X64windows security Mechanism Process _ thread _ Module Load Callback Summary

Each callback above x64 corresponds to a count count. Registry callbacks will also be available. Save the PSPNOTIFYENABLEMASK flag, each of which represents whether the corresponding callback exists.

The corresponding bits and the corresponding assembly code are as follows. Even if this callback has been registered by anti-virus software, we can get the corresponding callback to be executed by locating the corresponding count and clearing it by 0 or by the corresponding flag position of 0.

This disables the security mechanism for killing soft.

Pspnotifyenablemask1            1            1                1=fthread processex Process Image callback XP count clear 0 attack NT!pspcreateprocessnotifyroutinecount pspcreatethread pspexitprocess pssetcreateprocessnotifyroutinepage:83fcc9 7B B8 E4 AD F7 themov eax, offset _pspcreateprocessnotifyroutinecountpage:83fcc980 F0 0F C1 
     ,                                         LockXadd [eax], ecxpage:83fcc984 A1 +AB F7 themov eax, _pspnotifyenablemaskpage:83fcc989 A8 GenevaTest Al,2    //Tenpage:83fcc98b 0F -  -FF FF FF jnz loc_83fcc901page:83fcc991 B8 +AB F7 themov eax, offset _pspnotifyenablemaskpage:83fcc996 F0 0F BA -  on                                      LockBTS dword ptr [EAX],1NT!pspcreateprocessnotifyroutineexcount pspcreatethread pspexitprocess pssetcreateprocessnotifyroutineexpage:83 fcc9a0 B8 E0 AD F7 themov eax, offset _pspcreateprocessnotifyroutineexcountpage:83fcc9a5 F0 0F C1  ,                                         LockXadd [eax], ecxpage:83fcc9a9 A1 +AB F7 themov eax, _pspnotifyenablemaskpage:83fcc9ae A8GenevaTest Al,4    // -NT!pspcreatethreadnotifyroutinecount pspcreatethread pspexitthread pssetcreatethreadnotifyroutinepage:840a07c1 E 8 -F3 FF FF call [email protected] A ; Etwtracethread (x,x,x) page:840a07c6 A1 +AB F7 themov eax, _PSPNOTIFYENABLEMASKPAGE:840A07CB A8 ,Test Al,8    // +NT!Psploadimagenotifyroutinecount _psimagenotifyenabled Pssetloadimagenotifyroutinepage:83ffdf16 E8 A  . xx xxcall [email protected] - ; Miobtainsectionfordriver (x,x,x,x,x) page:83ffdf1b -DB xor ebx, ebxpage:83ffdf1d the  -  -0C mov [esp+60h+var_54], Eaxpage:83ffdf21 the5C -  -CMP [esp+60h+var_4c], ebxpage:83ffdf25 0F -B7xx xx xxJZ loc_83ffdfe2page:83ffdf2b A1 +AB F7 themov eax, _pspnotifyenablemaskpage:83ffdf30 8B 4C -  -mov ecx, [esp+60h+VAR_4C] Page:83ffdf34 A8 onTest Al,1//1Win7 Pspnotifyenablemask The 4 of these0111=7

X64windows security Mechanism Process _ thread _ Module Load Callback Summary