过TP驱动4(硬件断点部分)

 NtGetThreadContext

NtSetThreadContext

需要处理一下

 

 概念性代码:

 

NTSTATUS MyNtGetThreadContext(HANDLE hThread, PCONTEXT pContext)
{
	PEPROCESS p = IoGetCurrentProcess();
	NTSTATUS status ;

	if ( strncmp((char*)p + 0x174, "DNF.exe",6) == 0)
	{
		if (MmIsAddressValid(pContext))
		{
			pContext->Dr0 = 0;
			pContext->Dr1 = 0;
			pContext->Dr2 = 0;
			pContext->Dr3 = 0;
			pContext->Dr7 = 0;
		}

	}else{
		status = RealNtGetContextThread(hThread,pContext);
	}

	return status;
}


 

 

NTSTATUS MyNtSetThreadContext(HANDLE hThread, PCONTEXT pContext)
{
	PEPROCESS p = IoGetCurrentProcess();
	NTSTATUS status ;

	if ( strncmp((char*)p + 0x174, "DNF.exe",6) == 0)
	{
		if (pContext->Dr7==0x101)
		{
			status = RealNtSetContextThread(hThread,pContext);
		}
	}else{
		status = RealNtSetContextThread(hThread,pContext);
	}

	return status;
}

 

 


 

 

阅读更多
个人分类: 驱动
想对作者说点什么? 我来说一句

硬件

硬件注意问题

Wang_yf_ Wang_yf_

2016-10-14 11:05:08

阅读数:177

没有更多推荐了,返回首页

加入CSDN,享受更精准的内容推荐,与500万程序员共同成长!
关闭
关闭