系统调用-API函数调用过程

.text:7C8021D0                 mov     edi, edi.text:7C8021D2                 push    ebp.text:7C8021D3                 mov     ebp, esp.text:7C8021D5                 lea     eax, [ebp+BufferLength].text:7C8021D8                 push    eax             ; ReturnLength.text:7C8021D9                 push    [ebp+BufferLength] ; BufferLength.text:7C8021DC                 push    [ebp+Buffer]    ; Buffer.text:7C8021DF                 push    [ebp+BaseAddress] ; BaseAddress.text:7C8021E2                 push    [ebp+ProcessHandle] ; ProcessHandle.text:7C8021E5                 call    ds:NtReadVirtualMemory.text:7C8021EB                 mov     ecx, [ebp+lpNumberOfBytesRead].text:7C8021EE                 test    ecx, ecx.text:7C8021F0                 jnz     short loc_7C8021FD.text:7C8021F2.text:7C8021F2 loc_7C8021F2:                           ; CODE XREF: ReadProcessMemory+32j.text:7C8021F2                 test    eax, eax.text:7C8021F4                 jl      short loc_7C802204.text:7C8021F6                 xor     eax, eax.text:7C8021F8                 inc     eax.text:7C8021F9.text:7C8021F9 loc_7C8021F9:                           ; CODE XREF: ReadProcessMemory+3Cj.text:7C8021F9                 pop     ebp.text:7C8021FA                 retn    14h.text:7C8021FD ; ---------------------------------------------------------------------------.text:7C8021FD.text:7C8021FD loc_7C8021FD:                           ; CODE XREF: ReadProcessMemory+20j.text:7C8021FD                 mov     edx, [ebp+BufferLength].text:7C802200                 mov     [ecx], edx.text:7C802202                 jmp     short loc_7C8021F2.text:7C802204 ; ---------------------------------------------------------------------------.text:7C802204.text:7C802204 loc_7C802204:                           ; CODE XREF: ReadProcessMemory+24j.text:7C802204                 push    eax             ; NtStatus.text:7C802205                 call    sub_7C8093FD.text:7C80220A                 xor     eax, eax.text:7C80220C                 jmp     short loc_7C8021F9

BOOL ReadProcessMemory(  HANDLE  hProcess,           // 目标进程的句柄  LPCVOID lpBaseAddress,      // 要读取的内存的起始地址  LPVOID  lpBuffer,           // 存储读取数据的缓冲区  SIZE_T  nSize,              // 要读取的字节数  SIZE_T  *lpNumberOfBytesRead // 读取的实际字节数);

mov     eax, 0BBh       ; 0BBh代表真正操作系统内核中某一个函数的编号mov     edx, 7FFE0300h  ;7FFE0300h存了一个函数，该函数决定了我们用什么方式进入0环call    dword ptr [edx]retn    4

BOOL WriteProcessMemory(  HANDLE  hProcess,  LPVOID  lpBaseAddress,  LPCVOID lpBuffer,  SIZE_T  nSize,  SIZE_T  *lpNumberOfBytesWritten);

// 重写WriteProcessMemory.cpp : Defines the entry point for the console application.//

#include "stdafx.h"#include <windows.h>



BOOL __declspec(naked) _stdcall WriteProcessMemory0( HANDLE  hProcess,LPVOID  lpBaseAddress,LPCVOID lpBuffer,SIZE_T  nSize,SIZE_T  *lpNumberOfBytesWritten){  _asm  {    mov     eax, 115h;    mov     edx, 7FFE0300h;    call    dword ptr [edx];    retn    14h;  }}

int main(int argc, char* argv[]){  int i = 0;  printf("WriteProcessMemory0 begin: i = %xn",i);  int buffer = 0x1234;  SIZE_T lpNumberOfBytesWritten;  BOOL ret = WriteProcessMemory0((HANDLE)GetCurrentProcess(),&i,&buffer,sizeof(int),NULL);

  printf("WriteProcessMemory0 end: i = %xn",i);  getchar();  return 0;}