VM Anti-Dump技术与常见结构分析.pdfVIP

防转储推送fs:[30h]弹出eaxMOVEAX,[EAX+0Ch]

MOVEAX,[EAX+0Ch]MOVDWORDPTR[EAX+20h],0;将

内存镜像大小修改为0

_

0:kddtteb

***错误:模块加载完成，但无法加载LiveKdD.SYS的符号

_

ntdll!TEB

__

+0+0

x000NtTib:NTTIBx01c

+0

EnvironmentPointer:Ptr32Voidx020

__+0

ClientId:CLIENTIDx028

+0

ActiveRpcHandle:Ptr32Voidx02c

ThreadLocalStoragePointer:Ptr32Void+0

x030ProcessEnvironmentBlock:Pt