-
-
[求助]这是什么结构？
-
发表于:
2019-5-30 19:52
3361
-
//获得KTHREAD
DbgPrint("curProc:%p\n", curProc);
pRet = (PULONGLONG)((ULONGLONG)curProc + 0x308);
pThread = (PETHREAD)(*pRet - 0x428);
DbgPrint("pThread:%p\n", pThread);
//获得KTRAP_FRAME结构
pX64TrapFrame = (PULONGLONG)((ULONGLONG)pThread + 0x1d8);
DbgPrint("pX64TrapFrame:%p\n", pX64TrapFrame);
//获得pRsi寄存器
pRsi = (PULONGLONG)(*pX64TrapFrame + 0x150);
//获得OEP
pRsi = (PULONGLONG)(*pRsi + 0x7B0); // 这个加上7B0等于OEP是什么意思？
DbgPrint("pRsi:%p\n", pRsi);
pOEP = (PULONGLONG)*pRsi;
DbgPrint("pOEP:%p\n", pOEP);
*pRsi = (ULONGLONG)pBuf;
DbgPrint("pBuf:%p\n", pBuf);
这个加上7B0等于OEP（这个是入口）是什么结构？哪位大神能说一下吗？
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
最后于 2019-5-30 19:54
被cheating编辑
，原因：
