反OD调试支持不同版本OD

易语言 2020-06-22 16:04:21

ZwQueryInformationProcess (-1, 0, Info, 24, 0)
hProcess = OpenProcess (1040, 0, Info.InheritedFromUniqueProcessId)
Path = 取空白文本 (4096)
GetProcessImageFileNameA (hProcess, Path, 4096)
CloseHandle (hProcess)
文件名 = 取文本右边 (Path, 取文本长度 (Path) - 倒找文本 (Path, “\”, , 假))