-
-
[求助]自己试着写Anti-Trace的代码，调用ZwQueryObject返回失败，提示NO MEMORY
-
发表于:
2014-9-18 20:10
5913
-
[求助]自己试着写Anti-Trace的代码，调用ZwQueryObject返回失败，提示NO MEMORY
调试了很久都没有发现问题，用OLLYDBG调试
GetModuleHandle,GetProcAddress都返回正常
但是调用ZwQueryObject就提示异常C0000017 （NO MEMORY）
这个问题困扰我一天了，希望各位帮帮忙
lea eax,dword ptr [ebx+(NTDLLName-ImpTable_Start)]
push eax
call dword ptr [ebx+(GetModuleHandleAddr-ImpTable_Start)]
.if eax==0
lea eax,dword ptr [ebx+(NTDLLName-ImpTable_Start)]
push eax
call dword ptr [ebx+(LoadLibraryAddr-ImpTable_Start)]
.endif
mov edx,eax
lea esi,dword ptr [ebx+(AntiFuncName1-ImpTable_Start)]
push esi
push edx
call dword ptr [ebx+(GetProcAddressAddr-ImpTable_Start)]
mov edi,eax
lea eax,[ebx+(Buffer-ImpTable_Start)]
push eax
push 0
push 0
push 3
push 0
call edi
sub esp,ss:[ebx]
mov esi,esp ;struct OBJECT_TYPE_INFORMATION
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
