?? record.log
字號:
ULONG i;
ULONG result;
nProcessCount = 0;
for (i = 0x80000000 ;i<0x90000000;i+=4){
result = VALIDpage(i);
if (result == VALID){
if (*(PULONG)i == 0x7ffdf000){
if(IsaRealProcess(i)){
DbgPrint("EPROCESS: 0x%x ",i-PEB_OFFSET);
// getnAme(i);
}
}
}
else if(result == PTE_INVALID){
i -=4;
i += 0x1000;//4k
}
else{
i-=4;
i+= 0x400000;//4mb
}
}
for (i = 0xf0000000 ;i<0xffbe0000;i+=4){
result = VALIDpage(i);
if (result == VALID){
if (*(PULONG)i == 0x7ffdf000){
if(IsaRealProcess(i)){
DbgPrint("EPROCESS: 0x%x ",i-PEB_OFFSET);
// getnAme(i);
}
}
}
else if(result == PTE_INVALID){
i -=4;
i += 0x1000;//4k
}
else{
i-=4;
i+= 0x400000;//4mb
}
}
DbgPrint("seArching finish \n");
?? 快捷鍵說明
復制代碼
Ctrl + C
搜索代碼
Ctrl + F
全屏模式
F11
切換主題
Ctrl + Shift + D
顯示快捷鍵
?
增大字號
Ctrl + =
減小字號
Ctrl + -