Break through the security software load-driven approach

(1) zwloaddriver passionate loading,

Assume that a valid drive ABC boot = 3 has a registry key ABC, and ABC has not been loaded, then we will write an ABC of our ImagePath path in the registry users \ Software, when zwloaddriver is used to load the Registry path, some idiotic firewalls will let us load



(2) Boarding load, such as http://www.debugman.com/read.php? Tid = 2974


(3) DLL Loading

Someone's posts are vague, and I cannot understand XX again. It doesn't matter.


A. rdpdd. DLL. This is a driver. Replace rdpdd in some way. DLL, the method is simple to open dual open 3389 (the code can be sent to Baidu on the Internet), and then connect 3389 locally (use TCP socket for RDP protocol interaction, the code can also be sent to Baidu ).

B. atm fd. DLL, type1 font library, type1 font library, first throw a type1 font file (carried by yourself) to the font directory, and then replace the atm fd. DLL, and then call some XX to use the type1 font on an HDC ~

C. vgaxxx. These things are loaded due to XX behavior. If they are not tested, they are first blurred.

D. ATI *. dll, the yellow stuff, can be dynamically xx

E. printer...

F. Some video decoding AIDS. They are really drivers...

G. Something that someone has revealed is overly vague.



(4) Trust replacement; old topic: beep for file replacement and beep for registry replacement


(5) Crash Dump loading. For details, refer to the mj0011 article.


(6) Other... fuzzy


PS: for server hosts, rdpdd. dll can wait for external triggering.