SSDT Hook了NtOpenProcess,然后将替换函数写成如下的样子,想尝试下保护千千静听。
结果发现千千的进程可以保护起来,但是声音播放不了了。
又试了试保护其他程序,都可以成功保护,但是这些程序的窗口主题都显示不出来。
求解答。
NTSTATUS
NTAPI NewNtOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId
)
{
NTSTATUS status;
PEPROCESS EProcessToOpen;
PEPROCESS EProcess;
PUCHAR ProcessNameToOpen;
PUCHAR ProcessName;
status = PsLookupProcessByProcessId(
ClientId->UniqueProcess,
&EProcessToOpen
);
if( !NT_SUCCESS(status) ) {
KdPrint(( " SSDT_HOOK NtOpenProcess: NewNtOpenProcess!PsLookupProcessByProcessId" \
" failed with error code: 0x%08X\n", status ));
return status;
}
ProcessNameToOpen = PsGetProcessImageFileName( EProcessToOpen );
EProcess = PsGetCurrentProcess();
ProcessName = PsGetProcessImageFileName( EProcess );
KdPrint(( " SSDT_HOOK NtOpenProcess: %s -> %s\n", ProcessName, ProcessNameToOpen ));
if( RtlCompareMemory(ProcessNameToOpen, "TTPlayer.exe", 12) == 12 ) return STATUS_ACCESS_DENIED;
return OldNtOpenProcess(
ProcessHandle,
DesiredAccess,
ObjectAttributes,
ClientId);
}
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法