-
-
[求助]PsGetContextThread的问题
-
发表于:
2016-2-4 16:25
9467
-
[求助]PsGetContextThread的问题
UNICODE_STRING ustr;
RtlInitUnicodeString(&ustr, L"PsGetContextThread");
TCONTEXT context = *(PTCONTEXT)inputBuffer;
PSGETCT PsGetContextThread = (PSGETCT)MmGetSystemRoutineAddress(&ustr);
PETHREAD EThread = NULL;
if (NULL != PsGetContextThread)
{
THREAD_BASIC_INFORMATION tbi;
RtlInitUnicodeString(&ustr, L"ZwQueryInformationThread");
PFN_ZwQueryInformationThread ZwQueryInformationThread = (PFN_ZwQueryInformationThread)MmGetSystemRoutineAddress(&ustr);
if (NULL!=ZwQueryInformationThread)
{
ZwQueryInformationThread(context.hThread,
ThreadBasicInformation,
&tbi,
sizeof (tbi),
NULL);
Status = PsLookupThreadByThreadId(tbi.ClientId.UniqueThread, &EThread);
if (EThread != NULL)
{
Status = PsGetContextThread(EThread, &context.Context,UserMode);
DbgPrint("1->EThread:%x\nEax:%x\nEbx:%x\nEcx:%x\nEdx:%x\n",
EThread,
context.Context.Eax,
context.Context.Ebx,
context.Context.Ecx,
context.Context.Edx);
RtlMoveMemory_S(outputBuffer, &context, outputBufferLength);
if (!NT_SUCCESS(Status))
DbgPrint("Error Code:%x\n", Status);
}
else
{
DbgPrint("Can not get EThread:%x\n", Status);
}
}
else
{
DbgPrint("Can not get function addr!2\n");
}
}
else
{
DbgPrint("Can not get function addr!\n");
}
如上述
我在R3Suspend了他 ,之后调用这个函数 FLAG用的是THREAD_GET_CONTEXT
然后他返回的 STATUS 为C0000005 STATUS_ACCESS_VIOLATION
开始我以为是Flag的问题 我就改成了CONTEXT_FULL 同样是返回C0000005
请问这个是什么问题
小白现在这里谢谢大家了
对了 TCONTEXT 结构为
typedef struct _TCONTEXT
{
HANDLE hThread;
CONTEXT Context;
}TCONTEXT, *PTCONTEXT;
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课