NTSTATUS __stdcall lfOpenObjectByName(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
PUCHAR InstPool= NULL;
UNICODE_STRING ApiName = RTL_CONST_STRING( L"ObOpenObjectByName" );
PVOID _ObOpenObjectByName = MmGetSystemRoutineAddress(&ApiName);
if( _ObOpenObjectByName )
{
InstPool = (PUCHAR)ExAllocatePoolWithTag( NonPagedPool, 5, 'x360');
if( InstPool )
{
*InstPool = 0xC3;
__asm
{
push loc_ret
push Handle
push ParseContext
push DesiredAccess
push AccessState
push AccessMode
push ObjectType
push ObjectAttributes
push InstPool
mov eax , _ObOpenObjectByName
jmp eax
loc_ret:
mov Status, eax
}
ExFreePoolWithTag( InstPool,'x360' );
}
}
return Status;
}
转载于:https://my.oschina.net/ejoyc/blog/93699