约有 112 项符合查询结果， 以下是第 6 - 12项。
费时 < 1 秒。
setup程序和普通的启动没什么区别，只是NTLDR和OSKRNL有一些特殊对待，一样上BOOT DEBUGGER就可以了~
楼主这都不会还做BIOS啊。。
Posted in Windows内核调试
by
MJ0011
on 2009-05-01
验证了一下~
HMODULE hlib = LoadLibrary(''ntdll.dll'');
PVOID p = GetProcAddress(hlib , ''ZwQuerySystemInformation'');
SYSTEM_PERFORMANCE_INFORMATION info ;
SYSTEM_BASIC_INFORMATION basinfo ;
ULONG cb = sizeof(info);
ULONG cb1 = sizeof(basinfo);
__asm
{
push 0
push cb1
lea eax ,basinfo
push eax
push 0 ...
Posted in Windows内核调试
by
MJ0011
on 2009-04-28
PF Usage(页面文件使用量）是通过ZwQuerySystemInformation(SystemPerformanceInformation)获取的
typedef struct _SYSTEM_PERFORMANCE_INFORMATION {
LARGE_INTEGER IdleProcessTime;
LARGE_INTEGER IoReadTransferCount;
LARGE_INTEGER IoWriteTransferCount;
LARGE_INTEGER IoOtherTransferCount;
ULONG IoReadOperationCount;
ULONG ...
Posted in Windows内核调试
by
MJ0011
on 2009-04-27
NtRaiseHardError 就是通过LPC给CSRSS的winsrv.dll里的UserHardError弹框的~
用这个还可以实现驱动级弹框~
Posted in Windows内核调试
by
MJ0011
on 2009-04-19
[0Day]Windows NT4/2000/XP（全补丁）内核任意地址写入漏洞2009-03-30 22:38作者：MJ0011
日期：2009.3.30
Windows ...
Posted in Windows内核
by
MJ0011
on 2009-03-30
当然会使用了，否则堆栈怎么切换过去？否则为什么要通过EDX来让内核知道用户栈在哪里？否则为什么需要在call ebx(system service routine)前做堆栈参数COPY？
参考代码：
mov esi, edx ; (esi)->User arguments
mov ebx, [edi]+SdNumber ; get argument table address
xor ecx, ecx
mov cl, byte ptr [ebx+eax] ; (ecx) = argument size
mov ...
Posted in CPU架构
by
MJ0011
on 2009-03-28
wmi
Select ProcessorId From Win32_Processor
Posted in WinDbg
by
MJ0011
on 2009-03-20