瓜蛋的博客

摘要： 读取当前地址代码(NtOpenProcess):LONG *SSDT_Adr,t_addr,adr;t_addr=(LONG)KeServiceDescriptorTable->ServiceTableBase;SSDT_Adr=(PLONG)(t_addr+0x7a*4);adr=*SSDT_Adr;读取起源地址(NtOpenProcess):UNICODE_STRING SysRoutineName;LONG orgadr;‍RtlInitUnicodeString(&SysRoutineName,L"NtOpenProcess");‍orgadr=(LO 阅读全文

摘要： /*--------- 1.c -----------*/#include "1.h"//---------列举进程---------NTSTATUS EnumProcess(){int iCount = 1; //进程计数NTSTATUS status; //返回值PVOID pSi = NULL; /*指向SystemInformationClass的指针，此处为SystemProcessesAndThreadsInformation，即我们所要获取的信息*/PSYSTEM_PROCESS_INFORMATION pSpiNext = NULL; //同上ULONG u 阅读全文

摘要： 顺手记一记。呵呵修改寄存器命令r @eax=1 //将eax置为1修改内存命令ed 80505648 00001234 //将内存为80505648的数据改为00001234 阅读全文

摘要： 1、路径中不要有空格2、提示找不到头文件sourceannotations.h。把C:\Program Files\Microsoft Visual Studio 10.0\VC\include\下的CodeAnalysis 文件夹复制到C:\WinDDK\7600.16385.1\inc\api 下即可 阅读全文

摘要： Hi,This is just a little starter for people interested in starting Kernel-Mode DevelopmentBy following an good thread on UIC forum, opened by a beginner that wanted to know how to start with Device Driver Development, I remembered that long time ago published a similar blog post on that subject.Now 阅读全文

摘要： 装上CB2010，将以前的工程转过来，首先碰到的问题是AnsiString->UnicodeString。要想把程序彻底的改成Unicode,我总结了以下几点: 1，菜单Project->Options->Directories and Conditionals->_TCHAR maps to char 改为 wchar_t。（C++Builer2010的帮助文件中说，要使用VCL，这是必须的） 。 2，WinMain() 改成 _tWinMain。（新建工程不用改）。 3，const char s[N] = "abc"; 改成 const wcha 阅读全文

摘要： 可以用为分享代码，也可以在线编译，8错。呵呵http://codepad.org/ 阅读全文

摘要： select 'drop table ' || table_name ||';'||chr(13)||chr(10) from user_tables; --delete tablesselect 'drop view ' || view_name||';'||chr(13)||chr(10) from user_views; --delete viewsselect 'drop sequence ' || sequence_name||';'||chr(13)||chr(10) from user 阅读全文

摘要： //c++:HANDLE(void *) ---- c#:System.IntPtr //c++:Byte(unsigned char) ---- c#:System.Byte //c++:SHORT(short) ---- c#:System.Int16 //c++:WORD(unsigned short) ---- c#:System.UInt16 //c++:INT(int) ---- c#:System.Int16 //c++:INT(int) ---- c#:System.Int32 //c++:UINT(unsigned int) ---- c#:System.UInt16 //c 阅读全文

摘要： NOTICE: I am a C# noob and this tutorial is for other C# noobs. I have no doubt that I have broken countless C# coding conventions and good practices and it is best to assume the way I did everything is one of the least efficient possible. Credits go to many people, some of which I will mention towa 阅读全文