-
-
[原创]360比赛第5题-我的解法
-
发表于:
2008-12-19 14:39
40087
-
这题得了100分哦。
驱动加载后，直接对对IoCreateFile函数进行PATCH,
PATCH前函数为：
00010522 call dword_10804 // 先调用原来的nt!IopCreateFile
00010528 mov [ebp+var_210], eax
0001052E mov eax, [ebp+var_210]
00010534 test eax, eax
00010536 jl short loc_105AD
00010538 mov edx, [esi+8]
0001053B cmp word ptr [edx], 206h
00010540 ja short loc_105AD
00010542 cmp dword ptr [edx+4], 0
00010546 jz short loc_105AD
00010548 cmp word ptr [edx], 0
0001054C jz short loc_105AD
0001054E mov eax, edx
00010550 movzx ecx, word ptr [eax]
00010553 mov esi, [eax+4]
00010556 mov eax, ecx
00010558 shr ecx, 2
0001055B lea edi, [ebp+var_20C]
00010561 rep movsd
00010563 mov ecx, eax
00010565 and ecx, 3
00010568 rep movsb
0001056A movzx eax, word ptr [edx]
0001056D and [ebp+eax+var_20C], 0
00010576 lea eax, [ebp+var_20C]
0001057C push eax ; wchar_t *
0001057D call ds:_wcsupr
00010583 lea eax, [ebp+var_20C]
00010589 mov [esp+220h+var_220], offset a360game360game ;
"360GAME\\360GAME.TXT"
00010590 push eax ; wchar_t *
00010591 call ds:wcsstr
00010597 test eax, eax
00010599 pop ecx
0001059A pop ecx
0001059B jz short loc_105A7
0001059D and dword ptr [ebx], 0
000105A0 mov eax, 0C0000022h
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
·
