Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

新版 Freegate 的另一个问题

21 views
Skip to first unread message

Moses

unread,
Oct 16, 2009, 9:45:44 AM10/16/09
to
发现新版的 fg 用了 Themida 做了反反向工程的保护, 不过也就同时导致了一些问题, 具体症状就是如果运行了 Filemon, Regmon, ProMon 等程序後, 就不能在运行 fg 了, 即使关掉也不行, 必须要重启

Cen

unread,
Oct 16, 2009, 10:59:22 AM10/16/09
to
Themida��ʾ
"A monitor program has been found running in your system.
Please, unload it from memory and restart your program."

�Ҳ���һ���ڴ�, ��ȻFilemon, Regmon, ProMon�״�����ʱ���������
C:\WINDOWXP\system32\Drivers\FILEM701.SYS
C:\WINDOWXP\system32\Drivers\REGSYS701.SYS
C:\WINDOWXP\system32\Drivers\PROCMON20.SYS
�˳���ȴûж�������.

����Themida��⵽��Щ��������ڴ�, �͵���Filemon, Regmon, ProMon������.
����ֹ�ж�������?

"Moses" <moses...@gmail.com> wrote:
> �����°�� fg ���� Themida ���˷����򹤳̵ı���, ����Ҳ��ͬʱ������һЩ����, ����֢״������������� Filemon, > Regmon, ProMon �ȳ�����, �Ͳ��������� fg ��, ��ʹ�ص�Ҳ����, ����Ҫ����

Moses

unread,
Oct 17, 2009, 6:01:37 AM10/17/09
to
目前只找到一个解决方法就是重启............

--
楼上 Cen 说的 "Re: 新版 Freegate 的另一个问题" 在某一分钟的第 12 秒被 Moses 所回复;
文件夹 ID 为 58;
原帖 16 行共 1858 字节.

C> Themida提示
C> "A monitor program has been found running in your system.
C> Please, unload it from memory and restart your program."

C> 我查了一下内存, 果然Filemon, Regmon, ProMon首次运行时加载驱动程序
C> C:\WINDOWXP\system32\Drivers\FILEM701.SYS
C> C:\WINDOWXP\system32\Drivers\REGSYS701.SYS
C> C:\WINDOWXP\system32\Drivers\PROCMON20.SYS
C> 退出后却没卸载驱动程序.

C> 估计Themida检测到这些驱动程序在内存, 就当你Filemon, Regmon, ProMon在运行.
C> 如何手工卸载驱动程序?

Cen

unread,
Oct 19, 2009, 12:59:37 AM10/19/09
to
�����������ȫ�ķ���, ��˵[1,2], ProMon����������ж��, ���dz������, Ҳ�������ʧ��, ���п��Ե�.

[1] http://forum.sysinternals.com/forum_posts.asp?TID=8744
[2] http://forum.sysinternals.com/forum_posts.asp?TID=19099


"Moses" <moses...@gmail.com> wrote:
> Ŀǰֻ�ҵ�һ�����������������............
>
> "Cen" <C...@rixi.an> wrote:
>> Themida��ʾ


>> "A monitor program has been found running in your system.

>> Please, unload it from memory and restart your program."
>>

>> �Ҳ���һ���ڴ�, ��ȻFilemon, Regmon, ProMon�״�����ʱ���������

>> C:\WINDOWXP\system32\Drivers\FILEM701.SYS
>> C:\WINDOWXP\system32\Drivers\REGSYS701.SYS

0 new messages