能力值:
( LV12,RANK:420 )
2 楼
NtSetContextThread
能力值:
( LV2,RANK:10 )
3 楼
一般用 PsSetContextThread
能力值:
( LV12,RANK:420 )
4 楼
PsSetContextThread 没有导出,使用这个函数是非常愚蠢的行为。
能力值:
( LV12,RANK:760 )
5 楼
PsSetContextThread貌似有导出!
xp上有
上传的附件:
能力值:
( LV2,RANK:10 )
6 楼
NTSTATUS NtSetContextThread( __in HANDLE ThreadHandle, __in PCONTEXT ThreadContext ) /*++ Routine Description: This function sets the usermode context of the specified thread. This function will fail if the specified thread is a system thread. It will return the wrong answer if the thread is a non-system thread that does not execute in user-mode. Arguments: ThreadHandle - Supplies an open handle to the thread object from which to retrieve context information. The handle must allow THREAD_SET_CONTEXT access to the thread. ThreadContext - Supplies the address of a buffer that contains new context for the specified thread. Return Value: None. --*/ { KPROCESSOR_MODE Mode; NTSTATUS Status; PETHREAD Thread; PETHREAD CurrentThread; PAGED_CODE(); // // Get previous mode and reference specified thread. // CurrentThread = PsGetCurrentThread (); Mode = KeGetPreviousModeByThread (&CurrentThread->Tcb); Status = ObReferenceObjectByHandle (ThreadHandle, THREAD_SET_CONTEXT, PsThreadType, Mode, &Thread, NULL); // // If the reference was successful, the check if the specified thread // is a system thread. // if (NT_SUCCESS (Status)) { // // If the thread is not a system thread, then attempt to get the // context of the thread. // if (IS_SYSTEM_THREAD (Thread) == FALSE) { Status = PsSetContextThread (Thread, ThreadContext, Mode); } else { Status = STATUS_INVALID_HANDLE; } ObDereferenceObject (Thread); } return Status; }
我倒
能力值:
( LV3,RANK:20 )
7 楼
大哥们 贴个能用的代码吧。。
能力值:
( LV3,RANK:20 )
8 楼
CONTEXT MyContext;
typedef NTSTATUS (__stdcall *NtSetContextThread)(IN HANDLE ThreadHandle,OUT PCONTEXT pThreadContext);
typedef NTSTATUS (__stdcall *NtGetContextThread)(IN HANDLE ThreadHandle,OUT PCONTEXT pThreadContext);
MyNtGetContextThread = (NtGetContextThread)KeServiceDescriptorTable->ServiceTableBase[Index_NtGetContextThread];
DbgPrint("MyNtGetContextThread:0x%08X\n",MyNtGetContextThread);
MyNtSetContextThread = (NtSetContextThread)KeServiceDescriptorTable->ServiceTableBase[Index_NtSetContextThread]; RtlZeroMemory(&MyContext,sizeof(CONTEXT));
MyNtSuspendThread(ThreadHandle,NULL);
MyNtGetContextThread(ThreadHandle,&MyContext);
总是会失败 MyContext 根本没被写入任何东西 我要获取状态的线程是一个内核线程 和这个有关系吗?
能力值:
( LV3,RANK:20 )
9 楼
有没有大哥在的啊啊啊啊
能力值:
( LV2,RANK:10 )
10 楼
NTSTATUS
NtGetContextThread(
__in HANDLE ThreadHandle,
__inout PCONTEXT ThreadContext
)
/*++
Routine Description:
This function returns the usermode context of the specified thread. This
function will fail if the specified thread is a system thread. It will
return the wrong answer if the thread is a non-system thread that does
not execute in user-mode.
Arguments:
ThreadHandle - Supplies an open handle to the thread object from
which to retrieve context information. The handle
must allow THREAD_GET_CONTEXT access to the thread.
ThreadContext - Supplies the address of a buffer that will receive
the context of the specified thread.
Return Value:
None.
--*/
{
KPROCESSOR_MODE Mode;
NTSTATUS Status;
PETHREAD Thread;
PETHREAD CurrentThread;
PAGED_CODE();
//
// Get previous mode and reference specified thread.
//
CurrentThread = PsGetCurrentThread ();
Mode = KeGetPreviousModeByThread (&CurrentThread->Tcb);
Status = ObReferenceObjectByHandle (ThreadHandle,
THREAD_GET_CONTEXT,
PsThreadType,
Mode,
&Thread,
NULL);
//
// If the reference was successful, the check if the specified thread
// is a system thread.
//
if (NT_SUCCESS (Status)) {
//
// If the thread is not a system thread, then attempt to get the
// context of the thread.
//
if (IS_SYSTEM_THREAD (Thread) == FALSE) {
Status = PsGetContextThread (Thread, ThreadContext, Mode);
} else {
Status = STATUS_INVALID_HANDLE;
}
ObDereferenceObject (Thread);
}
return Status;
}
能力值:
( LV3,RANK:20 )
11 楼
KeGetPreviousModeByThread 这个函数怎么获取
PsGetContextThread 这个函数怎么定义?似乎都是未导出的函数啊
能力值:
( LV12,RANK:420 )
12 楼
不好意思,没有仔细看你的问题,SystemThread是无法通过NtSetContextThread设置Context的,因为系统实际是对线程插入APC来实现这一点的。
微软的函数说明也了这一点:
This function sets the usermode context of the specified thread. This
function will fail if the specified thread is a system thread. It will
return the wrong answer if the thread is a non-system thread that does
not execute in user-mode.
能力值:
( LV9,RANK:180 )
13 楼
最大的就回你的那个.
没更大了
能力值:
( LV3,RANK:20 )
14 楼
难道说就没有办法修改系统线程的状态了吗?
能力值:
( LV2,RANK:10 )
15 楼
貌似没有吧·
能力值:
( LV2,RANK:10 )
16 楼
PsSetContextThread 我的系统上有导出~~~一直用这个
能力值:
( LV12,RANK:420 )
17 楼
那你慢慢和自己玩吧
能力值:
( LV9,RANK:260 )
18 楼
直接改TrapFrame不行吗?
+0x134 TrapFrame : Ptr32 _KTRAP_FRAME
+0x000 DbgEbp : Uint4B
+0x004 DbgEip : Uint4B
+0x008 DbgArgMark : Uint4B
+0x00c DbgArgPointer : Uint4B
+0x010 TempSegCs : Uint4B
+0x014 TempEsp : Uint4B
+0x018 Dr0 : Uint4B
+0x01c Dr1 : Uint4B
+0x020 Dr2 : Uint4B
+0x024 Dr3 : Uint4B
+0x028 Dr6 : Uint4B
+0x02c Dr7 : Uint4B
+0x030 SegGs : Uint4B
+0x034 SegEs : Uint4B
+0x038 SegDs : Uint4B
+0x03c Edx : Uint4B
+0x040 Ecx : Uint4B
+0x044 Eax : Uint4B
+0x048 PreviousPreviousMode : Uint4B
+0x04c ExceptionList : Ptr32 _EXCEPTION_REGISTRATION_RECORD
+0x050 SegFs : Uint4B
+0x054 Edi : Uint4B
+0x058 Esi : Uint4B
+0x05c Ebx : Uint4B
+0x060 Ebp : Uint4B
+0x064 ErrCode : Uint4B
+0x068 Eip : Uint4B
+0x06c SegCs : Uint4B
+0x070 EFlags : Uint4B
+0x074 HardwareEsp : Uint4B
+0x078 HardwareSegSs : Uint4B
+0x07c V86Es : Uint4B
+0x080 V86Ds : Uint4B
+0x084 V86Fs : Uint4B
+0x088 V86Gs : Uint4B