原文:https://www.pediy.com/kssd/pediy10/78997.html
这题得了100分哦。
驱动加载后,直接对对IoCreateFile函数进行PATCH,
PATCH前函数为:
00010522 call dword_10804 // 先调用原来的nt!IopCreateFile 00010528 mov [ebp+var_210], eax 0001052E mov eax, [ebp+var_210] 00010534 test eax, eax 00010536 jl short loc_105AD 00010538 mov edx, [esi+8] 0001053B cmp word ptr [edx], 206h 00010540 ja short loc_105AD 00010542 cmp dword ptr [edx+4], 0 00010546 jz short loc_105AD 00010548 cmp word ptr [edx], 0 0001054C jz short loc_105AD 0001054E mov eax, edx 00010550 movzx ecx, word ptr [eax] 00010553 mov esi, [eax+4] 00010556 mov eax, ecx 00010558 shr ecx, 2 0001055B lea edi, [ebp+var_20C] 00010561 rep movsd 00010563 mov ecx, eax 00010565 and ecx, 3 00010568 rep movsb 0001056A movzx eax, word ptr [edx] 0001056D and [ebp+eax+var_20C], 0 00010576 lea eax, [ebp+var_20C] 0001057C push eax ; wchar_t * 0001057D call ds:_wcsupr 00010583 lea eax, [ebp+var_20C] 00010589 mov [esp+220h+var_220], offset a360game360game ; "360GAME\\360GAME.TXT" 00010590 push eax ; wchar_t * 00010591 call ds:wcsstr 00010597 test eax, eax 00010599 pop ecx 0001059A pop ecx 0001059B jz short loc_105A7 0001059D and dword ptr [ebx], 0 000105A0 mov eax, 0C0000022h