In response to the call of XHR, We reorganized it in May 5, 2008 and added some new skills.
I added a tip in July 13, 2008.
All OpenProcess/ZwOpenProcess/OpenThread/ZwOpenThread can be replaced with ZwQuerySystemInformation-> ZwOpenProcess-> ZwDuplicateObject. For more information, see why.
(Zw) OpenProcess (PID + 0/1/2/3)-> (Zw) TerminateProcess
(Zw) OpenProcess-> CreateRemoteThread (ZwCreateThread)-> ExitProcess (ZwTerminateProcess)
(Zw) OpenProcess-> VirtualProtect (ZwProtectVirtualMemory)-> WriteProcessMemory (ZwWriteVirtualMemory)
Thread32First/Thread32Next (ZwQuerySystemInformation)-> (Zw) OpenThread-> (Zw) TerminateThread
DebugActiveProcess
(Zw) OpenProcess-> DbgUiDebugActiveProcess
(Zw) OpenProcess-> (Zw) AssignProcessToJobObject-> (Zw) TerminateJobObject
(Zw) OpenProcess-> ZwUnmapViewOfSection
(Zw) OpenProcess-> (Zw) SetContextThread
(Zw) OpenProcess-> QueueUserAPC (ZwQueueApcThread)
/* Window Attacking */
PostMessage (SendMessage) WM_CLOSE/WM_QUIT/NC_DESTORY
SetParent-> DestoryWindow
EndTask // Will make a direct call to the Win32 subsystem
PostMessage (SendMessage) 0x19 // by MJ0011, for MFC Application
For (int I = 0; I <65536; I ++)
{
PostMessage (HWND, I, 0, 0); // Message Flood
}
SetWindowLong (HWND, GWL_WNDPROC, (WNDPROC) YourDeadLock_Or_Crash_Function );
To be continued.