1.DebugObect对象
2.收集事件
3.读写内存 处理
4.内存属性修改
5.调试API组件
6.PEB 标识位begin
7.DebugObect 移位
#效果图如下:
#ps:正常附加下段调试
Dbgk.c 调试事件采集函数 应该是梦无极调试教程 火哥完善
如果对你有帮助的话，希望可以点一下star呀
forked from test0x101/EtwHookDbg
-
Notifications
You must be signed in to change notification settings - Fork 0
10010100111000/EtwHookDbg
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
About
No description, website, or topics provided.
Resources
Stars
Watchers
Forks
Releases
No releases published
Packages 0
No packages published
Languages
- C 98.0%
- Assembly 2.0%