dll injection and manual mapping
Manual mapping of drivers
[
【利用|利用 Blackbone 做进程保护】](https://github.com/DarthTon/Blackbone#license)License
Blackbone is licensed under the MIT License. Dependencies are under their respective licenses.

利用|利用 Blackbone 做进程保护

推荐阅读

北控水务为什么不涨北控水务到底好不好

牵组词语汉字牵组词语

月季花扦插的最佳时间月季花扦插的最佳时间现在可以插吗?

2023重庆医科大学研究生成绩复查申请时间+方式

n95口罩能防尘吗 n95口罩可以用几次

摩托罗拉里程碑2刷机

如果你爱的人总是以怨报德,你会怎么样？

宝马525多少钱落地宝马525价格多少钱

电商铺货是什么意思电商货架什么意思，货架市场

胡萝卜怎样吃最有营养啊视频胡萝卜怎样吃最有营养啊

巴戟天药材多少钱一斤，巴戟天药店多少钱一斤

吕锅上的污渍怎么去除啊

非主流图片唯美霸气非主流相框素材

白金膏的功效与作用皮白金膏的功效与作用?

虚拟机怎么开网页游戏模式，虚拟机怎样打开网页

闻鸡起舞的主人公是谁囊萤映雪的主人公是谁

口红吃饭的时候怎么办

宝宝长期咳嗽易得肺炎

包贝尔大婚柳岩遭闹伴娘柳岩伴娘事件是什么?

未婚生子罚款多少2022年未婚生子罚款多少2022？