//New -- 逆向DNF驱动保护

dllsky

于 2010-07-10 03:23:00 发布

阅读量918

点赞数 1

文章标签： null system

本文链接：https://blog.youkuaiyun.com/dllsky/article/details/5724723

版权

本文介绍了如何通过逆向工程技术获取指定进程的系统句柄信息，特别是关注那些与QQGame_Mutex相关的句柄。通过调用`GetProcessKernelObject`函数，遍历系统句柄信息，利用`ZwQuerySystemInformation`和`NtQueryObject` API查询对象详细信息，最终找到并返回与QQGame_Mutex相关的句柄。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

HANDLE GetProcessKernelObject(DWORD ProcessId)
{

HMODULE hNtDll = NULL;
ZWQUERYSYSTEMINFORMATION pfnZwQuerySystemInformation = NULL;
NTQUERYOBJECT pfnNtQueryObject = NULL;
PSYSTEM_HANDLE_INFORMATION pSysHandleInfo = NULL;
POBJECT_ALL_INFORMATION pAllInfo =NULL;
POBJECT_NAME_INFORMATION pNameInfo = NULL;

ULONG nNumberHandle =0;
NTSTATUS ntStatus = 0;
ULONG ulSize,ulCount;
char cBuffer[0x80000],cInfoBuffer[0x10000];

hNtDll = GetModuleHandle(TEXT("ntdll.dll"));
pfnZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");
pfnNtQueryObject = (NTQUERYOBJECT)GetProcAddress(hNtDll,"NtQueryObject");

ntStatus = pfnZwQuerySystemInformation(SystemHandleInformation,cBuffer,0x80000,&ulSize);

if(NT_SUCCESS(ntStatus))

最低0.47元/天解锁文章