function NewNtCreateUserProcess(a,b:PHANDLE;c,d:ACCESS_MASK;e,f:PVOID;g,h:ulong;i,j,k:pointer): NTSTATUS; stdcall;
type
TNewZwCreateUserProcess =function (a,b:PHANDLE;c,d:ACCESS_MASK;e,f:PVOID;g,h:ulong;i,j,k:pointer): NTSTATUS; stdcall;
var
ProcessInfo: _PROCESS_BASIC_INFORMATION;
BaseAddr:pointer;
zpid:cardinal;
begin
unhook;

BaseAddr:=GetProcAddress(GetModuleHandle(Pansichar('ntdll.dll')),Pansichar('NtCreateUserProcess'));
Result :=TNewZwCreateUserProcess(BaseAddr)(a,b,c,d,e,f,g,h,i,j,k);

ZwQueryInformationProcess(a^, ProcessBasicInformation,
@ProcessInfo,
SizeOf(_PROCESS_BASIC_INFORMATION), nil);
AttachToProcess('','E:\k.dll',ProcessInfo.UniqueProcessId);
end;

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)