当前位置：网站首页>绕过ObRegisterCallbacks需要驱动签名方法

绕过ObRegisterCallbacks需要驱动签名方法

2022-07-02 09:45:00 【如鹿渴慕泉水】

windbg直接改代码
修改之前

nt!ObRegisterCallbacks+0x11d:
fffff800`052a1d3d e83e82faff      call    nt!MmVerifyCallbackFunction (fffff800`05249f80)
fffff800`052a1d42 3bc3            cmp     eax,ebx
fffff800`052a1d44 747b            je      nt!ObRegisterCallbacks+0x1a1 (fffff800`052a1dc1)  Branch

修改后

nt!ObRegisterCallbacks+0x11d:
fffff800`052a1d3d b801000000      mov     eax,1
或者
eb nt!ObRegisterCallbacks+0x11d b8 01 00 00 00

就不会STATUS_ACCESS_DENIED
The callback routines do not reside in a signed kernel binary image.

原网站

版权声明
本文为[如鹿渴慕泉水]所创，转载请带上原文链接，感谢
https://cbwang505.blog.csdn.net/article/details/125405191

边栏推荐

There is a hidden danger in CDH: the exchange memory used by the process of this role is XX megabytes. Warning threshold: 200 bytes
怎样写一篇赏心悦目的英文数学论文
Leetcode - < dynamic planning special> Jianzhi offer 19, 49, 60
"As a junior college student, I found out how difficult it is to counter attack after graduation."
防抖节流
计数类DP AcWing 900. 整数划分
China traffic sign detection data set
Fluent fluent library encapsulation
区间DP AcWing 282. 石子合并
AI mid stage technology research

随机推荐

浏览器node事件循环
Openssh remote enumeration username vulnerability (cve-2018-15473)
drools执行完某个规则后终止别的规则执行
AI中台技术调研
String palindrome hash template question o (1) judge whether the string is palindrome
H5 to app
哈希表 AcWing 840. 模拟散列表
[I'm a mound pytorch tutorial] learning notes
Record the range of data that MySQL update will lock
Sub thread get request
Go learning notes - go based interprocess communication
kubenetes中port、targetPort、nodePort、containerPort的区别与联系
Go learning notes - multithreading
FBX import under ue4/ue5 runtime
[ybtoj advanced training guide] similar string [string] [simulation]
Go学习笔记—多线程
深拷貝事件總線
Leetcode - Sword finger offer 51 Reverse pairs in an array
Floyd AcWing 854. Floyd求最短路
接口测试面试题目，你都会了吗？

当前位置：网站首页>绕过ObRegisterCallbacks需要驱动签名方法

绕过ObRegisterCallbacks需要驱动签名方法

边栏推荐

猜你喜欢

随机推荐