DynamoRIO/suite/tests/security-win32/hooker-ntdll.template-代码预览-DynamoRIO:运行时代码操控系统，支持多平台程序分析与优化 - AtomGit

DDerek BrueningCode cleanup: remove trailing spaces and tabs
067ac649创建于 2014年2月22日历史提交
ready to hook
ok: can't write
VirtualProtect(LdrLoadDll[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked LdrLoadDll
#endif
restored old code
VirtualProtect(LdrLoadDll[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
ok: can't write
VirtualProtect(LdrLoadDll[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked LdrLoadDll
#endif
restored old code
VirtualProtect(LdrLoadDll[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
ok: can't write
VirtualProtect(NtFlushInstructionCache[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked NtFlushInstructionCache
#endif
restored old code
VirtualProtect(NtFlushInstructionCache[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
ok: can't write
VirtualProtect(NtFlushInstructionCache[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked NtFlushInstructionCache
#endif
restored old code
VirtualProtect(NtFlushInstructionCache[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
ok: can't write
VirtualProtect(NtFlushWriteBuffer[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked NtFlushWriteBuffer
#endif
restored old code
VirtualProtect(NtFlushWriteBuffer[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
ok: can't write
VirtualProtect(NtFlushWriteBuffer[0x00000000],4096,PAGE_EXECUTE_READWRITE,prev) = 0 GLE=00000000 prev=00000020
#if !defined(handle_ntdll_modify) && !defined(thin_client)
there be witches! what happened to my write?
#else
hooked NtFlushWriteBuffer
#endif
restored old code
VirtualProtect(NtFlushWriteBuffer[0x00000000],4096,PAGE_EXECUTE_READ,...) = 0 GLE=00000000
#if !defined(handle_ntdll_modify) && !defined(thin_client)
old permissions ...prev=00000020)
#else
old permissions ...prev=00000040)
#endif
ok: can't write
all should be good
hooking done with