|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
强人那!
我拜! 
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
现在不行了．．．就算进入游戏的进程，也不能读游戏内存．．但是我在测试的过程中，dll进入游戏进程后，OpenProcess打开游戏进程还是成功的．．ReadProcessMemoery这个函数就不成功了，貌似是因为NP在r0下做了手脚．.ReadVirtualMemory实际上调用NtReadVirtualMemory：
.text:7C8021CC ReadProcessMemory proc near ; CODE XREF: GetProcessVersion+2F2FDp .text:7C8021CC ; GetProcessVersion+2F31Cp .text:7C8021CC ; GetProcessVersion+2F343p .text:7C8021CC ; Toolhelp32ReadProcessMemory+26p .text:7C8021CC .text:7C8021CC hProcess = dword ptr 8 .text:7C8021CC lpBaseAddress = dword ptr 0Ch .text:7C8021CC lpBuffer = dword ptr 10h .text:7C8021CC nSize = dword ptr 14h .text:7C8021CC lpNumberOfBytesRead= dword ptr 18h .text:7C8021CC .text:7C8021CC mov edi, edi .text:7C8021CE push ebp .text:7C8021CF mov ebp, esp .text:7C8021D1 lea eax, [ebp+nSize] .text:7C8021D4 push eax .text:7C8021D5 push [ebp+nSize] .text:7C8021D8 push [ebp+lpBuffer] .text:7C8021DB push [ebp+lpBaseAddress] .text:7C8021DE push [ebp+hProcess] .text:7C8021E1 call ds:NtReadVirtualMemory NtReadVirtualMemory： NtReadVirtualMemory proc near ; CODE XREF: LdrFindCreateProcessManifest+1CCp .text:7C92E2BB ; LdrCreateOutOfProcessImage+7Cp .text:7C92E2BB ; RtlReadOutOfProcessMemoryStream+2Ep .text:7C92E2BB ; LdrFindCreateProcessManifest+1612Fp .text:7C92E2BB ; LdrFindCreateProcessManifest+1691Ep .text:7C92E2BB ; LdrFindCreateProcessManifest+1697Bp ... .text:7C92E2BB mov eax, 0BAh ; NtReadVirtualMemory .text:7C92E2C0 mov edx, 7FFE0300h .text:7C92E2C5 call dword ptr [edx] .text:7C92E2C7 retn 14h .text:7C92E2C7 .text:7C92E2C7 NtReadVirtualMemory endp 最后他还是要进ring0．．．不知道恢复ssdt，ReadVirtualMemory能否读游戏内存？
|
|
|
好文，顶顶
|
|
|
|
|
|
|
|
|
|
|
|
|
