1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

//步驟1和2的代碼
//獲取到微信所有進程句柄
DWORD Num = GetProcIds(L"WeChat.exe", Pids);
...
Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, 0x1000, &dwSize);
PSYSTEM_HANDLE_INFORMATION1 pHandleInfo = (PSYSTEM_HANDLE_INFORMATION1)pbuffer;
	for(nIndex = 0; nIndex < pHandleInfo->NumberOfHandles; nIndex++)
	{
	    //句柄在Pids中，就是微信進程的句柄信息
		if(IsTargetPid(pHandleInfo->Handles[nIndex].UniqueProcessId, Pids, Num))
		{
		    HANDLE hHandle = DuplicateHandleEx(pHandleInfo->Handles[nIndex].UniqueProcessId, 
						(HANDLE)pHandleInfo->Handles[nIndex].HandleValue,
						DUPLICATE_SAME_ACCESS
						);
			//對象名
			Status = NtQueryObject(hHandle, ObjectNameInformation, szName, 512, &dwFlags);
			//對象類型名
			Status = NtQueryObject(hHandle,  ObjectTypeInformation, szType, 128, &dwFlags);
			//找到微信的標志
			if (0 == wcscmp(TypName, L"Mutant"))
			{
				if (wcsstr(Name, L"_WeChat_App_Instance_Identity_Mutex_Name"))
				{
				    //DUPLICATE_CLOSE_SOURCE標志很重要，不明白的查一查
    				hHandle = DuplicateHandleEx(pHandleInfo->Handles[nIndex].UniqueProcessId, 
						(HANDLE)pHandleInfo->Handles[nIndex].HandleValue,
						DUPLICATE_CLOSE_SOURCE
						);
					if(hHandle)
					{
						printf("+ Patch wechat success!\n");
						CloseHandle(hHandle);
					}
				}
			}
		}
	}
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

步驟3的代碼
//通過注冊表找到微信安裝目錄
if(ERROR_SUCCESS != RegOpenKey(HKEY_CURRENT_USER, L"Software\\Tencent\\WeChat", &hKey))
{
	return;
}
DWORD Type = REG_SZ;
WCHAR Path[MAX_PATH] = {0};
DWORD cbData = MAX_PATH*sizeof(WCHAR);
if(ERROR_SUCCESS != RegQueryValueEx(hKey, L"InstallPath", 0, &Type, (LPBYTE)Path, &cbData))
{
	goto __exit;
}
PathAppend(Path, L"WeChat.exe");
//啟動微信客戶端
ShellExecute(NULL, L"Open", Path, NULL, NULL, SW_SHOW);