能力值：
( LV2，RANK：10 )
|
-
-
2 楼
在网上查了一下,解决了这个问题了 http://bbs.byr.cn/#!article/Security/6828
发现 该进程EPROCESS偏移0c4h处的_HANDLE_TABLE .
_HANDLE_TABLE +0x4 就是 进程的基地
VOID LoadExeRoutine (
IN HANDLE hParentId, IN HANDLE PId,IN BOOLEAN bCreate
)
{
PEPROCESS EProcess;
NTSTATUS status;
status = PsLookupProcessByProcessId( (ULONG)PId, &EProcess);
if (!NT_SUCCESS( status ))
{
DbgPrint("PsLookupProcessByProcessId()\n");
return ;
}
if ( bCreate )
{
if( _stricmp((char *)((ULONG)(EProcess)+0x174),"Client.exe")==TRUE)
{
ULONG aa =*(ULONG*)((ULONG)EProcess+0x0c4);
KdPrint(("Client的基地址为%x \n",*(ULONG*)(aa+4)));
DbgPrint(("\n\n+++++++++++++++++++++++++++++++Client.exe++++++++++++++++++++++++++\n\n"));
}
}
return;
} 用windbg 验证了一下
PROCESS 83621da0 SessionId: 0 Cid: 0514 Peb: 7ffdb000 ParentCid: 06ac
DirBase: 1418e000 ObjectTable: e1877760 HandleCount: 494.
Image: Client.exe
这是调试的信息:
Client的基地址为83621da0 +++++++++++++++++++++++++++++++Client.exe++++++++++++++++++++++++++
|
|
|
