-
-
[求助]这句话如何翻译(加了上文)
-
发表于: 2007-1-12 17:58
-
Does a thread call it and specifies the
query class 5 (SystemProcessInformation;
thxEliCZ) we modify the returned chain of
process information structures.
还有这句
For that purpose we pass the address
of NtDll!NtQuerySystemInformation to the driver which extracts the
Native API ID from there....
query class 5 (SystemProcessInformation;
thxEliCZ) we modify the returned chain of
process information structures.
还有这句
For that purpose we pass the address
of NtDll!NtQuerySystemInformation to the driver which extracts the
Native API ID from there....
|
|
|---|---|
|
|
|
|
|
 谢谢Here things get trickier. Because a ring3 process has nearly no rights we transfer the action to a KMD. At first we hook NtQuerySystemInformation. Does a thread call it and specifies the query class 5 (SystemProcessInformation; thx EliCZ) we modify the returned chain of process information structures. In fact I don't overwrite the whole structure. I enlarge the SYSTEM_PROCESS_INFORMATION.SizeOfBlock structure item of the process block being before the block of our process. 这是上下文 |
|
|
|
