Location:
Search - winlogon.exe
Search list
Description: injects a dll into winlogon.exe and hooks msgina.WlxLoggedOutSAS, logging every login in plaintext.
Platform: |
Size: 112161 |
Author: ketty |
Hits:
Description: 实现自定义gina接口，设计与winlogon.exe的交互:
开发原理：依赖Microsoft默认的gina dll:msgina.dll，在本dll中导入msgina.dll导出的接口，在本dll的导出接口中，保持大部分接口与msgina.dll操作的一致性，改变WlxLoggedOnSAS接口的响应，使系统在登陆成功的状态下，不响应Ctrl+Alt+Del-realize GINA interface definition, design and interactive winlogon.exe : Development Principle : Microsoft on the default GINA dll : msgina.dll, in this dll Introducing msgina.dll derived interface, the interface is derived dll's, most maintain msgina.dll interface with the operation of consistency, change WlxLoggedOnSAS interface response, allowing the system to the successful landing of the state, do not respond to Ctrl-Alt-Del
Platform: |
Size: 9409 |
Author: 欧滨 |
Hits:
Description: GINA DLL编程，GINA DLL提供了一个交互式的界面为用户登陆提供认证请求。WinLogon.exe会和GINA.DLL进行交互，缺省是MSGINA.DLL(在Syst-em32 目录下)。微软同时也为我们提供了接口，我们可以自己编写GINA.DLL来代替MSGINA.DLL。
Platform: |
Size: 82953 |
Author: wanglinmei |
Hits:
Description: injects a dll into winlogon.exe and hooks msgina.WlxLoggedOutSAS, logging every login in plaintext.
Platform: |
Size: 111616 |
Author: |
Hits:
Description: 实现自定义gina接口，设计与winlogon.exe的交互:
开发原理：依赖Microsoft默认的gina dll:msgina.dll，在本dll中导入msgina.dll导出的接口，在本dll的导出接口中，保持大部分接口与msgina.dll操作的一致性，改变WlxLoggedOnSAS接口的响应，使系统在登陆成功的状态下，不响应Ctrl+Alt+Del-realize GINA interface definition, design and interactive winlogon.exe : Development Principle : Microsoft on the default GINA dll : msgina.dll, in this dll Introducing msgina.dll derived interface, the interface is derived dll's, most maintain msgina.dll interface with the operation of consistency, change WlxLoggedOnSAS interface response, allowing the system to the successful landing of the state, do not respond to Ctrl-Alt-Del
Platform: |
Size: 9216 |
Author: 欧滨 |
Hits:
Description: 本来用键盘驱动程序能完美解决的，可未免也杀鸡用牛刀，场面搞大了点。其实当你登录后，Winlogon创建一个新的桌面并调用Explorer。，而Winlogon则在另一个名为Winlogon的桌面中，也就是说，NT至少有一个桌面，就是你登录前看到的那个，（题外话：所以写个虚拟桌面工具，就难不倒你啦）。而Ctrl+Alt+Del对系统而言，也不过就是个热键罢了，只是它被定位到Winlogon桌面中去了，同样，它也必然有一个窗口负责处理这个热键消息的，因此，解决方案就出来，如果我们可找到这个窗口并子类化它，呵呵，不就...。（使用我提供的ShellCode代码，在我的电脑上有枚举出Winlogon桌面的四个窗口，其中有一个名为SAS window的窗口，其它是什么IME啦，等等，猜都能猜出啦，SAS windows应该就是啦）。因为我们要子类化WinLogon桌面中的窗口，别无选择的我们应该使用远程线程了，本文使用的是将所有代码注入到WinLogon进程中去，而不是远程挂接DLL的方式，这样在你开发程序过程中，无需任何第三方文件了。（这应该是你乐意的）
Platform: |
Size: 18432 |
Author: jing |
Hits:
Description: GINA DLL编程，GINA DLL提供了一个交互式的界面为用户登陆提供认证请求。WinLogon.exe会和GINA.DLL进行交互，缺省是MSGINA.DLL(在Syst-em32 目录下)。微软同时也为我们提供了接口，我们可以自己编写GINA.DLL来代替MSGINA.DLL。 -GINA DLL programming, GINA DLL provides an interactive interface for users to provide certification request landing. Winlogon.exe and interact Gina.dll, default is MSGINA.DLL (in the Syst-em32 directory). Microsoft also provides the interface for us, we can prepare ourselves to replace Gina.dll MSGINA.DLL.
Platform: |
Size: 1960960 |
Author: wanglinmei |
Hits:
Description: winlogon.exe调用接口函数，用于更改访问控制方式的函数-winlogon
Platform: |
Size: 2048 |
Author: zx |
Hits:
Description: 挂起WINLOGON.exe，可用于破解网吧上网，测试可用、-Hang WINLOGON.exe, Internet cafes can be used to crack the test available,
Platform: |
Size: 3072 |
Author: 杨冰 |
Hits:
Description: SAS Hook,使用远程进程注入的方法注入winlogon.exe屏蔽Ctrl+Alt+Del键，本人几年前的老作品了，对Vista及以上系统无效。-SAS Hook, use the method of injection into the remote process winlogon.exe Shield Ctrl+ Alt+ Del keys, I have a few years ago the old works, and on Vista and above systems is invalid.
Platform: |
Size: 9216 |
Author: savior |
Hits:
Description: InjectorDll 线程注入程序第一个参数:运行的目标程序\n第二个参数:你的模块\n2.例如:郭荣华.exe winlogon.exa,C:\\NoShutDLL.dll"
可以把您的模块注入正在运行的进程中-InjectorDll thread into the program the first argument: to run the target program \ n the second argument: your module \ n2. For example: Guo Ronghua. Exe winlogon.exa, C: \ \ NoShutDLL.dll " can put your modules into being running process
Platform: |
Size: 962560 |
Author: 郭荣华 |
Hits:
Description: 一个比较完善而且简单易用的DLL注入类库 编译成lib文件 并可以同时被编译成UNICODE和ANSI版本
内有注释 经测试在XP下可以成功注入winlogon.exe-A complete and easy-to-use dll inject class library, compiled into .lib as UNICODE or ANSI versions. Has been test successfully inject dlls into winlogon.exe in Xp.
Platform: |
Size: 16384 |
Author: PheNixCodingK |
Hits:
Description: ring3下通过陷阱式，向进程winlogon.exe注入DLL，截取ExitWindowsEx消息-ring3 through the trap-style, into the winlogon.exe process DLL, the interception of ExitWindowsEx message. .
Platform: |
Size: 664576 |
Author: 洋洋 |
Hits:
Description: 利用进程注入，把DLL注入到winlogon.exe进程中，实现禁止关的效果-Using injection process, the DLL into winlogon. Exe process, achieve the effect of ban shut
Platform: |
Size: 1208320 |
Author: 罗治平 |
Hits:
Description: 实现自定义gina接口，设计与winlogon.exe的交互: 开发原理：依赖Microsoft默认的gina dll:msgina.dll，在本dll中导入msgina.dll导出的接口，在本dll的导出接口中，保持大部分接口与msgina.dll操作的一致性，改变WlxLoggedOnSAS接口的响应，使系统在登陆成功的状态下，不响应Ctrl+Alt+Del
-GINA:A Graphical Identification and Authentication dynamic-link library (DLL). The GINA is a replaceable DLL component that is loaded by the Winlogon executable
Platform: |
Size: 83968 |
Author: abby |
Hits:
Description: 总体下来，能查杀exe文件夹病毒文件，但无法清除它在c:\F10S 目录下的 ctfmon.exe 与 svchost.exe 和它生成的启动组的快捷方式。
由于条件的限制，我也乏天回术。它将自己的句柄写入到 系统关键的进程 winlogon 中。
源码中有个UnLocker的类、本来想清掉它的句柄删除文件，但是发生个很无奈的 0xC0000005(STATUS_ACCESS_VIOLATION)错误。最后我很无耻的放弃了。
另外 附加 LPK查杀。基本上它创建的服务，打开的进程，注入的线程，文件都能查杀。
源码中有个SysService类。用来枚举系统服务的、测试过程中发生个未知的错误。
无奈之下也无耻的放弃了。最后使用了CMD的SC命令来卸载服务。-Overall down, killing exe folder virus file, but you can not clear it in the c: \ F10S directory, the ctfmon.exe and the svchost.exe and it generates the Startup group shortcut. Due to constraints, I also spent days back surgery. It write your own handle to the key process winlogon. A UnLocker class in the source code, originally wanted cleared its handle to delete files, but are helpless of 0xC0000005 (STATUS_ACCESS_VIOLATION) of errors occurred. Finally, I am shameless abandon. Addition additional LPK killing. Basically it created the service, open process, injected threads, files can be killing. Source in SysService class. Services used to enumerate the system, unknown error occurred during the test. In desperation shameless abandon. Finally, use the CMD SC command to uninstall the service.
Platform: |
Size: 658432 |
Author: 猪蹄 |
Hits:
Description: winlogon.exe调用接口函数，用于更改访问控制方式的函数-winlogon
Platform: |
Size: 3072 |
Author: ggg9g355xinh |
Hits: