|
|
|---|---|
|
|
 把ntdll.dll丢IDA里就看到了。
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
_ZwOpenProcess@16 proc near
mov eax, 7Ah ; NtOpenProcess mov edx, 7FFE0300h call dword ptr [edx] retn 10h _ZwOpenProcess@16 endp 7A, 看到吗? 
|
|
|
|
|
|
|
