pwp
This commit is contained in:
CSlime 2021-10-20 14:01:07 +08:00
parent 45d04c9f93
commit 461dbb0fac
6 changed files with 16 additions and 1 deletions

View File

@ -1,3 +1,6 @@
//author :cslime
//https://github.com/CS1ime/DICHook
#include "DDKCommon.h"
#include "MyMemoryIo64.h"
#pragma comment(lib,"oldnames.lib")

View File

@ -1,3 +1,6 @@
//author :cslime
//https://github.com/CS1ime/DICHook
#pragma once
#ifndef __DDKCOMMON_INCLUDED_

View File

@ -226,7 +226,7 @@ VOID DispatchCallback(ULONG64 pRsp) {
if (RspOffset_NtQuery == 0 && DispatchControl::enable_ntq) {
if (Rsp[0] == 0xCC22334455666688) {
if (Rsp[1] == 0xAA77665544333399) {
//搜索栈上Object偏移
//搜索栈上参数偏移
ULONG64 OLRSP = (ULONG64)Rsp;
for (int j = 0; OLRSP > pRsp && j < 0x800; OLRSP -= 8, j += 8) {
if (*(ULONG64*)OLRSP == NtQueryVolumeInformationFileRet) {

View File

@ -1,3 +1,6 @@
//author :cslime
//https://github.com/CS1ime/DICHook
#pragma once
#ifndef _SPOOFER_INCLUDED_

View File

@ -1,3 +1,6 @@
//author :cslime
//https://github.com/CS1ime/DICHook
#include "MyMemoryIo64.h"
DWORD64 g_PteBase = NULL;

View File

@ -1,3 +1,6 @@
//author :cslime
//https://github.com/CS1ime/DICHook
#pragma once
#ifndef __MyMempryIO64___Included___