search

antiwar3 / py

飘云ark（pyark）
http://www.pysafe.cn
436 stars 66 forks source link

签名教程 #17

Open coding-today opened 2 years ago

coding-today commented 2 years ago

image 教程中让自己签名，可以给一个教程吗？

antiwar3 commented 2 years ago

C:\Windows\System32\drivers\PYArkSafe.sys 找到这个文件 然后自己签名放到exe同级目录即可

alienwu2018 commented 2 years ago

可以劫持一下debughelp.dll，然后hook 一下createservice更换一下自己签名的驱动镜像(盲猜楼主是因为现在打的签名过不了EAC的回调)

SC_HANDLE WINAPI MyCreateServiceW( In SC_HANDLE hSCManager, In LPCWSTR lpServiceName, _Inopt LPCWSTR lpDisplayName, In DWORD dwDesiredAccess, In DWORD dwServiceType, In DWORD dwStartType, In DWORD dwErrorControl, _Inopt LPCWSTR lpBinaryPathName, _Inopt LPCWSTR lpLoadOrderGroup, _Outopt LPDWORD lpdwTagId, _Inopt LPCWSTR lpDependencies, _Inopt LPCWSTR lpServiceStartName, _Inopt LPCWSTR lpPassword ) { lpBinaryPathName = L"\SystemRoot\System32\drivers\PYArkSafeSign.sys"; return pfCreateServiceA(hSCManager, lpServiceName, lpDisplayName, dwDesiredAccess, dwServiceType, dwStartType, dwErrorControl, lpBinaryPathName, lpLoadOrderGroup, lpdwTagId, lpDependencies, lpServiceStartName, lpPassword); }

inox159357 commented 7 months ago

como faço para assinar um arquivo sys ?