这段代码展示了在Windows内核中如何使用APC（异步过程调用）进行读写进程内存的操作。`APCReadProcessMemory`函数通过`KeStackAttachProcess`挂载目标进程，`ProbeForRead`安全检查后读取数据。`APCWriteProcessMemory`不仅读写内存，还涉及了`Cr0`寄存器的修改，以禁用写保护。
BOOLEAN APCReadProcessMemory(ULONG PID, PVOID targetaddress, ULONG length, PVOID retdata){
PEPROCESS pepro; KAPC_STATE kapc = { 0 }; pepro = LookupProcess((HANDLE)PID); if (pepro == NULL) return FALSE;
ObDereferenceObject(pepro); __try {
KeStackAttachProcess(pepro, &kapc);
ProbeForRead(targetaddress, length, sizeof(CHAR));
RtlCopyMemory(retdata, targetaddress, length);
KeUnstackDetachProcess(&kapc);
__except (EXCEPTION_EXECUTE_HANDLER) {
KeUnstackDetachProcess(&kapc);
return FALSE;
}
return TRUE;
}
BOOLEAN APCWriteProcessMemory(ULONG PID, PVOID targetaddress, ULONG length, PVOID Indata){
PEPROCESS pepro; KAPC_STATE kapc = { 0 }; pepro = LookupProcess((HANDLE)PID);
if (pepro == NULL) return FALSE;
ObDereferenceObject(pepro); ULONG64 Cr0;
__try {
KeStackAttachProcess(pepro, &kapc);
Pr
最低0.47元/天 解锁文章
1079
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
