Windows系统调用中API的3环部分(依据分析重写ReadProcessMemory(2)

 1 #include "pch.h"
 2 #include <iostream>
 3 #include <algorithm>
 4 #include <Windows.h>
 5 void  ReadMemory(HANDLE hProcess,PVOID pAddr,PVOID pBuffer,DWORD dwSize,DWORD  *dwSizeRet)  6 {  7 
 8  _asm  9  { 10         lea     eax,[ebp + 0x14] 11  push eax 12         push[ebp + 0x14] 13         push[ebp + 0x10] 14         push[ebp + 0xc] 15         push[ebp + 8] 16         sub esp,4
17         mov eax,0x115
18         mov edx,0X7FFE0300   //sysenter不能直接调用，我间接call的
19  CALL DWORD PTR[EDX] 20         add esp,24
21 
22  } 23 } 24 int main() 25 { 26     HANDLE hProcess = 0; 27     int t = 123; 28  DWORD pBuffer; 29     //hProcess = OpenProcess(PROCESS_ALL_ACCESS,a);
30     ReadMemory((HANDLE)-1,(PVOID)&t,&pBuffer,sizeof(int),0); 31     printf("%X\n",pBuffer); 32     ReadProcessMemory((HANDLE)-1,0); 33     printf("%X\n",pBuffer); 34 
35  getchar(); 36     return 0; 37 }

（编辑：ASP站长网）