 |
|
ดู processhacker
1. query Start Process
Code (C++)
PhGetThreadStartAddress(
_In_ HANDLE ThreadHandle,
_Out_ PVOID *StartAddress
)
{
return NtQueryInformationThread(
ThreadHandle,
ThreadQuerySetWin32StartAddress,
StartAddress,
sizeof(PVOID),
NULL
);
}
2. symbol file (pdb)
3. query symbol file หา function name จะได้ค่า
ModuleName.dll+<startAddress - moduleBase>
Code (C++)
data->StartAddressString = PhGetSymbolFromAddress(
data->ThreadProvider->SymbolProvider,
data->ThreadItem->StartAddress,
&data->StartAddressResolveLevel,
&data->StartAddressFileName,
NULL,
NULL
);
4. Suspend
Code (C++)
SuspendThread(threadHandle);
|
 |
 |
 |
 |
| Date :
2020-06-26 22:07:35 |
By :
PhrayaDev |
|
 |
 |
 |
 |
|
|
 |
