|
|
|---|---|
|
|
求沟通，求交流.....
 if(dwAddress == 0 || dwAddress == 0xFFFFFFFF) return NULL; dwAddress += 0x1B0; //peb if((dwAddress = *(DWORD*)dwAddress) == 0) return 0; dwAddress += 0x10; // +0x010 ProcessParameters if((dwAddress = *(DWORD*)dwAddress) == 0) return 0; dwAddress1 = dwAddress;//2000 dwAddress += 0x3C; if((dwAddress = *(DWORD*)dwAddress) == 0) return 0; if (dwAddress < dwAddress1) dwAddress = dwAddress + dwAddress1; return (PCWSTR)dwAddress; //通过peb -> ProcessParameters->硬编码：0x3c 得到路径后...if (dwAddress < dwAddress1) dwAddress = dwAddress + dwAddress1; 你这句为何 获取2000下的么...? |
|
|
|
|
|
惭愧啊， 参考了看雪上某些大牛的源码， 没改就直接用了， 在XP下有些代码可以直接删了的。
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
开源好样的，哈哈
|
|
|
|
|
|
谢谢看下
|
|
|
|
|
|
|
|
|
|
|
|
|
