-
-
[求助]WIN7 32位HOOK KiDispatchException,关闭了页保护,走到 lock cmpxchg8b qword ptr ss : [esi] 这条语句就无法单步继续执行了
-
发表于:
2022-4-26 18:23
5014
-
[求助]WIN7 32位HOOK KiDispatchException,关闭了页保护,走到 lock cmpxchg8b qword ptr ss : [esi] 这条语句就无法单步继续执行了
BOOLEAN addHookHooKE8OrE9Struct(PHooKE8OrE9Struct hkf)
{
if (hkf->isHookSuccess)
return TRUE;
memcpy(hkf->code, (PVOID)hkf->oldHookAddress, hkf->len);
UCHAR code[8] = {0xe9};
ULONG address = calcE8OrE9(hkf->oldHookAddress, hkf->newHookAddress);
(ULONG)(code + 1) = address;
memcpy(code + 5, (PVOID)(hkf->oldHookAddress + 5), 3);
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | KIRQL irql = KeRaiseIrqlToDpcLevel();
writeProbOff();
__asm
{
cli;
mov edi, [hkf];
mov esi, [edi + 4];
mov ecx, dword ptr ss : [code + 4] ;
mov ebx, dword ptr ss : [code] ;
mov eax, [edi + 0xC];
mov edx, [edi + 0x10];
lock cmpxchg8b qword ptr ss : [esi] ;
cmp[esi], 0xe9
jnz __exit;
mov eax, 1;
mov[edi + 0x18], eax;
__exit:
sti;
}
writeProbNo();
KfLowerIrql(irql);
if (hkf->isHookSuccess)
{
insertListTail(&gHookE8OrE9Struct.listEntry, &hkf->listEntry);
return TRUE;
}
ExFreePoolWithTag(hkf, 'hic');
return FALSE;
|
}
[培训]科锐软件逆向54期预科班、正式班开始火爆招生报名啦！！！
hzqst
