能力值：
( LV2，RANK：10 )
|
-
-
2 楼
过PG没
|
能力值：
( LV4，RANK：50 )
|
-
-
3 楼
不知道啊，没有管PG--
|
能力值：
( LV4，RANK：50 )
|
-
-
4 楼
下面是调用新的方法的汇编，个人感觉就是对第5个参数的处理好像有点问题，各位大神的感觉呢？
kd> u 0x383fa0+0xfffff800`03c57000
nt!NtQueryInformationProcess:
fffff800`03fdafa0 44894c2420 mov dword ptr [rsp+20h],r9d
fffff800`03fdafa5 4c89442418 mov qword ptr [rsp+18h],r8
fffff800`03fdafaa 48894c2408 mov qword ptr [rsp+8],rcx
fffff800`03fdafaf 53 push rbx
fffff800`03fdafb0 56 push rsi
fffff800`03fdafb1 57 push rdi
fffff800`03fdafb2 4154 push r12
fffff800`03fdafb4 4155 push r13
kd> u MYDRIVER!NewNtQueryInformationProcess
MYDRIVER!NewNtQueryInformationProcess [c:\users\administrator\desktop\build\hookntqueryinformationprocess.h @ 26]:
fffff880`036fe7bc 48895c2408 mov qword ptr [rsp+8],rbx
fffff880`036fe7c1 48896c2410 mov qword ptr [rsp+10h],rbp
fffff880`036fe7c6 4889742418 mov qword ptr [rsp+18h],rsi
fffff880`036fe7cb 57 push rdi
fffff880`036fe7cc 4883ec30 sub rsp,30h
fffff880`036fe7d0 8bf2 mov esi,edx
fffff880`036fe7d2 ba02000000 mov edx,2
fffff880`036fe7d7 498bf8 mov rdi,r8
kd> u
MYDRIVER!NewNtQueryInformationProcess+0x1e [c:\users\administrator\desktop\build\hookntqueryinformationprocess.h @ 27]:
fffff880`036fe7da 488be9 mov rbp,rcx
fffff880`036fe7dd 4c8d054c0f0000 lea r8,[MYDRIVER! ?? ::FNODOBFM::`string' (fffff880`036ff730)]
fffff880`036fe7e4 8d4a4b lea ecx,[rdx+4Bh]
fffff880`036fe7e7 418bd9 mov ebx,r9d
fffff880`036fe7ea ff1510190000 call qword ptr [MYDRIVER!_imp_DbgPrintEx (fffff880`03700100)]
fffff880`036fe7f0 4c8b5c2460 mov r11,qword ptr [rsp+60h]
fffff880`036fe7f5 448bcb mov r9d,ebx
fffff880`036fe7f8 4c8bc7 mov r8,rdi
kd> u
MYDRIVER!NewNtQueryInformationProcess+0x3f [c:\users\administrator\desktop\build\hookntqueryinformationprocess.h @ 28]:
fffff880`036fe7fb 8bd6 mov edx,esi
fffff880`036fe7fd 488bcd mov rcx,rbp
fffff880`036fe800 4c895c2420 mov qword ptr [rsp+20h],r11
fffff880`036fe805 ff15a5780000 call qword ptr [MYDRIVER!OldNtQueryInformationProcess (fffff880`037060b0)]
fffff880`036fe80b 488b5c2440 mov rbx,qword ptr [rsp+40h]
fffff880`036fe810 488b6c2448 mov rbp,qword ptr [rsp+48h]
fffff880`036fe815 488b742450 mov rsi,qword ptr [rsp+50h]
fffff880`036fe81a 4883c430 add rsp,30h
kd> dq fffff880`037060b0
fffff880`037060b0 fffff800`03fdafa0 fffffa80`1c55f7e0
fffff880`037060c0 00000000`00000000 00000000`00000000
fffff880`037060d0 00000000`00000000 00000000`00000000
fffff880`037060e0 00000000`00000000 00000000`00000000
fffff880`037060f0 00000000`00000000 00000000`00000000
fffff880`03706100 00000000`00000000 00000000`00000000
fffff880`03706110 00000000`00000000 00000000`00000000
fffff880`03706120 00000000`00000000 00000000`00000000
kd> u fffff800`03fdafa0
nt!NtQueryInformationProcess:
fffff800`03fdafa0 44894c2420 mov dword ptr [rsp+20h],r9d
fffff800`03fdafa5 4c89442418 mov qword ptr [rsp+18h],r8
fffff800`03fdafaa 48894c2408 mov qword ptr [rsp+8],rcx
fffff800`03fdafaf 53 push rbx
fffff800`03fdafb0 56 push rsi
fffff800`03fdafb1 57 push rdi
fffff800`03fdafb2 4154 push r12
fffff800`03fdafb4 4155 push r13
但是我的调用约定确实是fastcall
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
。。。都没管pg.能不GG吗？
|
能力值：
( LV4，RANK：50 )
|
-
-
6 楼
但是我HOOK了 SSDT 的两个函数，在HOOK这个函数之前，只HOOK另外一个函数貌似还挺好的
|
能力值：
( LV4，RANK：50 )
|
-
-
7 楼
我去试试看
|
能力值：
( LV4，RANK：50 )
|
-
-
8 楼
最后还是没有过好PG，所以这个HOOK就暂时被放在这里了
|
能力值：
( LV4，RANK：50 )
|
-
-
9 楼
放32位下先试试
|
能力值：
( LV4，RANK：50 )
|
-
-
10 楼
恩，好的，有空在去试试看 
|
|
|
