Thread: ScyllaHide
View Single Post
  #16  
Old 04-15-2014, 17:37
ZeNiX's Avatar
ZeNiX ZeNiX is offline
Administrator
 
Join Date: Feb 2009
Posts: 712
Rept. Given: 172
Rept. Rcvd 767 Times in 256 Posts
Thanks Given: 193
Thanks Rcvd at 694 Times in 220 Posts
ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899 ZeNiX Reputation: 700-899
Problem solved.
After downloaded the symbols, we need to use pdb-getprocaddress to get three addresses.

In my system, they are...

[060200000109_x86_000162F9]
NtUserQueryWindow=00009965
NtUserBuildHwndList=0000FBB1
NtUserFindWindowEx=0000804C
Reply With Quote