nt!NtGetContextThread:
805c7644 8bff mov edi,edi
805c7646 55 push ebp
805c7647 8bec mov ebp,esp
805c7649 51 push ecx
805c764a 56 push esi
805c764b 64a124010000 mov eax,dword ptr fs:[00000124h]
805c7651 8a8040010000 mov al,byte ptr [eax+140h]
805c7657 6a00 push 0
805c7659 8845fc mov byte ptr [ebp-4],al
805c765c 8d4508 lea eax,[ebp+8]
805c765f 50 push eax
805c7660 ff75fc push dword ptr [ebp-4]
805c7663 ff35bca75580 push dword ptr [nt!PsThreadType (8055a7bc)]
805c7669 6a08 push 8
805c766b ff7508 push dword ptr [ebp+8]
805c766e e8e994feff call nt!ObReferenceObjectByHandle (805b0b5c)
805c7673 8bf0 mov esi,eax
805c7675 85f6 test esi,esi
805c7677 7c2a jl nt!NtGetContextThread+0x5f (805c76a3)
nt!NtGetContextThread+0x35:
805c7679 57 push edi
805c767a 8b7d08 mov edi,dword ptr [ebp+8]
805c767d f6874802000010 test byte ptr [edi+248h],10h
805c7684 7510 jne nt!NtGetContextThread+0x52 (805c7696)
nt!NtGetContextThread+0x42:
805c7686 ff75fc push dword ptr [ebp-4]
805c7689 ff750c push dword ptr [ebp+0Ch]
805c768c 57 push edi
805c768d e8b2fdffff call nt!PsGetContextThread (805c7444)
805c7692 8bf0 mov esi,eax
805c7694 eb05 jmp nt!NtGetContextThread+0x57 (805c769b)
nt!NtGetContextThread+0x52:
805c7696 be080000c0 mov esi,0C0000008h
nt!NtGetContextThread+0x57:
805c769b 8bcf mov ecx,edi
805c769d e880baf5ff call nt!ObfDereferenceObject (80523122)
805c76a2 5f pop edi <-----这里是hook的地方
nt!NtGetContextThread+0x5f:
805c76a3 8bc6 mov eax,esi
805c76a5 5e pop esi
805c76a6 c9 leave
805c76a7 c20800 ret 8<-----跳回的地方
原本想在NtGetContextThread这里Hook一下,以达绕过程序通过调用GetThreadContext的时候判断是否存在硬件断点,但是现在仅仅是加了一个jmp跳转出去。。。然后执行被覆盖的几个指令805c76a2 5f
pop edi <-----这里是hook的地方
nt!NtGetContextThread+0x5f:
805c76a3 8bc6 mov eax,esi
805c76a5 5e pop esi
805c76a6 c9 leave
最后跳回805c76a7 c20800 ret 8<-----跳回的地方
不知道为什么用其他程序调用GetThreadContext时会出现ERROR_MR_MID_NOT_FOUND is being returned这个提示貌似我还没做任何操作。。。望大家帮忙解答一下,谢谢
提示信息如下:
EndRTL: RtlNtStatusToDosError(0x805c76a7): No Valid Win32 Error Mapping
RTL: Edit ntos\rtl\generr.c to correct the problem
RTL: ERROR_MR_MID_NOT_FOUND is being returned
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法