Thread: ScyllaHide
View Single Post
  #11  
Old 04-15-2014, 17:37
ZeNiX's Avatar
ZeNiX ZeNiX is offline
Administrator
  
Join Date: Feb 2009
Posts: 735
Rept. Given: 177
Rept. Rcvd 772 Times in 259 Posts
Thanks Given: 226
Thanks Rcvd at 910 Times in 247 Posts
ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899
Problem solved.
After downloaded the symbols, we need to use pdb-getprocaddress to get three addresses.

In my system, they are...

[060200000109_x86_000162F9]
NtUserQueryWindow=00009965
NtUserBuildHwndList=0000FBB1
NtUserFindWindowEx=0000804C
Reply With Quote