外围网上金喜网站

任意代码保护 - 防止非图像支持的执行代码和代码页修改（例如VirtualAlloc / VirtualProtect创建/修改的代码）
阻止低完整性图像
阻止远程图像
阻止不受信任的字体
代码完整性守护者
禁用Win32k系统调用
不允许子进程
导出地址过滤 - 将功能修补到另一个功能的一个常见方法中的一个步骤
导入地址过滤 - 将功能修补到另一个功能的一个常见方法中的一个步骤
模拟执行
验证API调用（CallerCheck）
验证图像依赖完整性
验证堆栈完整性

xperf - “PROC_THREAD + LOADER”-f“wdeg_klogger.etl”
 
xperf -start“WDEG” - “Microsoft-Windows-Security-Mitigations：0xFFFFFFFFFFFFFF：0xFF：'stack'”-f“wdeg_unmerged.etl”

xperf -stop -stop“WDEG”-d“wdeg_merged.etl”

#include <Windows.h>#include <iostream>using namespace std;void* CreateCodeInVirtualMemory(BOOL writable)
{ BYTE code[3] = { 0x33, 0xc0, 0xc3 }; LPVOID result = VirtualAlloc(NULL, sizeof(code), MEM_COMMIT | MEM_RESERVE, writable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE); if (result)
{
  memcpy(result, code, sizeof(code));
} else cout << "VirtualAllocEx failed with error " << GetLastError() << endl; return result;
}void CreateCodeInVirtualMemoryAndExecute(BOOL useWritableMemory)
{ LPTHREAD_START_ROUTINE addr = (LPTHREAD_START_ROUTINE)CreateCodeInVirtualMemory(useWritableMemory); if (addr)
{  DWORD result = addr(NULL);
  cout << "Code at 0x" << hex << (void*)addr << " returned " << result << endl;
} else cout << "NULL address was not executed" << endl;
}void ExecuteIllegalMemory()
{
CreateCodeInVirtualMemoryAndExecute(FALSE);
} 
void PrintOptions()
{
cout << "Enter one of the following options:" << endl;
cout << "1 - Execute Memory Not Marked As Executable" << endl;
cout << "2 - Create Code in Virtual Memory" << endl;
cout << "3 - Create Code in Virtual Memory and Execute" << endl;
cout << "0 - Exit" << endl;
 
}void DecisionLoop()
{ while (true)
{  int selection;
  PrintOptions();
  cin >> selection;  switch (selection)
  {   case 0:    return;   case 1:
    ExecuteIllegalMemory();    break;   case 2:
    CreateCodeInVirtualMemory(TRUE);    break;   case 3:
    CreateCodeInVirtualMemoryAndExecute(TRUE);    break;   default:
    cout << "Invalid input" << endl;
  }
}
}int main()
{
DecisionLoop(); return 0;
}