65,210
社区成员
发帖
与我相关
我的任务
分享
ULONG MyZwOpenLife( IN ULONG ObjName,IN ULONG ObjAddr)
{
_asm
{
push ebp
mov ebp, esp
mov eax, dword ptr [<&ntoskrnl.NtBuildNumber>] //F6C170DC 这里要怎么实现呢
mov ax, word ptr [eax]
xor edi, edi
JNE _CodeOne //这里写错了
retn 8
_CodeOne:
push 43
cmp eax, 29A
retn 12
HANDLE hLib;
hLib = LoadLibrary ("ntoskrnl.exe");
PFNDLL pNtBuildNumber=(PFNDLL) GetProcAddress(hLib,"NtBuildNumber");
ULONG MyZwOpenLife( IN ULONG ObjName,IN ULONG ObjAddr)
{
_asm
{
push ebp
mov ebp, esp
mov eax, pNtBuildNumber//dword ptr [<&ntoskrnl.NtBuildNumber>] //F6C170DC 这里要怎么实现呢
mov ax, word ptr [eax]
xor edi, edi
JNE _CodeOne //这里写错了
retn 8
}
_CodeOne:
_asm {
push 43
cmp eax, 29A
retn 12
}