重写OpenProcess功能

最新推荐文章于 2024-04-27 19:54:04 发布

大海得味道

最新推荐文章于 2024-04-27 19:54:04 发布

阅读量516

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/signed2008/article/details/104497265

__kernel_entry NTSYSCALLAPI NTSTATUS NtOpenProcess(
  PHANDLE            ProcessHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  PCLIENT_ID         ClientId
);

void hftestfunc()
{
   HANDLE hProc; OBJECT_ATTRIBUTES oa; CLIENT_ID ci;

   memset(&oa, 0, sizeof(oa));
   memset(&ci, 0, sizeof(ci));
   ci.UniqueProcess = pid;

   NtOpenProcess(&hProc, MAXIMUM_ALLOWED, &oa, &ci);
}