|
发表于 2009-12-30 19:45:10
|
显示全部楼层
跟他废什么话啊,直接这么写:
NTSTATUS fake_NtOpenProcess(OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttribtes,IN PCLIENT_ID ClientId OPTIONAL)
{
NTSTATUS nsReturn;
PEPROCESS pKill;
PsLookupProcessByProcessId((ULONG)ClientId->UniqueProcess,&pKill);
if (aProcesses == (ULONG)pKill)
{
ClientId->UniqueProcess=PsGetCurrentProcessId();
}
else
{
nsReturn = odNtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttribtes,ClientId);
}
return nsReturn;
} |
|