-
-
[旧帖]
hook NtCreateEvent被检测 模拟函数头5个字节也不行咋办
0.00雪花
-
发表于:
2015-12-26 20:23
3187
-
[旧帖] hook NtCreateEvent被检测 模拟函数头5个字节也不行咋办
0.00雪花
NewAddr.Addr1 :=$8B55FF8B;
NewAddr.JmpCode1:=$5DEC;
NewAddr.MovEax:=$68;
NewAddr.Addr:=DWORD(NewFunc);
NewAddr.JmpCode:=$00C3;
{ NewAddr.MovEax:=$68;
NewAddr.Addr:=DWORD(NewFunc);
NewAddr.JmpCode:=$00C3; }
// NewAddr.MovEax:=$E9;
// NewAddr.Addr:=DWORD(NewFunc);
// NewAddr.JmpCode:=$0093;
这三个头都实验了还是被检测 怎么办啊
[课程]Android-CTF解题方法汇总！
