What is unlocker?

A header-only, fast, simple Ring3 unlocker library.

Aimed to be better than famous tool - unlocker @ Cedrick Collomb.

Advantanges

• [x] [UNIQUE] support operations on unacceptable-name files (reserved names or name ends with a period or a space)
• [x] [UNIQUE] support detection of opened memory-mapping-file (abbr as mmf) handle and map view of mmf
  • MS Office compatible mode (e.g. *.doc, *.xls, *.ppt opened by MS Office 2007+)
  • file copy by Windows Explorer
  • other scenarios
• [x] low resource comsuption & quick scan improvement
  • hang-up handle check without creating a mount of threads (Robert Simpson's answer at stackoverflow.com)
• [x] support operating files in UNC/Network drive
• [x] support operations cross x64 and x86 modules
• [x] support both UNICODE & non-UNICODE projects
• [ ] support terminate some of the protected Ring3 processes
• [ ] support all version of Visual C++ or Visual Studio
• [ ] support all version of Windows OS

How it works?

Type of files

• Non-executable files:
  • *.txt, *.jpg, *.mp3, *.zip, *.doc, etc.
• Executable files:
  • *.exe - (Portable Executable / MS-DOS MZ executable)
  • *.dll - (Dynamic-Linked Library / COM Object)
  • *.sys - (Driver)

Feedback

• email : [email protected]
• wechat : zw198932
• QQ: 529055130

References

Thanks to following projects, in no particular order

• ncFindFileHandle.cpp @ 宇文莺语 (wang huan)
• vmmap @ twpol

About author

  var orca = {
    name  : "Zhang Wei",
    site : "http://ez8.co"
  }