FunctionAddress = GetDllFunctionAddress("NtUnmapViewOfSection",&DllName);
        pos = *((WORD*)(FunctionAddress+1));
        ntUnmapViewOfSection = (NtUnmapViewOfSection)(KeServiceDescriptorTable->ServiceTableBase[pos]);
        ntUnmapViewOfSection(hProcess,(LPVOID)BaseAddress);

为什么ntUnmapViewOfSection结束不了进程中的模块！
GetDllFunctionAddress函数如下：

DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)
{
        HANDLE hThread, hSection, hFile, hMod;
        SECTION_IMAGE_INFORMATION sii;
        IMAGE_DOS_HEADER* dosheader;
        IMAGE_OPTIONAL_HEADER* opthdr;
        IMAGE_EXPORT_DIRECTORY* pExportTable;
        DWORD* arrayOfFunctionAddresses;
        DWORD* arrayOfFunctionNames;
        WORD* arrayOfFunctionOrdinals;
        DWORD functionOrdinal;
        DWORD Base, x, functionAddress;
        char* functionName;
        STRING ntFunctionName, ntFunctionNameSearch;
        PVOID BaseAddress = NULL;
        SIZE_T size=0;

        OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};

        IO_STATUS_BLOCK iosb;

        //_asm int 3;
        ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);

        oa.ObjectName = 0;

        ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);

        ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);

        ZwClose(hFile);

        hMod = BaseAddress;

        dosheader = (IMAGE_DOS_HEADER *)hMod;

        opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);

        pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);

        // now we can get the exported functions, but note we convert from RVA to address
        arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);

        arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);

        arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);

        Base = pExportTable->Base;

        RtlInitString(&ntFunctionNameSearch, lpFunctionName);

        for(x = 0; x < pExportTable->NumberOfFunctions; x++)
        {
                functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);

                RtlInitString(&ntFunctionName, functionName);

                functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0
                // this is the funny bit. you would expect the function pointer to simply be arrayOfFunctionAddresses[x]...
                // oh no... thats too simple. it is actually arrayOfFunctionAddresses[functionOrdinal]!!
                functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);
                if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)
                {
                        ZwClose(hSection);
                        return functionAddress;
                }
        }

        ZwClose(hSection);
        return 0;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)