![]() |
|
|
|
#1
|
||||
|
||||
|
crash spot = softice tries to get cr3 value from EPROCESS struct.
Only thing that comes to my mind is that internal structures might be changed. Can you at least provide us with disassembly of ntoskrnl.exe!PsGetCurrentProcess , I just wanna be sure that internal structs haven't changed.
__________________
http://accessroot.com |
|
#2
|
|||
|
|||
|
WinXP: ntoskrnl.exe!PsGetCurrentProcess
Code:
mov eax, fs:[124] mov eax, [eax+44] ret Code:
mov eax, fs:[124] mov eax, [eax+38] ret |
![]() |
| Thread Tools | |
| Display Modes | |
|
|