-
-
[求助]win10 KiFastSystemCall
-
发表于:
2015-11-8 09:52
4121
-
[求助]win10 KiFastSystemCall
75898240 > B8 54130400 mov eax,0x41354 ; ClipCursor
75898245 BA 80AC8975 mov edx,user32.7589AC80
7589824A FFD2 call edx
7589824C C2 0400 retn 0x4
7589AC80 64:8B15 30000000 mov edx,dword ptr fs:[0x30]
7589AC87 8B92 54020000 mov edx,dword ptr ds:[edx+0x254]
7589AC8D F7C2 02000000 test edx,0x2
7589AC93 74 03 je Xuser32.7589AC98
7589AC95 CD 2E int 0x2E
7589AC97 C3 retn
7589AC98 EA 9FAC8975 3300 jmp far 0033:7589AC9F
7770AF00 > 8BD4 mov edx,esp ; KiFastSystemCall
7770AF02 0F34 sysenter
7770AF04 8DA424 00000000 lea esp,dword ptr ss:[esp]
7770AF0B EB 03 jmp Xntdll.KiFastSystemCallRet
7770AF0D CC int3
7770AF0E CC int3
7770AF0F CC int3
7770AF10 > C3 retn
int 0x2E下断也不会断下,谁知道这是什么情况么?
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课