-
-
[原创]浅谈之重读老文章之那些年我们追过的gdt hook
-
发表于:
2014-4-27 02:22
9317
-
[原创]浅谈之重读老文章之那些年我们追过的gdt hook
typedef struct CALLGATE_DESCRIPTOR
{
USHORT offset_0_15; (2)
USHORT selector;
UCHAR param_count : 4;
UCHAR some_bits : 4;
UCHAR type : 4;
UCHAR app_system : 1;
UCHAR dpl : 2;
UCHAR present : 1;
USHORT offset_16_31(3);
ULONG Gdtbase()
{
char gdt[6] ;
ULONG base;
__asm sgdt gdt;
base=*(ULONG *)(&gdt[2]);
DbgPrint("base 0x%x\n",base);
return base;
}
CALLGATE_DESCRIPTOR cg;
cg.selector=0x8;
cg.param_count=0;
cg.type=0x3;
cg.dpl=0x3;
cg.offset_0_15=0xffff&Address;
cg.offset_16_31=Address>>16;
return cg;
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
