-
-
R3下HOOK NTQueryObject问题
-
发表于:
2012-12-24 15:45
5168
-
在R3下 HOOK NTQueryObject mov eax,0xa3位置下做hook 一直返回0XC00005 搞不懂哪错了 大神看下 有SRC
NTSTATUS __stdcall New_NtQueryObject(
HANDLE ObjectHandle,
OBJECT_INFORMATION_CLASS ObjectInformationClass,
PVOID ObjectInformation,
ULONG ObjectInformationLength,
PULONG ReturnLength
)
{
NTSTATUS ret_value=1;
POBJECT_NAME_INFORMATION Object_name;
__asm
{
/*push ReturnLength
push ObjectInformationLength
push ObjectInformation
push ObjectInformationClass
push ObjectHandle*/
mov eax,0xa3
mov edx,0x7FFE0300
mov edx,[edx]
call edx
mov ret_value,eax
//add esp,0x14
}
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)