function NewNtCreateUserProcess(a,b:PHANDLE;c,d:ACCESS_MASK;e,f:PVOID;g,h:ulong;i,j,k:pointer): NTSTATUS; stdcall;
type
TNewZwCreateUserProcess =function (a,b:PHANDLE;c,d:ACCESS_MASK;e,f:PVOID;g,h:ulong;i,j,k:pointer): NTSTATUS; stdcall;
var
ProcessInfo: _PROCESS_BASIC_INFORMATION;
BaseAddr:pointer;
zpid:cardinal;
begin
unhook;

BaseAddr:=GetProcAddress(GetModuleHandle(Pansichar('ntdll.dll')),Pansichar('NtCreateUserProcess'));
Result :=TNewZwCreateUserProcess(BaseAddr)(a,b,c,d,e,f,g,h,i,j,k);

ZwQueryInformationProcess(a^, ProcessBasicInformation,
@ProcessInfo,
SizeOf(_PROCESS_BASIC_INFORMATION), nil);
AttachToProcess('','E:\k.dll',ProcessInfo.UniqueProcessId);
end;

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课