[求助]根据内核函数地址获取所在模块名称。-求助问答-看雪-安全社区|安全招聘|kanxue.com

最新回复 (7)
Sprite雪碧雪币： 9626 活跃值： (1848) 能力值： ( LV5，RANK：73 ) 在线值：发帖 2 回帖 322 粉丝 73 关注私信	Sprite雪碧 1 2 楼第一步：打开浏览器，在地址栏输入百度的域名“5f8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5 第二步：将帖子标题去掉前缀和标点符号“根据内核函数地址获取所在模块名称”，粘贴进百度搜索框，然后回车。第三步：排除结果。首先第一个不是，第二个是你自己的帖子，那看看第三个？第四步：点开第三个链接，阅读内容。第五步：得到结果：“ZwQuerySystemInformation传入SystemModuleInformation，自己根据模块基址和模块大小判断地址所在的模块。” 最后，请问楼主学会使用搜索引擎了吗？没有的话我再教一遍。最后于 2019-9-22 09:11 被Sprite雪碧编辑，原因： 2019-9-22 09:08 3
大只狼雪币： 1140 活跃值： (102) 能力值： ( LV4，RANK：48 ) 在线值：发帖 13 回帖 248 粉丝 1 关注私信	大只狼 3 楼哈哈 2019-9-22 10:35 0
kingswb 雪币： 6664 活跃值： (967) 能力值： ( LV2，RANK：10 ) 在线值：发帖 29 回帖 179 粉丝 0 关注私信	kingswb 4 楼 Sprite雪碧第一步：打开浏览器，在地址栏输入百度的域名“52fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1u0m8i4K6S2o6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1#2i4@1t1H3i4K6R3$3i4@1f1#2i4@1t1^5i4K6V1$3i4@1f1#2i4@1q4p5i4K6V1H3i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1&6i4@1p5J5i4K6V1^5i4@1f1#2i4K6S2q4i4@1u0n7i4@1f1$3i4K6S2q4i4K6R3&6i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1%4i4@1u0o6i4K6R3H3i4@1f1#2i4K6V1J5i4K6S2o6i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1%4i4K6R3J5i4@1t1&6i4@1f1%4i4@1q4o6i4@1p5$3i4@1f1#2i4K6S2r3i4@1t1%4i4@1f1J5i4K6R3H3i4K6W2o6i4@1f1$3i4@1p5H3i4@1t1&6i4@1f1$3i4K6S2p5i4@1q4q4i4@1f1#2i4K6R3$3i4K6R3#2i4@1f1$3i4@1p5H3i4@1t1^5i4@1f1#2i4K6R3%4i4@1u0p5i4@1f1$3i4K6V1#2i4@1t1H3i4@1f1#2i4K6W2o6i4@1t1H3i4@1f1#2i4K6W2p5i4K6R3H3i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1$3i4K6R3&6i4K6R3H3i4@1f1#2i4K6W2o6i4@1p5^5i4@1f1$3i4@1p5^5i4@1p5I4i4@1f1#2i4K6W2p5i4K6V1%4i4@1f1#2i4K6V1H3i4K6S2p5i4@1f1%4i4@1p5%4i4@1t1H3i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4@1t1J5i4K6V1^5i4@1f1^5i4@1t1@1i4@1t1@1i4@1f1^5i4@1u0r3i4K6W2n7i4@1f1%4i4K6V1&6i4@1u0q4i4@1f1#2i4@1u0m8i4@1p5$3i4@1f1$3i4K6V1H3i4K6W2o6i4@1f1%4i4@1t1@1i4@1p5J5i4@1f1$3i4@1p5I4i4K6R3$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1t1^5i4K6R3&6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1$3i4K6S2q4i4K6V1J5i4@1f1&6i4K6V1&6i4@1p5@1i4@1f1%4i4@1u0n7i4K6V1K6 ... 哥，真心谢谢你。，两个我的问题都是你仔细的回复。唉，怪我读书的时候不认真，看文章都不仔细。谢谢。 2019-9-22 10:44 0
xiaofu 雪币： 1564 活跃值： (3567) 能力值： ( LV13，RANK：420 ) 在线值：发帖 118 回帖 638 粉丝 273 关注私信	xiaofu 8 5 楼 RtlPcToFileHeader 2019-9-22 13:39 0
GodSurvive 雪币： 1686 活跃值： (183) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 70 粉丝 3 关注私信	GodSurvive 6 楼雪碧大佬 2019-9-22 14:23 0
mb_ddciclgc 雪币： 5 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 7 粉丝 0 关注私信	mb_ddciclgc 7 楼百度并不是万能的，比如搜索infinityhook就只有看雪一条答案。only看雪！！ 2019-9-27 11:14 0
guoqiangck 雪币： 963 活跃值： (85) 能力值： ( LV2，RANK：10 ) 在线值：发帖 8 回帖 57 粉丝 4 关注私信	guoqiangck 8 楼 Sprite雪碧第一步：打开浏览器，在地址栏输入百度的域名“832K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1u0m8i4K6S2o6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1#2i4@1t1H3i4K6R3$3i4@1f1#2i4@1t1^5i4K6V1$3i4@1f1#2i4@1q4p5i4K6V1H3i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1&6i4@1p5J5i4K6V1^5i4@1f1#2i4K6S2q4i4@1u0n7i4@1f1$3i4K6S2q4i4K6R3&6i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1%4i4@1u0o6i4K6R3H3i4@1f1#2i4K6V1J5i4K6S2o6i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1%4i4K6R3J5i4@1t1&6i4@1f1%4i4@1q4o6i4@1p5$3i4@1f1#2i4K6S2r3i4@1t1%4i4@1f1J5i4K6R3H3i4K6W2o6i4@1f1$3i4@1p5H3i4@1t1&6i4@1f1$3i4K6S2p5i4@1q4q4i4@1f1#2i4K6R3$3i4K6R3#2i4@1f1$3i4@1p5H3i4@1t1^5i4@1f1#2i4K6R3%4i4@1u0p5i4@1f1$3i4K6V1#2i4@1t1H3i4@1f1#2i4K6W2o6i4@1t1H3i4@1f1#2i4K6W2p5i4K6R3H3i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1$3i4K6R3&6i4K6R3H3i4@1f1#2i4K6W2o6i4@1p5^5i4@1f1$3i4@1p5^5i4@1p5I4i4@1f1#2i4K6W2p5i4K6V1%4i4@1f1#2i4K6V1H3i4K6S2p5i4@1f1%4i4@1p5%4i4@1t1H3i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4@1t1J5i4K6V1^5i4@1f1^5i4@1t1@1i4@1t1@1i4@1f1^5i4@1u0r3i4K6W2n7i4@1f1%4i4K6V1&6i4@1u0q4i4@1f1#2i4@1u0m8i4@1p5$3i4@1f1$3i4K6V1H3i4K6W2o6i4@1f1%4i4@1t1@1i4@1p5J5i4@1f1$3i4@1p5I4i4K6R3$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1t1^5i4K6R3&6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1$3i4K6S2q4i4K6V1J5i4@1f1&6i4K6V1&6i4@1p5@1i4@1f1%4i4@1u0n7i4K6V1K6 ... 大佬牛X 最后于 2019-9-27 11:26 被guoqiangck编辑，原因： 2019-9-27 11:26 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

Sprite雪碧

雪币： 9626

活跃值： (1848)

能力值：

( LV5，RANK：73 )

在线值：

发帖

2

回帖

322

粉丝

73

关注

私信

Sprite雪碧 1: 2 楼

第一步：打开浏览器，在地址栏输入百度的域名“5f8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5

第二步：将帖子标题去掉前缀和标点符号“根据内核函数地址获取所在模块名称”，粘贴进百度搜索框，然后回车。

第三步：排除结果。首先第一个不是，第二个是你自己的帖子，那看看第三个？

第四步：点开第三个链接，阅读内容。

第五步：得到结果：“ZwQuerySystemInformation传入SystemModuleInformation，自己根据模块基址和模块大小判断地址所在的模块。”

最后，请问楼主学会使用搜索引擎了吗？没有的话我再教一遍。

最后于 2019-9-22 09:11 被Sprite雪碧编辑，原因：

2019-9-22 09:08

3

大只狼

雪币： 1140

活跃值： (102)

能力值：

( LV4，RANK：48 )

在线值：

发帖

13

回帖

248

粉丝

1

关注

私信

大只狼: 3 楼

哈哈

2019-9-22 10:35

0

kingswb

雪币： 6664

活跃值： (967)

能力值：

( LV2，RANK：10 )

在线值：

发帖

29

回帖

179

粉丝

0

关注

私信

kingswb: 4 楼

Sprite雪碧第一步：打开浏览器，在地址栏输入百度的域名“52fK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1u0m8i4K6S2o6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1#2i4@1t1H3i4K6R3$3i4@1f1#2i4@1t1^5i4K6V1$3i4@1f1#2i4@1q4p5i4K6V1H3i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1&6i4@1p5J5i4K6V1^5i4@1f1#2i4K6S2q4i4@1u0n7i4@1f1$3i4K6S2q4i4K6R3&6i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1%4i4@1u0o6i4K6R3H3i4@1f1#2i4K6V1J5i4K6S2o6i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1%4i4K6R3J5i4@1t1&6i4@1f1%4i4@1q4o6i4@1p5$3i4@1f1#2i4K6S2r3i4@1t1%4i4@1f1J5i4K6R3H3i4K6W2o6i4@1f1$3i4@1p5H3i4@1t1&6i4@1f1$3i4K6S2p5i4@1q4q4i4@1f1#2i4K6R3$3i4K6R3#2i4@1f1$3i4@1p5H3i4@1t1^5i4@1f1#2i4K6R3%4i4@1u0p5i4@1f1$3i4K6V1#2i4@1t1H3i4@1f1#2i4K6W2o6i4@1t1H3i4@1f1#2i4K6W2p5i4K6R3H3i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1$3i4K6R3&6i4K6R3H3i4@1f1#2i4K6W2o6i4@1p5^5i4@1f1$3i4@1p5^5i4@1p5I4i4@1f1#2i4K6W2p5i4K6V1%4i4@1f1#2i4K6V1H3i4K6S2p5i4@1f1%4i4@1p5%4i4@1t1H3i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4@1t1J5i4K6V1^5i4@1f1^5i4@1t1@1i4@1t1@1i4@1f1^5i4@1u0r3i4K6W2n7i4@1f1%4i4K6V1&6i4@1u0q4i4@1f1#2i4@1u0m8i4@1p5$3i4@1f1$3i4K6V1H3i4K6W2o6i4@1f1%4i4@1t1@1i4@1p5J5i4@1f1$3i4@1p5I4i4K6R3$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1t1^5i4K6R3&6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1$3i4K6S2q4i4K6V1J5i4@1f1&6i4K6V1&6i4@1p5@1i4@1f1%4i4@1u0n7i4K6V1K6 ...

哥，真心谢谢你。

，两个我的问题都是你仔细的回复。唉，怪我读书的时候不认真，看文章都不仔细。谢谢。

2019-9-22 10:44

0

xiaofu

雪币： 1564

活跃值： (3567)

能力值：

( LV13，RANK：420 )

在线值：

发帖

118

回帖

638

粉丝

273

关注

私信

xiaofu 8: 5 楼

RtlPcToFileHeader

2019-9-22 13:39

0

GodSurvive

雪币： 1686

活跃值： (183)

能力值：

( LV2，RANK：10 )

在线值：

发帖

2

回帖

70

粉丝

3

关注

私信

GodSurvive: 6 楼

雪碧大佬

2019-9-22 14:23

0

mb_ddciclgc

雪币： 5

能力值：

( LV1，RANK：0 )

在线值：

发帖

0

回帖

7

粉丝

0

关注

私信

mb_ddciclgc: 7 楼

百度并不是万能的，比如搜索infinityhook就只有看雪一条答案。only看雪！！

2019-9-27 11:14

0

guoqiangck

雪币： 963

活跃值： (85)

能力值：

( LV2，RANK：10 )

在线值：

发帖

8

回帖

57

粉丝

4

关注

私信

guoqiangck: 8 楼

Sprite雪碧第一步：打开浏览器，在地址栏输入百度的域名“832K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3u0S2K9h3c8#2i4K6u0W2j5$3!0E0i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1u0m8i4K6S2o6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1#2i4@1t1H3i4K6R3$3i4@1f1#2i4@1t1^5i4K6V1$3i4@1f1#2i4@1q4p5i4K6V1H3i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1&6i4@1p5J5i4K6V1^5i4@1f1#2i4K6S2q4i4@1u0n7i4@1f1$3i4K6S2q4i4K6R3&6i4@1f1#2i4K6R3&6i4K6S2p5i4@1f1%4i4@1u0o6i4K6R3H3i4@1f1#2i4K6V1J5i4K6S2o6i4@1f1$3i4@1p5H3i4K6R3%4i4@1f1%4i4K6R3J5i4@1t1&6i4@1f1%4i4@1q4o6i4@1p5$3i4@1f1#2i4K6S2r3i4@1t1%4i4@1f1J5i4K6R3H3i4K6W2o6i4@1f1$3i4@1p5H3i4@1t1&6i4@1f1$3i4K6S2p5i4@1q4q4i4@1f1#2i4K6R3$3i4K6R3#2i4@1f1$3i4@1p5H3i4@1t1^5i4@1f1#2i4K6R3%4i4@1u0p5i4@1f1$3i4K6V1#2i4@1t1H3i4@1f1#2i4K6W2o6i4@1t1H3i4@1f1#2i4K6W2p5i4K6R3H3i4@1f1^5i4K6S2q4i4@1t1%4i4@1f1#2i4K6S2r3i4K6V1$3i4@1f1$3i4K6R3&6i4K6R3H3i4@1f1#2i4K6W2o6i4@1p5^5i4@1f1$3i4@1p5^5i4@1p5I4i4@1f1#2i4K6W2p5i4K6V1%4i4@1f1#2i4K6V1H3i4K6S2p5i4@1f1%4i4@1p5%4i4@1t1H3i4@1f1J5i4K6R3H3i4K6W2p5i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4@1t1J5i4K6V1^5i4@1f1^5i4@1t1@1i4@1t1@1i4@1f1^5i4@1u0r3i4K6W2n7i4@1f1%4i4K6V1&6i4@1u0q4i4@1f1#2i4@1u0m8i4@1p5$3i4@1f1$3i4K6V1H3i4K6W2o6i4@1f1%4i4@1t1@1i4@1p5J5i4@1f1$3i4@1p5I4i4K6R3$3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4K6R3@1i4@1t1$3i4@1f1#2i4K6V1H3i4K6S2q4i4@1f1#2i4K6W2n7i4K6W2q4i4@1f1^5i4@1u0p5i4@1p5$3i4@1f1K6i4K6R3H3i4K6R3J5i4@1f1%4i4@1q4o6i4@1q4o6i4@1f1@1i4@1t1^5i4K6R3&6i4@1f1$3i4@1q4p5i4@1p5#2i4@1g2r3i4@1u0o6i4K6W2m8i4@1f1$3i4K6S2q4i4K6V1J5i4@1f1&6i4K6V1&6i4@1p5@1i4@1f1%4i4@1u0n7i4K6V1K6 ...

大佬牛X

最后于 2019-9-27 11:26 被guoqiangck编辑，原因：

2019-9-27 11:26

0

未解决 [求助]根据内核函数地址获取所在模块名称。