function GetThreadProcAddress(ProcId, ThreadId: DWORD): DWORD;
const
THREAD_ALL_ACCESS = $001F03FF;
var
hThread: DWORD;
hProc: DWORD;
Rtn: DWORD;
ThreadInfo: THREAD_BASIC_INFORMATION;
p: Pointer;
begin
Result := 0;
hProc := OpenProcess(PROCESS_ALL_ACCESS, false, ProcId);
hThread := OpenThread(THREAD_ALL_ACCESS, false, ThreadId);
if (hProc = 0) or (hThread = 0) then Exit;
try
ZeroMemory(@ThreadInfo, SizeOf(ThreadInfo));
NtQueryInformationThread(hThread, ThreadBasicInformation, @ThreadInfo, SizeOf(ThreadInfo), @Rtn);
p := ThreadInfo.TebBaseAddress;
while true do
begin
ReadProcessMemory(hProc, p, @Result, SizeOf(DWORD), Rtn);
if Result <> $FFFFFFFF then
p := Pointer(Result)
else
Break;
end;
ReadProcessMemory(hProc, Pointer(dword(p) + SizeOf(DWORD) * 6), @Result, SizeOf(DWORD), Rtn);
form1.memo1.Lines.Add('ThreadProc: ' + inttostr(ThreadInfo.ClientId.UniqueProcess));
finally
CloseHandle(hProc);
CloseHandle(hThread);
end;
end;
上面的代码总是调试不成功,哪个朋友帮我看下要怎么弄呢?
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)