songbei6-优快云博客

原创 IoRegisterDriverReinitialization Demo

#include <ntddk.h> VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("Enter OnUnload\n"); } DRIVER_REINITIALIZE Reinitialize; VOID Reinitialize( _In_ struct _DRIVER_OBJECT *Drive...

2020-03-31 22:29:47 578

原创 PPL 相关控制属性

0: kd> vertarget Windows 10 Kernel Version 18362 MP (2 procs) Free x64 Built by: 18362.1.amd64fre.19h1_release.190318-1202 Machine Name: Kernel base = 0xfffff801`11400000 PsLoadedModuleList = 0xfff...

2020-03-31 22:27:57 891

原创禁用其他程序的 DEP & ASLR

上 Code: #include <Windows.h> #include <ImageHlp.h> #include <iostream> using namespace std; #pragma comment(lib, "ImageHlp.lib") bool Flag(LPCSTR path, bool ASLR, bool DEP) { L...

2020-03-31 22:23:43 493

原创 Wow64 环境检测

1、使用 IsWow64Process2 说明 Determines whether the specified process is running under WOW64; also returns additional machine process and architecture information. 语法 BOOL IsWow64Process2( HANDLE hProcess...

2020-03-31 22:20:48 1823

原创关于驱动初始化内存块标记("INIT") 的说明

代码： #pragma once #ifdef __cplusplus extern "C" { #endif #include <NTDDK.h> #ifdef __cplusplus } #endif #define PAGEDCODE code_seg("PAGE") #define LOCKEDCODE code_seg() #define INITCODE code...

2020-03-31 22:18:27 529

原创 Windows 系统版本总结

0、导引详细介绍了 Windows 系统相关 API 的使用等内容。 1、操作系统版本 Operating system Version number Windows 10 10.0* Windows Server 2019 10.0* Windows Server 2016 10.0* Windows 8.1 6.3* Windows Server 201...

2020-03-31 22:14:27 2044

原创获得所在系统的处理器的体系结构

GetSystemInfo provides the basic system information and processor architecture of the underlying platform. This API can be used successfully in both x64 and x86 platform. But, under 64-bit WIndows, we...

2020-03-31 22:12:35 284