能力值：
( LV2，RANK：10 )
|
-
-
2 楼
eprocess->CreateTime
eprocess->ExitTime
汗……不知道自己用windbg查查么？
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
r0:
退出时间：PsGetProcessExitTime
创建时间：PsGetProcessCreateTimeQuadPart(XP+)
NtQueryInformationProcess(ProcessTimes)
r3:GetProcessTimes
c3dK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3#2K6k6r3&6Q4x3X3g2E0K9h3y4J5L8%4y4G2k6Y4c8Q4x3X3g2U0L8$3#2Q4x3V1k6W2L8W2)9J5k6s2g2K6i4K6u0r3L8r3W2T1M7X3q4J5P5g2)9J5c8X3#2K6y4U0R3K6x3U0t1K6i4K6t1^5g2W2y4Q4x3X3f1^5y4g2)9J5z5g2)9J5k6h3q4K6M7s2R3`.
|
|
|
|
