这个驱动保护的,请问怎么改能屏蔽掉它啊 EagleNT.sys
b6a72410 55 push ebp
b6a72411 8bec mov ebp,esp
b6a72413 83ec14 sub esp,14h
b6a72416 c645fb01 mov byte ptr [ebp-5],1
b6a7241a c645ef00 mov byte ptr [ebp-11h],0
b6a7241e c745fc00000000 mov dword ptr [ebp-4],0
b6a72425 b924b2a7b6 mov ecx,0B6A7B224h
b6a7242a ff153083a7b6 call dword ptr ds:[0B6A78330h]
b6a72430 e891430000 call b6a767c6
b6a72435 8945f0 mov dword ptr [ebp-10h],eax
b6a72438 833d64b2a7b600 cmp dword ptr ds:[0B6A7B264h],0
b6a7243f 0f8e82000000 jle b6a724c7
b6a72445 833da837a8b602 cmp dword ptr ds:[0B6A837A8h],2
b6a7244c 7479 je b6a724c7
b6a7244e 6a20 push 20h
b6a72450 8b45f0 mov eax,dword ptr [ebp-10h]
b6a72453 50 push eax
b6a72454 68203ba8b6 push 0B6A83B20h
b6a72459 e88278ffff call b6a69ce0
b6a7245e 0fb6c8 movzx ecx,al
b6a72461 83f901 cmp ecx,1
b6a72464 7519 jne b6a7247f
b6a72466 833da837a8b600 cmp dword ptr ds:[0B6A837A8h],0
b6a7246d 7506 jne b6a72475
b6a7246f c645fb00 mov byte ptr [ebp-5],0
b6a72473 eb08 jmp b6a7247d
b6a72475 c645fb01 mov byte ptr [ebp-5],1
b6a72479 c645ef01 mov byte ptr [ebp-11h],1
b6a7247d eb48 jmp b6a724c7
b6a7247f 6a10 push 10h
b6a72481 8b55f0 mov edx,dword ptr [ebp-10h]
b6a72484 52 push edx
b6a72485 e836240000 call b6a748c0
b6a7248a 0fb6c0 movzx eax,al
b6a7248d 83f801 cmp eax,1
b6a72490 7506 jne b6a72498
b6a72492 c645fb00 mov byte ptr [ebp-5],0
b6a72496 eb2f jmp b6a724c7
b6a72498 6a10 push 10h
b6a7249a ff154483a7b6 call dword ptr ds:[0B6A78344h]
b6a724a0 50 push eax
b6a724a1 e850250000 call b6a749f6
b6a724a6 8845fb mov byte ptr [ebp-5],al
b6a724a9 0fb64dfb movzx ecx,byte ptr [ebp-5]
b6a724ad 83f901 cmp ecx,1
b6a724b0 7411 je b6a724c3
b6a724b2 6a10 push 10h
b6a724b4 8b55f0 mov edx,dword ptr [ebp-10h]
b6a724b7 52 push edx
b6a724b8 e8d3210000 call b6a74690
b6a724bd c645fb00 mov byte ptr [ebp-5],0
b6a724c1 eb04 jmp b6a724c7
b6a724c3 c645ef01 mov byte ptr [ebp-11h],1
b6a724c7 0fb645fb movzx eax,byte ptr [ebp-5]
b6a724cb 83f801 cmp eax,1
b6a724ce 0f8586000000 jne b6a7255a
b6a724d4 8b4d10 mov ecx,dword ptr [ebp+10h]
b6a724d7 51 push ecx
b6a724d8 8b550c mov edx,dword ptr [ebp+0Ch]
b6a724db 52 push edx
b6a724dc 8b4508 mov eax,dword ptr [ebp+8]
b6a724df 50 push eax
b6a724e0 ff15c037a8b6 call dword ptr ds:[0B6A837C0h]
b6a724e6 8945fc mov dword ptr [ebp-4],eax
b6a724e9 837dfc00 cmp dword ptr [ebp-4],0
b6a724ed 746b je b6a7255a
b6a724ef 0fb64def movzx ecx,byte ptr [ebp-11h]
b6a724f3 83f901 cmp ecx,1
b6a724f6 7562 jne b6a7255a
b6a724f8 c745f400000000 mov dword ptr [ebp-0Ch],0
b6a724ff eb09 jmp b6a7250a
b6a72501 8b55f4 mov edx,dword ptr [ebp-0Ch]
b6a72504 83c201 add edx,1
b6a72507 8955f4 mov dword ptr [ebp-0Ch],edx
b6a7250a 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a7250d 3b45fc cmp eax,dword ptr [ebp-4]
b6a72510 7348 jae b6a7255a
b6a72512 8b4df4 mov ecx,dword ptr [ebp-0Ch]
b6a72515 6bc91c imul ecx,ecx,1Ch
b6a72518 8b550c mov edx,dword ptr [ebp+0Ch]
b6a7251b 833c0a01 cmp dword ptr [edx+ecx],1
b6a7251f 7515 jne b6a72536
b6a72521 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a72524 6bc01c imul eax,eax,1Ch
b6a72527 8b4d0c mov ecx,dword ptr [ebp+0Ch]
b6a7252a 8d540104 lea edx,[ecx+eax+4]
b6a7252e 52 push edx
b6a7252f e8fcbbffff call b6a6e130
b6a72534 eb22 jmp b6a72558
b6a72536 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a72539 6bc01c imul eax,eax,1Ch
b6a7253c 8b4d0c mov ecx,dword ptr [ebp+0Ch]
b6a7253f 833c0100 cmp dword ptr [ecx+eax],0
b6a72543 7513 jne b6a72558
b6a72545 8b55f4 mov edx,dword ptr [ebp-0Ch]
b6a72548 6bd21c imul edx,edx,1Ch
b6a7254b 8b450c mov eax,dword ptr [ebp+0Ch]
b6a7254e 8d4c1004 lea ecx,[eax+edx+4]
b6a72552 51 push ecx
b6a72553 e838bcffff call b6a6e190
b6a72558 eba7 jmp b6a72501
b6a7255a b924b2a7b6 mov ecx,0B6A7B224h
b6a7255f ff153483a7b6 call dword ptr ds:[0B6A78334h]
b6a72565 8b45fc mov eax,dword ptr [ebp-4]
b6a72568 8be5 mov esp,ebp
b6a7256a 5d pop ebp
b6a7256b c20c00 ret 0Ch
lkd> uf b6a767c6
nt!PsGetCurrentProcessId:
8052b3c2 64a124010000 mov eax,dword ptr fs:[00000124h]
8052b3c8 8b80ec010000 mov eax,dword ptr [eax+1ECh]
8052b3ce c3 ret
b6a767c6 ff25d483a7b6 jmp dword ptr ds:[0B6A783D4h]
lkd> uf 0xb6a72410
b6a72410 55 push ebp
b6a72411 8bec mov ebp,esp
b6a72413 83ec14 sub esp,14h
b6a72416 c645fb01 mov byte ptr [ebp-5],1
b6a7241a c645ef00 mov byte ptr [ebp-11h],0
b6a7241e c745fc00000000 mov dword ptr [ebp-4],0
b6a72425 b924b2a7b6 mov ecx,0B6A7B224h
b6a7242a ff153083a7b6 call dword ptr ds:[0B6A78330h]
b6a72430 e891430000 call b6a767c6
b6a72435 8945f0 mov dword ptr [ebp-10h],eax
b6a72438 833d64b2a7b600 cmp dword ptr ds:[0B6A7B264h],0
b6a7243f 0f8e82000000 jle b6a724c7
b6a72445 833da837a8b602 cmp dword ptr ds:[0B6A837A8h],2
b6a7244c 7479 je b6a724c7
b6a7244e 6a20 push 20h
b6a72450 8b45f0 mov eax,dword ptr [ebp-10h]
b6a72453 50 push eax
b6a72454 68203ba8b6 push 0B6A83B20h
b6a72459 e88278ffff call b6a69ce0
b6a7245e 0fb6c8 movzx ecx,al
b6a72461 83f901 cmp ecx,1
b6a72464 7519 jne b6a7247f
b6a72466 833da837a8b600 cmp dword ptr ds:[0B6A837A8h],0
b6a7246d 7506 jne b6a72475
b6a7246f c645fb00 mov byte ptr [ebp-5],0
b6a72473 eb08 jmp b6a7247d
b6a72475 c645fb01 mov byte ptr [ebp-5],1
b6a72479 c645ef01 mov byte ptr [ebp-11h],1
b6a7247d eb48 jmp b6a724c7
b6a7247f 6a10 push 10h
b6a72481 8b55f0 mov edx,dword ptr [ebp-10h]
b6a72484 52 push edx
b6a72485 e836240000 call b6a748c0
b6a7248a 0fb6c0 movzx eax,al
b6a7248d 83f801 cmp eax,1
b6a72490 7506 jne b6a72498
b6a72492 c645fb00 mov byte ptr [ebp-5],0
b6a72496 eb2f jmp b6a724c7
b6a72498 6a10 push 10h
b6a7249a ff154483a7b6 call dword ptr ds:[0B6A78344h]
b6a724a0 50 push eax
b6a724a1 e850250000 call b6a749f6
b6a724a6 8845fb mov byte ptr [ebp-5],al
b6a724a9 0fb64dfb movzx ecx,byte ptr [ebp-5]
b6a724ad 83f901 cmp ecx,1
b6a724b0 7411 je b6a724c3
b6a724b2 6a10 push 10h
b6a724b4 8b55f0 mov edx,dword ptr [ebp-10h]
b6a724b7 52 push edx
b6a724b8 e8d3210000 call b6a74690
b6a724bd c645fb00 mov byte ptr [ebp-5],0
b6a724c1 eb04 jmp b6a724c7
b6a724c3 c645ef01 mov byte ptr [ebp-11h],1
b6a724c7 0fb645fb movzx eax,byte ptr [ebp-5]
b6a724cb 83f801 cmp eax,1
b6a724ce 0f8586000000 jne b6a7255a
b6a724d4 8b4d10 mov ecx,dword ptr [ebp+10h]
b6a724d7 51 push ecx
b6a724d8 8b550c mov edx,dword ptr [ebp+0Ch]
b6a724db 52 push edx
b6a724dc 8b4508 mov eax,dword ptr [ebp+8]
b6a724df 50 push eax
b6a724e0 ff15c037a8b6 call dword ptr ds:[0B6A837C0h]
b6a724e6 8945fc mov dword ptr [ebp-4],eax
b6a724e9 837dfc00 cmp dword ptr [ebp-4],0
b6a724ed 746b je b6a7255a
b6a724ef 0fb64def movzx ecx,byte ptr [ebp-11h]
b6a724f3 83f901 cmp ecx,1
b6a724f6 7562 jne b6a7255a
b6a724f8 c745f400000000 mov dword ptr [ebp-0Ch],0
b6a724ff eb09 jmp b6a7250a
b6a72501 8b55f4 mov edx,dword ptr [ebp-0Ch]
b6a72504 83c201 add edx,1
b6a72507 8955f4 mov dword ptr [ebp-0Ch],edx
b6a7250a 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a7250d 3b45fc cmp eax,dword ptr [ebp-4]
b6a72510 7348 jae b6a7255a
b6a72512 8b4df4 mov ecx,dword ptr [ebp-0Ch]
b6a72515 6bc91c imul ecx,ecx,1Ch
b6a72518 8b550c mov edx,dword ptr [ebp+0Ch]
b6a7251b 833c0a01 cmp dword ptr [edx+ecx],1
b6a7251f 7515 jne b6a72536
b6a72521 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a72524 6bc01c imul eax,eax,1Ch
b6a72527 8b4d0c mov ecx,dword ptr [ebp+0Ch]
b6a7252a 8d540104 lea edx,[ecx+eax+4]
b6a7252e 52 push edx
b6a7252f e8fcbbffff call b6a6e130
b6a72534 eb22 jmp b6a72558
b6a72536 8b45f4 mov eax,dword ptr [ebp-0Ch]
b6a72539 6bc01c imul eax,eax,1Ch
b6a7253c 8b4d0c mov ecx,dword ptr [ebp+0Ch]
b6a7253f 833c0100 cmp dword ptr [ecx+eax],0
b6a72543 7513 jne b6a72558
b6a72545 8b55f4 mov edx,dword ptr [ebp-0Ch]
b6a72548 6bd21c imul edx,edx,1Ch
b6a7254b 8b450c mov eax,dword ptr [ebp+0Ch]
b6a7254e 8d4c1004 lea ecx,[eax+edx+4]
b6a72552 51 push ecx
b6a72553 e838bcffff call b6a6e190
b6a72558 eba7 jmp b6a72501
b6a7255a b924b2a7b6 mov ecx,0B6A7B224h
b6a7255f ff153483a7b6 call dword ptr ds:[0B6A78334h]
b6a72565 8b45fc mov eax,dword ptr [ebp-4]
b6a72568 8be5 mov esp,ebp
b6a7256a 5d pop ebp
b6a7256b c20c00 ret 0Ch
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
