Simplest security protection software

Let's not talk about anything else. Let's take a look at the effect.

I. Description

This software intercepts CreateProcessW, RegSetValueExW, RegDeleteValueW, and other processes, modifies and deletes the registry key values, to achieve security protection. The content intercepted here is relatively small. You can expand it as needed.

Ii. Main Code

1. Dynamic Link Library code

#include  HIPS_CREATEPROCESS    0x00000001L HIPS_REGSETVALUE    0x00000002L HIPS_REGDELETEVALUE 0x00000003L=* data_seg(".shared")== data_seg() comment(linker, "/.shared,RWS")  = { (wcslen(lpCommandLine) != == {NULL, (HIPS_INFO), (*)&= (SendMessage(FindWindow(NULL, L), WM_COPYDATA, GetCurrentProcessId(), (LPARAM)&cds) != -=*= {== {NULL, (HIPS_INFO), (*)&= (SendMessage(FindWindow(NULL, L), WM_COPYDATA, GetCurrentProcessId(), (LPARAM)&cds) != -== {== {NULL, (HIPS_INFO), (*)&= (SendMessage(FindWindow(NULL, L), WM_COPYDATA, GetCurrentProcessId(), (LPARAM)&cds) != -==&GetMsgProc, g_hInst, ==, , ,  (g_hHook !=

#include =~CInlineHook(=    m_pfnOrig = (NULL !=        DWORD dwNum = , &        m_bNewBytes[] = TEXT(        *(DWORD*)(m_bNewBytes + ) = (DWORD)pfnHookFunc - (DWORD)m_pfnOrig -         WriteProcessMemory(GetCurrentProcess(), m_pfnOrig, m_bNewBytes, , &=VOID CInlineHook::UnHook( ( !== , &BOOL CInlineHook::ReHook(= ( !== , &=

 once<Windows.h>);        ~CInlineHook();        VOID UnHook(    BOOL ReHook(    BYTE m_bOldBytes[];        BYTE m_bNewBytes[];    };

2. Call some code

 HIPS_CREATEPROCESS    0x00000001L HIPS_REGSETVALUE    0x00000002L HIPS_REGDELETEVALUE 0x00000003L*** CHipsCallDlg::InitLogList(| LVS_EX_FULLROWSELECT |, L, L, L, L, L&, Rect.Width() / ,  * Rect.Width() / ,  * Rect.Width() / ,  * Rect.Width() / , Rect.Width() /     m_hInst = LoadLibrary(TEXT(= (SETHOOKON)GetProcAddress(m_hInst,     m_hInst = GetModuleHandle(TEXT(= (SETHOOKOFF)GetProcAddress(m_hInst, * pWnd, COPYDATASTRUCT*= nNum =&= ((PHIPS_INFO)(pCopyDataStruct->lpData))->= _T(+= (IDYES === _T(== _T(= (((PHIPS_INFO)(pCopyDataStruct->lpData))->= _T(= _T(= _T(

Iii. Download

: Http://pan.baidu.com/s/1ntwjz77