None

来源:互联网 发布:免费阅读软件 编辑:程序博客网 时间:2024/06/07 20:02

VOID HookPage(PUCHAR Page)
{
  PHARDWARE_PTE_X86PAE PointerPte;
  __try {

    __asm { 
      mov   eax, Page 
      mov   eax, [eax]
    }
    PointerPte = (PHARDWARE_PTE_X86PAE)MiGetPteAddressPAE(Page);

    if (PointerPte->Valid == 1) {
      PointerPte->ExecuteDisable = 1;
      DbgPrint("HookPage = %08X", Page);
    }
  }
  __except(EXCEPTION_EXECUTE_HANDLER) {
    DbgPrint("Exception captured while hooking page");
  }
}

VOID UnhookPage(PUCHAR Page)
{
  PHARDWARE_PTE_X86PAE PointerPte;

  __try {
    __asm {
      mov  eax, Page 
      mov  eax, [eax]
    }

    PointerPte = (PHARDWARE_PTE_X86PAE)MiGetPteAddressPAE(Page);

    if (PointerPte->Valid == 1) {
      PointerPte->ExecuteDisable = 0;
    }
  }
  __except(EXCEPTION_EXECUTE_HANDLER) {
    DbgPrint("Exception captured while unhooking page");
  }
}

原创粉丝点击