Skip to content

Instantly share code, notes, and snippets.

@wyyqyl
Last active December 15, 2015 08:09
Show Gist options
  • Save wyyqyl/5228315 to your computer and use it in GitHub Desktop.
Save wyyqyl/5228315 to your computer and use it in GitHub Desktop.
while (TRUE)
{
CLIENT_ID cid;
PVOID pThread;
PsCreateSystemThread(&hThread, 0L, NULL, NULL, &cid,
(PKSTART_ROUTINE)UnhookInt2E, NULL);
if (hThread)
{
PsLookupThreadByThreadId(cid.UniqueThread, (PETHREAD *)&pThread);
KeWaitForSingleObject(pThread, Executive, KernelMode, FALSE, NULL);
ZwClose(hThread);
if (nIDTUnhooked == nProcessors)
break;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment