ANSI_STRING STRUCT
_Length dd ?
MaximumLength dd ?
Buffer dd ?
ANSI_STRING ENDS
UNICODE_STRING STRUCT
_Length dd ?
MaximumLength dd ?
Buffer dd ?
UNICODE_STRING ENDS
LOCAL @lsls[15]:byte
LOCAL @lpRtlInitAnsiString,@lpRtlAnsiStringToUnicodeString:dword
LOCAL @unstr:UNICODE_STRING
LOCAL @anstr:ANSI_STRING
invoke RtlZeroMemory,addr @anstr,sizeof ANSI_STRING
invoke RtlZeroMemory,addr @lsls,15
invoke LoadLibrary,CTEXT("ntdll.dll")
invoke GetProcAddress,eax,CTEXT("RtlInitAnsiString")
mov @lpRtlInitAnsiString,eax
invoke LoadLibrary,CTEXT("ntdll.dll")
invoke GetProcAddress,eax,CTEXT("RtlAnsiStringToUnicodeString")
mov @lpRtlAnsiStringToUnicodeString,eax
invoke RtlMoveMemory,addr @lsls,CTEXT("c:\spoolsv.exe"),15
lea eax,@lsls
push eax
lea eax,@anstr
push eax
call @lpRtlInitAnsiString
invoke MessageBox,0,addr @anstr.Buffer,addr @anstr.Buffer,MB_OK ;为什么我就添冲了ansi结构就不对了呢,晕.
[课程]Linux pwn 探索篇!