Windows系统调用中API的3环部分(依据分析重写ReadProcessMemory(2)
发布时间:2021-01-08 16:20 所属栏目:52 来源:网络整理
导读:(执行结果) 1 #include "pch.h" 2 #include iostream 3 #include algorithm 4 #include Windows.h 5 void ReadMemory(HANDLE hProcess,PVOID pAddr,PVOID pBuffer,DWORD dwSize,DWORD *dwSizeRet) 6 { 7 8 _asm 9
(执行结果)
1 #include "pch.h" 2 #include <iostream> 3 #include <algorithm> 4 #include <Windows.h> 5 void ReadMemory(HANDLE hProcess,PVOID pAddr,PVOID pBuffer,DWORD dwSize,DWORD *dwSizeRet) 6 { 7 8 _asm 9 { 10 lea eax,[ebp + 0x14] 11 push eax 12 push[ebp + 0x14] 13 push[ebp + 0x10] 14 push[ebp + 0xc] 15 push[ebp + 8] 16 sub esp,4 17 mov eax,0x115 18 mov edx,0X7FFE0300 //sysenter不能直接调用,我间接call的 19 CALL DWORD PTR[EDX] 20 add esp,24 21 22 } 23 } 24 int main() 25 { 26 HANDLE hProcess = 0; 27 int t = 123; 28 DWORD pBuffer; 29 //hProcess = OpenProcess(PROCESS_ALL_ACCESS,a); 30 ReadMemory((HANDLE)-1,(PVOID)&t,&pBuffer,sizeof(int),0); 31 printf("%X\n",pBuffer); 32 ReadProcessMemory((HANDLE)-1,0); 33 printf("%X\n",pBuffer); 34 35 getchar(); 36 return 0; 37 } (编辑:ASP站长网) |
相关内容
网友评论
推荐文章
热点阅读