某ANTI的记录

Hook NtGdiBitBlt

{

sub_298();

}

sub_298()

{

EP=IoGetCurrentProcess();

sub_9cc(EP);

}

sub_9cc(EP)

{

if (MmIsAddressValid(EP))

{

DB4=1;

PID=sub_8d6(EP);

for (i=0;i<5;i++)

{

if ([F30+i*8]==PID)

{

[F30+i*8+4]++;

break;

}

if ([F30+i*8]==0)

{

[F30+i*8]=PID;

[F30+i*8+4]++;

break;

}

}

DB4=0;

}

}

sub_8d6(EP)

{

return PsGetProcessId(EP);

}