如何关闭系统文件保护功能
/*得到进程的ID，具体的方法可以使用CreateToolHelpSnap32()，ProcessFirst32()以及ProcessNext32()得到*/DWORD dwPid=GetProcessIdFromName(“Winlogon.exe”);
HANDLE Process=OpenProcess(，FALSE，dwPid);
DWORD dwVersion;
HMODULE hSfc;
dwVersion = GetVersion();
//判断操作系统的类型
if ((DWORD)(LOBYTE(LOWORD(dwVersion))) == 5)
{ // Windows 2000/XP
if((DWORD)(HIBYTE(LOWORD(dwVersion))) == 0) //Windows 2000
hSfc = LoadLibrary("sfc.dll");
else if((DWORD)(HIBYTE(LOWORD(dwVersion))) = 1) //Windows XP
hSfc = LoadLibrary("sfc_os.dll");
}
//得到函数的地址
FARPROC dwAddress=GerProcAddress(hSfc， MAKEINTRESOURCE(2));
DWORD dwThreadId;
HANDLE hThread;
//创建远线程
hThread =CreateRemoteThread(hProcess，0，0， /
(DWORD (__stdcall *) (void *)) dwAddress，0，0，&dwThreadId);
WaitForSingleObject(hThread，0x0FA0);
具体原理可参看Bgate的《在Win 2000/XP上安静地替换正在使用的系统文件》这篇文章
页:
[1]