二级C++实例(一个特别的驱动加载方式)
我们一起来研究一下。好像有时候会出现蓝屏,跟分页有关
typedef struct _ system _ load _ and _ call _ image
{
Unicode _ String Modulename;
} SYSTEM _ LOAD _ AND _ CALL _ IMAGE,* PSYSTEM _ LOAD _ AND _ CALL _ IMAGE
# define SYSTEM loadandcallimage 38
bool LOAD _ sysfile()
{
SYSTEM _ LOAD _ AND _ CALL _ IMAGE GregsImage;
WCHAR daPath[] = L"\??\C:\MIGBOT。SYS ";
RtlInitUnicodeString =(RtlInitUnicodeString)
GetProcAddress(GetModuleHandle(" ntdll . dll ")
," RtlInitUnicodeString "[br/])
ZwSetSystemInformation =(ZwSetSystemInformation)
GetProcAddress(
GetModuleHandle(" ntdll . dll ")
," ZwSetSystemInformation ")
rtliniModuleName)
,daPath
);
ZwSetSystemInformation(SystemLoadAndCallImage,
,sizeof(SYSTEM _ LOAD _ AND _ CALL _ IMAGE)))
返回true
}
0条评论