-
-
未解决
[求助]怎样在内核下获取当前活动的窗口
-
发表于:
2019-12-24 11:36
3405
-
通过自己分析和查找资料发现可以使用NtUserGetThreadState函数
ULONG_PTR NtUserGetThreadState(ULONG ThreadState)
{
PVOID ThreadStateProcAddr = NULL;
ThreadStateProcAddr = GetShadowSSDTProcAddr(0x3);
KdPrint(("NtUserGetThreadState的地址为%p\n", ThreadStateProcAddr));
NTSTATUS status;
PRKAPC_STATE apcState;
PEPROCESS eprocess;
status = PsLookupProcessByProcessId((HANDLE)GetPidByProcName((PWCHAR)L"csrss.exe"), &eprocess);
if (!NT_SUCCESS(status))
{
return NULL;
}
apcState = (PRKAPC_STATE)ExAllocatePool(NonPagedPool, sizeof(KAPC_STATE));
KeStackAttachProcess((PRKPROCESS)eprocess, apcState);
// 这里蓝屏,在获取当前线程信息时,rax返回为0,所以在返回句柄时出现内存访问错误
ULONG_PTR hActiveWindow = ((pfNtUserGetThreadState)ThreadStateProcAddr)(ThreadState);
KeUnstackDetachProcess(apcState);
ExFreePool(apcState);
ObDereferenceObject(eprocess);
return hActiveWindow;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
DriverObject->DriverUnload = DriverUnload;
status = STATUS_SUCCESS;
HANDLE hActiveWindow = (HANDLE)NtUserGetThreadState(1);
KdPrint(("驱动加载\n"));
return status;
}
调试发现在NtUserGetThreadState函数内部,在获取当前线程信息时返回为0,之后造成内存访问出错蓝屏
我觉得可能是我这个函数不会用,请教下该如何使用
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
最后于 2019-12-24 11:37
被TopC编辑
,原因: