1.以前用的好像是
mov REG,0xXXXXXXXX
call  REG
2.驱动加载后,分配非分页内存,把关键代码放在里面,然后驱动就Unload了

用XueTr提取内存模块可以用来逆向么？

谢谢回复!还是找不到...
不过用RKUnhooker3.7检测出来code hooks:
2个inline hook
ntkrnlpa.exe-->DbgPrint, Type: Inline - RelativeJump at address 0x8052C892 hook handler located in [TesSafe.sys]
ntkrnlpa.exe-->PsGetVersion, Type: Inline - RelativeJump at address 0x8052C062 hook handler located in [TesSafe.sys]

3个dll hook
[3024]CG_Ystjc.exe-->kernel32.dll-->LoadLibraryExW, Type: Inline - RelativeJump at address 0x7C801AF5 hook handler located in [ystjc.dll]
[3024]CG_Ystjc.exe-->kernel32.dll-->OutputDebugStringA, Type: Inline - DirectJump at address 0x7C85AD4C hook handler located in [ystjc.dll]/*防止调试?*/
[3024]CG_Ystjc.exe-->user32.dll-->SendMessageA, Type: Inline - RelativeJump at address 0x77D2F3C2 hook handler located in [ystjc.dll]

HOOK NtDeleteFile

pe reload 一个内核,  把ntopenprocess 给干回来。 lz 在搞dnf？

不是dnf，这是一个私服的保护，好像比dnf的保护思路还完整，初学有关内核的知识，所以来看雪求教。

搞个蓝屏dump ，一切尽在不言之中。。总允许蓝屏吧