code.google.com/p/reactos-mirror https://github.com/zqzjz0911?tab=following

GetGUIThreadInfo GetWindowThreadProcessId

http://huaidan.org/archives/1052.html

Windows 中的三种对象 http://blog.csdn.net/qq_18218335/article/details/78143724

!process 0 0 .process /p EProcess .reload /f /user .process /i /p EProcess !locks -v fffffa8002d92af0

https://www.anquanke.com/post/id/85485 https://weibo.com/p/1001603842055548865374 https://github.com/hfiref0x/CVE-2015-1701/blob/master/Source/Taihou/main.c http://bobao.360.cn/learning/detail/516.html

http://blog.csdn.net/u013761036/article/details/68939796 https://github.com/metoo10987/WinNT4/blob/f5c14e6b42c8f45c20fe88d14c61f9d6e0386b8e/private/ntos/w32/ntuser/client/dlgbegin.c

http://bbs.pediy.com/showthread.php?t=212786

http://blog.csdn.net/u013761036/article/details/61467912 http://blog.csdn.net/kingswb/article/details/51468675 http://blog.csdn.net/swanabin/article/details/16858413 https://www.52pojie.cn/thread-245482-1-1.html https://bbs.pediy.com/thread-159743.htm https://bbs.pediy.com/thread-185786.htm http://www.freebuf.com/news/138216.html https://www.anquanke.com/post/id/86928 https://www.anquanke.com/post/id/86821 http://www.sohu.com/a/199121624_257305 https://www.anquanke.com/post/id/86829 https://www.anquanke.com/post/id/86671 https://www.anquanke.com/post/id/86575 https://www.anquanke.com/post/id/87076 http://www.freebuf.com/articles/system/99141.html http://www.freebuf.com/articles/system/93413.html http://www.4hou.com/system/9724.html

https://github.com/tandasat/RemoteWriteMonitor DebugActiveProcess

构建一个高交互型的难以发现的蜜罐 https://ipot.sec-wiki.com/article/2017-05-23-construct-honeypot.html

http://standa-note.blogspot.ca/2015/03/section-based-code-injection-and-its.html