能力值：
( LV2，RANK：10 )
|
-
-
2 楼
shell之类的都可以吧
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
ADVAPI32.CreateProcessAsUserW
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
囧. 原来已经有人回了. 我后来自己试出来了. 最开始也打了这个断点的. 有可能是拼写错误了.
我打的NtCreateProcessEx 堆栈如下.
0:011> kb
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
04c5f51c 77dba96c 00000454 055ed660 003f7f38 ntdll!NtCreateProcessEx
04c5f570 0040e684 00000454 055ed660 003f7f38 ADVAPI32!CreateProcessAsUserW+0xc3
04c5f8b0 004467f4 003f0000 003f7e48 0000002c chrome!sandbox::TargetProcess::Create+0xc4 [d:\chrome\src\sandbox\src\target_process.cc @ 172]
04c5f8d4 0040eac9 ff936a98 0040a28d 055ed660 chrome!malloc+0x79 [f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.c @ 163]
04c5f94c 01c49d97 01232ec4 01c4b523 00000060 chrome!sandbox::PolicyBase::GetAlternateDesktop+0x69 [d:\chrome\src\sandbox\src\sandbox_policy_base.cc @ 166]
04c5f954 01c4b523 00000060 00000007 04c5fa20 chrome_1c30000!tcmalloc::ThreadCache::Allocate+0x47
04c5f968 01c4bad1 00000060 01c4bb5a 00000060 chrome_1c30000!`anonymous namespace'::do_malloc+0xc3
04c5f970 01c4bb5a 00000060 01c4bbcc 00000060 chrome_1c30000!malloc+0x31
04c5f978 01c4bbcc 00000060 00000000 00000056 chrome_1c30000!generic_cpp_alloc+0xa
04c5f990 01c368a3 055ed660 055ed960 00000056 chrome_1c30000!operator new+0xc
04c5f9ac 01c334c3 055ed660 0000005e 055ed960 chrome_1c30000!memcpy_s+0x4a [f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c @ 67]
04c5fa94 77da8633 0015ada4 77da863c 0015ad8c chrome_1c30000!std::basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t> >::assign+0xd3
04c5fa9c 77da863c 0015ad8c 77e162f8 04c5fc08 ADVAPI32!SystemFunction036+0x391
|
|
|
|
