572
支付宝
[原创]另一种进入NT内核方法的汇编版本
.386.model flat, stdcalloption casemap:noneinclude c:masm32includewindows.incinclude c:masm32includeuser32.incinclude c:masm32includekernel32.incinclude c:masm32includeadvapi32.incincludelib c:masm32libuser32.libincludelib c:masm32libkernel32.libincludelib c:masm32libadvapi32.libinclude c:masm32macrosucmacros.asmUNICODE_STRING STRUCT _Length WORD ? MaximumLength WORD ? Buffer DWORD ?UNICODE_STRING ENDSSystemLoadAndCallImage equ 38_ZwSetSystemInformation typedef proto :dword,:dword,:dwordlpZwSetSystemInformation typedef ptr _ZwSetSystemInformation_RtlInitUnicodeString typedef proto :dword,:dwordlpRtlInitUnicodeString typedef ptr _RtlInitUnicodeStringSYSTEM_LOAD_AND_CALL_IMAGE struct ModuleName UNICODE_STRING <?>SYSTEM_LOAD_AND_CALL_IMAGE ends .consttxt db 'Just Do It!',0cp db 'hopy|侯佩',0WSTR drvnameW,"??c: mpDrv.sys"drvname db '??c:tmpDrv.sys',0dllname db 'ntdll.dll',0szZwSetSystemInformation db 'ZwSetSystemInformation',0szRtlInitUnicodeString db 'RtlInitUnicodeString',0 .data?hInstance dd ?hdll dd ?stSysCallImage SYSTEM_LOAD_AND_CALL_IMAGE <>ZwSetSystemInformation lpZwSetSystemInformation ?RtlInitUnicodeString lpRtlInitUnicodeString ? .codestart: invoke GetModuleHandle, 0 mov hInstance,eax invoke LoadLibrary,addr dllname mov hdll,eax invoke GetProcAddress,hdll,addr szZwSetSystemInformation mov ZwSetSystemInformation,eax invoke GetProcAddress,hdll,addr szRtlInitUnicodeString mov RtlInitUnicodeString,eax invoke RtlInitUnicodeString,addr stSysCallImage.ModuleName, addr drvnameW invoke ZwSetSystemInformation,SystemLoadAndCallImage, addr stSysCallImage, sizeof SYSTEM_LOAD_AND_CALL_IMAGE invoke MessageBox,NULL,addr txt,addr cp,MB_OK invoke ExitProcess,NULLend start
最后更新：2017-04-02 00:06:25