-
-
[讨论]再内核模式下获取用户态系统API地址的最方便的方法
-
发表于: 2009-9-2 21:12
-
|
|
|---|---|
|
|
|
|
|
|
|
|
 倒。。太心急了。。。没注意咋写成原创了。。各位老大不好意思。。。 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
因为被MSDN恐吓过
 ：Note that attaching a thread to a different process can prevent asynchronous I/O operations from completing and can potentially cause deadlocks. In general, the lines of code between the call to KeStackAttachProcess and the call to KeUnstackDetachProcess should be very simple and should not call complex routines or send IRPs to other drivers. ——MSDN |
|
|
开线程的 那个程序只要预先载入个Dll，在DllMain里停下，占住loader lock 就能让你一直等下去
或者在DLL_THREAD_ATTACH的时候干点坏事 
|
|
|
|
|
|
|
|
|
|
