-
-
[求助]获取不了驱动对象，有代码
-
发表于:
2009-5-12 15:07
4841
-
GetDriverObject proc
local oa:OBJECT_ATTRIBUTES
local iosb:IO_STATUS_BLOCK
local hFile:HANDLE
local lpObj:HANDLE
pushad
InitializeObjectAttributes addr oa,$CCOUNTED_UNICODE_STRING ("\\??\\xxx.sys"),OBJ_CASE_INSENSITIVE + OBJ_KERNEL_HANDLE,NULL,NULL
invoke ZwCreateFile,addr hFile,0001f01ffh,addr oa,addr iosb,0,000000080h,000000007h,000000003h,000000020h,0,0
invoke ObReferenceObjectByHandle,hFile,0,0,KernelMode,addr lpObj,0
invoke ZwClose,hFile
popad
mov eax,lpObj
ret
GetDriverObject endp
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
