UltraDebug

 找回密码
 立即注册

QQ登录

只需一步,快速开始

搜索
热搜: A C D R G Y M Z X S P
公益项目,接受捐赠
查看: 2631|回复: 0
收起左侧

[分享] Access violation at address XXX in module 'ntdll.dll'.的暴力解决

[复制链接]
admincenter

主题

0

回帖

UD

新手上路

UID
7
积分
33
注册时间
2021-12-26
最后登录
1970-1-1
2023-8-12 23:02:34 | 显示全部楼层 |阅读模式
剧情是这个样子的:
编译了一个x64dbg插件模块
Access violation at address XXX in module 'ntdll.dll'.的暴力解决 - admincenter_UltraDebug

当在x64dbg标题栏按Window+A时就会
Access violation at address XXX in module 'ntdll.dll'.的暴力解决 - admincenter_UltraDebug

Access violation at address XXX in module 'ntdll.dll'.write of address YYY.之后截获窗口标题
奇怪的是在其他窗口按键也完全正常。。。你说奇怪不奇怪?
[Delphi] 纯文本查看 复制代码
procedure TCapture_Window.hotykey(var msg: TMessage);
var
pid: Cardinal;
  pHandle: THandle;
  buf: array[0..MAX_PATH] of Char;
  ps: array[0..254] of Char;       // 这个是定义激活的窗口的控件名
  path: string;                   // 激活窗口的路径
  arr: array[0..254] of Char;
  h: HWND;
  pt: TPoint;
  c: TColor;
begin
  if (GetAsyncKeyState(VK_LWIN) and (GetAsyncKeyState(Ord('A'))) < 0) then        // Win+A
  begin
    h := GetForegroundWindow; 
    GetWindowThreadProcessId(h, @pid);
    pHandle := OpenProcess(PROCESS_ALL_ACCESS, False, pid);
    GetModuleFileNameEx(pHandle, 0, buf, Length(buf));
    CloseHandle(pHandle);
GetWindowText(h, @arr, SizeOf(arr));
    GetClassName(h, ps, 255);
    path := GetProcessExePath(h);
    Capture_Window.KJ_Edit1.Text := arr;       //x64dbg的完整窗口标题
end;
SyntaxHighlighter Copyright 2004-2013 Alex Gorbatchev.
无奈,还是直接上x64dbg直接开干吧。。。
Access violation at address XXX in module 'ntdll.dll'.的暴力解决 - admincenter_UltraDebug

Access violation at address XXX in module 'ntdll.dll'.的暴力解决 - admincenter_UltraDebug
是吧? 边走边看。
[Asm] 纯文本查看 复制代码
000000006D525E70 | 55                     | push rbp                                |
000000006D525E71 | 48:81EC D0000000       | sub rsp,D0                              |
000000006D525E78 | 48:8BEC                | mov rbp,rsp                             |
000000006D525E7B | 48:896D 48             | mov qword ptr ss:[rbp+48],rbp           |
000000006D525E7F | 48:898D E0000000       | mov qword ptr ss:[rbp+E0],rcx           |
000000006D525E86 | 48:8995 E8000000       | mov qword ptr ss:[rbp+E8],rdx           |
000000006D525E8D | 4C:8985 F0000000  
还有更多的精彩内容,作者设置为付费后可见
UltraDebug免责声明
✅以上内容均来自网友转发或原创,如存在侵权请发送到站方邮件9003554@qq.com处理。
✅The above content is forwarded or original by netizens. If there is infringement, please send the email to the destination 9003554@qq.com handle.
回复 打印

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

小黑屋|Archiver|站点地图|UltraDebug ( 滇ICP备2022002049号-2 滇公网安备 53032102000034号)

GMT+8, 2026-1-17 03:10 , Processed in 0.042197 second(s), 12 queries , Redis On.

Powered by Discuz X3.4

© 2001-2023 Discuz! Team.

快速回复 返回顶部 返回列表