error C2065: 'NtReadVirtualMemory' : undeclared identifier
看提示是说这个函数未定义啊！
你是不是要把函数原型给定义一下呀。之后在用。不明白的话加我QQ121935930，一起看看。

NTSYSAPI
NTSTATUS
NTAPI
NtReadVirtualMemory(

  IN HANDLE               ProcessHandle,
  IN PVOID                BaseAddress,
  OUT PVOID               Buffer,
  IN ULONG                NumberOfBytesToRead,
  OUT PULONG              NumberOfBytesReaded OPTIONAL );

sources 文件中加入 TARGETLIBS=$(DDK_LIB_PATH)\ntdll.lib

感谢指教 可以编译通过了 但我是用monitor加载之后会出现error(127) 找不到指定的程序
请问能为我解惑么

要获得地址的话，给你一个zzage大牛发的函数。

DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)
{
  HANDLE hThread, hSection, hFile, hMod;
  SECTION_IMAGE_INFORMATION sii;
  IMAGE_DOS_HEADER* dosheader;
  IMAGE_OPTIONAL_HEADER* opthdr;
  IMAGE_EXPORT_DIRECTORY* pExportTable;
  DWORD* arrayOfFunctionAddresses;
  DWORD* arrayOfFunctionNames;
  WORD* arrayOfFunctionOrdinals;
  DWORD functionOrdinal;
  DWORD Base, x, functionAddress;
  char* functionName;
  STRING  ntFunctionName, ntFunctionNameSearch;
  PVOID BaseAddress = NULL;
  SIZE_T size=0;
  
  OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};
  IO_STATUS_BLOCK iosb;
  
  ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);
  
  oa.ObjectName = 0;
  
  ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);
  
  ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);
  
  ZwClose(hFile);
  
  hMod = BaseAddress;
  
  dosheader = (IMAGE_DOS_HEADER *)hMod;
  
  opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);
  
  pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);
  
  arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);
  
  arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);
  
  arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);
  
  Base = pExportTable->Base;
  
  RtlInitString(&ntFunctionNameSearch, lpFunctionName);
  
  for(x = 0; x < pExportTable->NumberOfFunctions; x++)
  {
    functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);
   
    RtlInitString(&ntFunctionName, functionName);
   
    functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1;
    functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);
    if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)
    {
      ZwClose(hSection);
      return functionAddress;
    }
  }
  
  ZwClose(hSection);
  return 0;
}

驱动没接触过~

这么问，即使是神，也爱莫能助

路过，支持一下