text:00441FED push 'aCmM' ; Tag
.text:00441FF2 push 68h
; NumberOfBytes [FONT=宋体]为[/FONT] sizeof(CONTROL_AREA) + sizeof(MSUBSECTION)
.text:00441FF4 push esi ; PoolType
.text:00441FF5 call _ExAllocatePoolWithTag@12 ; ExAllocatePoolWithTag(x,x,x)
.text:0044208F lea eax, [ebp+var_GlobalNeeded]
.text:00442092 push eax ; GlobalNeeded
.text:00442093 push 1 ; PfnLockHeld
.text:00442095 push [ebp+var_pFileObject] ; File
.text:00442098 call _MiFindImageSectionObject@12 ;
text:00442225 push [ebp+var_NewControlArea] ; InputControlArea
.text:00442228 push [ebp+var_ChangeFileReference_pFO] ; File
.text:0044222B call _MiInsertImageSectionObject@8 ; MiInsertImageSectionObject(x,x)
text:0044238C cmp [ebp+var_AllocationAttributes], esi
.text:0044238F lea eax, [ebp+Segment]
.text:00442392 jz short var_AllocationAttributes_is_0 ; [FONT=宋体]对于可执行文件，跳转不成功[/FONT]
.text:00442394 push eax ; _SEGMENT **
.text:00442395 push [ebp+var_ChangeFileReference_pFO] ; _FILE_OBJECT *
.text:00442398 call _MiCreateImageFileMap@8 ; MiCreateImageFileMap(x,x)
.text:0044239D jmp short loc_4423B4
.text:0044239F ; ---------------------------------------------------------------------------
.text:0044239F var_AllocationAttributes_is_0:
.text:0044239F push [ebp+var_IgnoreFileSizing] ; IgnoreFileSizing
.text:004423A2 push dword ptr [ebp+1Ch] ; AllocationAttributes
.text:004423A5 push [ebp+arg_SectionPageProtection] ; SectionPageProtection
.text:004423A8 push [ebp+arg_pInputMaximumSize] ; MaximumSize
.text:004423AB push eax ; Segment
.text:004423AC push [ebp+var_ChangeFileReference_pFO] ; File
.text:004423AF call _MiCreateDataFileMap@24 ; MiCreateDataFileMap(x,x,x,x,x,x)
.text:004423B4 loc_4423B4:
[FONT=宋体]PAGE:004F8426 push eax ; FileSize[/FONT]
[FONT=宋体]PAGE:004F8427 push [ebp+arg_pfobFile] ; FileObject[/FONT]
[FONT=宋体]PAGE:004F842A xor esi, esi[/FONT]
[FONT=宋体]PAGE:004F842C inc esi[/FONT]
[FONT=宋体]PAGE:004F842D xor edi, edi[/FONT]
[FONT=宋体]PAGE:004F842F mov [ebp+var_MarkModified], esi[/FONT]
[FONT=宋体]PAGE:004F8435 mov [ebp+var_MarkHeaderModified], edi[/FONT]
[FONT=宋体]PAGE:004F8438 call _FsRtlGetFileSize@8 ; FsRtlGetFileSize(x,x)[/FONT]
[FONT=宋体]PAGE:004F84B9 mov ecx, dword ptr _MmPfnDatabase[/FONT]
[FONT=宋体]PAGE:004F84C2 mov ebx, eax ; eax = PageFrameNumber[/FONT]
[FONT=宋体]PAGE:004F84C4 lea eax, [ebx+ebx*2][/FONT]
[FONT=宋体]PAGE:004F84C7 lea eax, [ecx+eax*8] [/FONT]
[FONT=宋体]PAGE:004F84CA mov [ebp+var_Pfn1], eax[/FONT]
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
