GamesGuard (NP)驱动分析 详解.pdfVIP

GamesGuard (NP)驱动分析 详解 学习各种高级外挂制作技术，马上去百度搜索 魔鬼作坊，点击第一个站进入， 快速成为做挂达人。 14个函数 53NtCreateThread 68NtDuplicateObject 122NtOpenProcess// 128NtOpenThread // 137NtProtectVirtualMemory 154NtQueryInformationProcess 155NtQueryInformationThread //7C8105BC . FF15 3811807C CALL DWORD PTR DS:[ntdll.NtQueryInformationThread] ; \ZwQueryInformationThread 173NtQuerySystemInformation 178NtQueryVirtualMemory 180NtQueueApcThread 186NtReadVirtualMemory 228NtSetInformationProcess 255NtSystemDebugControl 277NtWriteVirtualMemory RtlPrefetchMemoryNonTemporal Ke386IoSetAccessProcess KeInsertQueueApc KeUserModeCallback PsLookUpThreadByThreadID PsLookupProcessByProcessId //805d4122 ObReferenceObjectByHandle ??KeAttachProcess ??PsSetCreateProcessNotifyRoutine ??PsSetCreateThreadNotifyRoutine ??PsSetLoadImageNotifyRoutine //用RemoveNotifyRoutine 清空回调函数 导出函数的hook NtAllocateVirtualMemory+0x15A 处 PsPCreateThread+0x4F处 //805D1116 //805D1124 ObReferenceObjectByHandle 0:kd u ObReferenceObjectByHandle l 11 nt!ObReferenceObjectByHandle: 805bc49e8bff mov edi,edi 805bc4a055 push ebp 805bc4a18bec mov ebp,esp 805bc4a351 push ecx 805bc4a453 push ebx 805bc4a556 push esi 805bc4a657 push edi 0:kd upspCreateThread+30l 30 nt!PspCreateThread+0x30: 805d1106e033 loopne nt!PspCreateThread+0x65 (805d113b) 805d1108db895dc03975 fisttp dwordptr[ecx+7539C05Dh] 805d110e1474 adc al,74h 805d111020568d and byteptr[esi-73h],dl 805d111345 inc ebp 805f75 adc byte ptr[eax-1],75h 805d1118dcff fdiv st(7),st 805d111a 35b8495680 xor eax,offsetnt!PsProcessType(805649b8) //从805d1000 开始找 nt!PsProcessType 地址+A 80