雨落空林 发表于 2013-4-8 09:16:00

汇编进程EPROCESS地址获取

至于EPROCESS有何作用，呵呵，不用明说了，获取方式由如下代码，大牛莫见笑
.586p
.model flat, stdcall
option casemap:none

include PidToEprocess.inc

EXP_PsLookupProcessByProcessId typedef proto :HANDLE,:PEPROCESS
FUN_EXP_PsLookupProcessByProcessId typedef ptr EXP_PsLookupProcessByProcessId

.data
FUN_PsLookupProcessByProcessId FUN_EXP_PsLookupProcessByProcessId ?

.code

DriverUnload proc pDriverObject:PDRIVER_OBJECT

invoke DbgPrint,$CTA0("Unload Driver Success\n")
ret

DriverUnload endp

GetKernelExpFunAddr proc uniFunName:PUNICODE_STRING
LOCAL retFunAddr:dword
cli
invoke MmGetSystemRoutineAddress,uniFunName
mov retFunAddr,eax
sti
mov eax,retFunAddr

ret

GetKernelExpFunAddr endp


PidToEprocess proc imgPid:DWORD
LOCAL funAddr:DWORD
LOCAL imgEprocess:PEPROCESS
LOCAL funName:UNICODE_STRING
invoke RtlInitUnicodeString,addr funName,$CCOUNTED_UNICODE_STRING("PsLookupProcessByProcessId")
invoke GetKernelExpFunAddr,$CCOUNTED_UNICODE_STRING("PsLookupProcessByProcessId")
;invoke MmGetSystemRoutineAddress,$CCOUNTED_UNICODE_STRING("PsLookupProcessByProcessId")
mov funAddr,eax
mov FUN_PsLookupProcessByProcessId,eax
.if funAddr==0
    invoke DbgPrint,$CTA0("Get PsLookupProcessByProcessId Address Failed.\n")
    ret
.endif
;lea eax,imgEprocess
;push eax
;push imgPid
;call funAddr
invoke FUN_PsLookupProcessByProcessId,imgPid,addr imgEprocess
mov eax,dword ptr

ret

PidToEprocess endp

DriverEntry proc pDriverObject:PDRIVER_OBJECT,pusRegistryPath:PUNICODE_STRING
mov esi,pDriverObject
mov ,offset DriverUnload
invoke PidToEprocess,1676
invoke DbgPrint,$CTA0("EPROCESS Address: 0x%08X\n"),eax
mov eax,STATUS_SUCCESS

    ret

DriverEntry endp

end DriverEntry

dk26wfc 发表于 2023-10-26 10:58:20



https://files.catbox.moe/nrnqg0.png
https://files.catbox.moe/57vj48.png
https://files.catbox.moe/bjptfk.png
https://files.catbox.moe/vofg1s.png
https://files.catbox.moe/4lkc07.png
https://files.catbox.moe/ri9mvb.png
https://files.catbox.moe/zdcj4a.png
https://files.catbox.moe/bz4osu.png
https://files.catbox.moe/bpy7l4.png
https://files.catbox.moe/w5flk0.png
https://files.catbox.moe/9skknr.png
https://files.catbox.moe/mw7xjk.png
https://files.catbox.moe/l6arxi.png
https://files.catbox.moe/22s3xz.png
https://files.catbox.moe/i2iwo7.png
https://files.catbox.moe/txsh6r.png
https://files.catbox.moe/asuv94.png
https://files.catbox.moe/5niuff.png
https://files.catbox.moe/xdrdqi.png
https://files.catbox.moe/y314t1.png
https://files.catbox.moe/ovh8zs.png
https://files.catbox.moe/2my4yp.png
https://files.catbox.moe/qxo6ki.png
https://files.catbox.moe/wlsh4i.png
https://files.catbox.moe/vq8gyk.png
https://files.catbox.moe/f2hyer.png
https://files.catbox.moe/e1rgl6.png
https://files.catbox.moe/bzz5v1.png
https://files.catbox.moe/va3c4s.png
https://files.catbox.moe/h5df4p.png
https://files.catbox.moe/6l7s6c.png
https://files.catbox.moe/hdknpc.png
https://files.catbox.moe/w90638.png



https://s3.bmp.ovh/imgs/2023/10/16/d3172734dffa2adc.png
https://s3.bmp.ovh/imgs/2023/10/16/9d80541023cb3064.png
https://s3.bmp.ovh/imgs/2023/10/16/02353eb45b8ab0dd.png
https://s3.bmp.ovh/imgs/2023/10/16/82c91acca0b49348.png
https://s3.bmp.ovh/imgs/2023/10/16/fa4564b1c4929c3d.png
https://s3.bmp.ovh/imgs/2023/10/16/a8cb9ca0fd5090bc.png
https://s3.bmp.ovh/imgs/2023/10/16/7a3b70a6c86642e4.png
https://s3.bmp.ovh/imgs/2023/10/16/0bc3ccef0b4f7fc3.png
https://s3.bmp.ovh/imgs/2023/10/16/955f67e6c268b41d.png
https://s3.bmp.ovh/imgs/2023/10/16/f07a89308a110f35.png
https://s3.bmp.ovh/imgs/2023/10/16/14f13f5993e9f7be.png
https://s3.bmp.ovh/imgs/2023/10/16/bd39b3045c9baebf.png
https://s3.bmp.ovh/imgs/2023/10/16/794e6a7a4c38c415.png
https://s3.bmp.ovh/imgs/2023/10/16/635f6ebdc530d780.png
https://s3.bmp.ovh/imgs/2023/10/16/db5a20999e5af755.png
https://s3.bmp.ovh/imgs/2023/10/16/74ccd5e0b239f5ed.png
https://s3.bmp.ovh/imgs/2023/10/16/e9ec3c898798fbfa.png
https://s3.bmp.ovh/imgs/2023/10/16/23cb4b899fd1d69b.png
https://s3.bmp.ovh/imgs/2023/10/16/b495fe6a1a1b4aba.png
https://s3.bmp.ovh/imgs/2023/10/16/0ba337b3a96fa67e.png
https://s3.bmp.ovh/imgs/2023/10/16/d44e4f3c92bc3a1c.png
https://s3.bmp.ovh/imgs/2023/10/16/284f1f0de1b5d315.png
https://s3.bmp.ovh/imgs/2023/10/16/a37d9f3beeeb08e2.png
https://s3.bmp.ovh/imgs/2023/10/16/45c105f5a4112f11.png
https://s3.bmp.ovh/imgs/2023/10/16/c2993e7717e03874.png
https://s3.bmp.ovh/imgs/2023/10/16/5e1bbfa1f87c05bd.png
https://s3.bmp.ovh/imgs/2023/10/16/71208c83a0ceffe5.png
https://s3.bmp.ovh/imgs/2023/10/16/7f6b4caa82658484.png
https://s3.bmp.ovh/imgs/2023/10/16/8d513e1f0311862d.png
https://s3.bmp.ovh/imgs/2023/10/16/c2445a3d1b0a84b0.png
https://s3.bmp.ovh/imgs/2023/10/16/38ae1a080df15c50.png
https://s3.bmp.ovh/imgs/2023/10/16/dbbe9a1207b4e924.png
https://s3.bmp.ovh/imgs/2023/10/16/fb2782eeb4473fa1.png

https://www.wlyxmusic.net/data/attachment/forum/202310/17/162123dq89ug8eqg0s08es.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162126bcaii45nxcp2nuiy.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162130p9xe955vhoyhndfo.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162134r5jz05otxtljzvgt.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162137ofsbfg1sijd0ijgb.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162140sja1dldaycvpgcpg.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162145nbz8y2i6ygi2nuhh.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162149u9jpdbx11bdswys6.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162152y61fxo1ccnoq1glq.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162157x0kkzm6ekmuo23je.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162200wkyokoyu4zy4oza8.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162203t0hton58rqm29tr0.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162208vbqto6f91obzgmuq.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162212u52aasea6vyjrha7.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162216aem8cskkunl8gtrx.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162219pczebuue63vbb3vy.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162222yghalqtt32qvmqqz.png
https://www.wlyxmusic.net/data/attachment/forum/202310/17/162225kkdtqkcttd9ckg36.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123841zu9nqtsvznwjtva9.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123845krzgrlol7rljjud5.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123850lhav8opu8mb8gupm.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123855pzspc8nmbgpom8gc.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123900tmxewio9awg4gj6h.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123903l1wxjvnj1njxtdc0.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123908h3tu7x5z33am3hxm.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123911jtww2vjcjxkpz21a.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123913chrl9aj9h1dzr9ed.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123917t3ueffe96jtje2j3.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123921i73hkk3k3e356337.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123925jtibs1q91qsx66f6.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123930y889t70lwtljw8l9.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123932sgjg55rdjfeozvdf.png
https://www.ilovematlab.cn/data/attachment/forum/202310/21/123935ikg2t2uc9dgdvd2d.png

{2023年10月01日}2023冬季，全球 崩 盘，三 峡 溃 坝

{2023年10月01曰}2023冬季，全球 崩 盘，三 峡 溃 坝



作者 ： 薛桦镰
时间：2023年10月01曰 О8:49:57      星期曰      农历八月十七
         上正宗指 3110.48点    恒指 17809.66点   道指33507.50点
         囯际音乐节      囯际老人节
         


         
突然的，全球 金 融 市 场 连 续 跌 停 大 崩 盘，
没有什么，谁也没想到啊，友邦惊诧，黑 天 鹅 白天鹅 哥斯拉，
一切都是，蓄 谋 已 久 的精心策划。zéi 喊捉zéi。


{一} 今时今曰{癸卯2023年10月01曰 } ：
今时今曰，我预.测，人类有始.以来最大的金.融.崩 盘 ，未来三个月
之内，即，2023年11月、12月、2024年元月，将 震 撼呈 现。
---- 中卝囯股市、全球股市、全球金融市场 连序跌婷大崩 盘 ， 大盘连
       续或稍稍间断30/40多个跌亭板，人类有.史以来最大的金融.嗨啸。
股市、汇市、债市、期货商品、可能还有楼卝市，全部连卝锁式彻底崩溃。
黄 金 价 格 应 该 避 险 bào 涨。
忽 然 之 间 ，天 塌 了。{ 全 球 闪 崩 }
十 八 级 金融大 地.震，史无前例地球崩卝盘，要 多 惨 有 多惨，世界沫曰。
金融天坑，股市雪崩、铡 dāo 斩 首 、bào 雷 溃 坝 ，希 特 勒 巴巴罗萨
金融闪击战 。画 皮 ，终 于 撕 去 了 。
最热的天气，最冷的人心。
道琼斯，憋了14年的一泡shǐ{⑥440.О8}，2023冬季，总算找到了，公共厕所。
缠中说禅17年之前预卝言的，2019毁miè性下跌。{有四年误差}
已故“周期天王”周金涛的，“2018年到2019年是康波周期的万卝劫卝不卝复之年”。
以金.融战.争为表现形式的，第 叁 次.世.戒.大.战，全面 bào.发。
---- 一切友好互访探讨分歧，新型大囯关
页: [1]
查看完整版本: 汇编进程EPROCESS地址获取