-
-
R3下HOOK NTQueryObject问题
-
发表于:
2012-12-24 15:45
5158
-
在R3下 HOOK NTQueryObject mov eax,0xa3位置下做hook 一直返回0XC00005 搞不懂哪错了 大神看下 有SRC
NTSTATUS __stdcall New_NtQueryObject(
HANDLE ObjectHandle,
OBJECT_INFORMATION_CLASS ObjectInformationClass,
PVOID ObjectInformation,
ULONG ObjectInformationLength,
PULONG ReturnLength
)
{
NTSTATUS ret_value=1;
POBJECT_NAME_INFORMATION Object_name;
__asm
{
/*push ReturnLength
push ObjectInformationLength
push ObjectInformation
push ObjectInformationClass
push ObjectHandle*/
mov eax,0xa3
mov edx,0x7FFE0300
mov edx,[edx]
call edx
mov ret_value,eax
//add esp,0x14
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课