-
-
[己解决]关于HOOK NtReadVirtualMemory
-
发表于:
2012-2-5 09:40
6250
-
[己解决]关于HOOK NtReadVirtualMemory
已经成功HOOK了,但是我想输出BaseAddress和BufferLength值不对。。。
我记得好像这些是内核地址,怎么转换才能正确输出。
#pragma PAGEDCODE
extern "C" NTSTATUS __declspec(naked) __stdcall HookNtReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL
)
{
KdPrint(("=== Addr:%d Size:%d ===", (int*)BaseAddress, (int*)BufferLength));
__asm
{
push 0x1c
push 0x804daef0
mov eax, pfnRealNtReadVirtualMemory add eax, 7
jmp eax
}
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课