Hook NtGdiBitBlt
{
sub_298();
}
sub_298()
{
EP=IoGetCurrentProcess();
sub_9cc(EP);
}
sub_9cc(EP)
{
if (MmIsAddressValid(EP))
{
DB4=1;
PID=sub_8d6(EP);
for (i=0;i<5;i++)
{
if ([F30+i*8]==PID)
{
[F30+i*8+4]++;
break;
}
if ([F30+i*8]==0)
{
[F30+i*8]=PID;
[F30+i*8+4]++;
break;
}
}
DB4=0;
}
}
sub_8d6(EP)
{
return PsGetProcessId(EP);
}
转载于:https://blog.51cto.com/chinahanwu/1641275