posted on 2007-09-24 15:08 叶子 阅读(4673) 评论(2) 编辑 收藏 引用 所属分类: 技术研究
这是ring0的代码么? 回复 更多评论
NtUnmapViewOfSection可以再Ring3下使用。 我用VB做给你看 Private Declare Function NtUnmapViewOfSection Lib "ntdll.dll" (ByVal ProcessHandle As Long ,ByVal BaseAddress As Long)As Long Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long ,ByVal bInheritHandle As Boolean, ByVal dwProcessId As Long)As Long Private Declare Function GetModuleHandleA Lib "kernel32" (ByVal lpModuleFileName As String) As Long Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long Private Sub UnloadNtdll(ByVal PID As Long) Dim hProc As Long hProc = OpenProcess(&h8 Or &H400, False, PID) If hProc = 0 Then Exit Sub NtUnmapViewOfSection hProc, GetModuleHandleA("ntdll.dll") CloseHandle hProc End Sub 回复 更多评论
Powered by: C++博客 Copyright © 叶子