蹂躏D&F学习之重复NtCreateFile(一开始一进去要+几个回车的)

最新推荐文章于 2024-05-24 20:31:20 发布

EXPENF

最新推荐文章于 2024-05-24 20:31:20 发布

阅读量569

点赞数

本文链接：https://blog.csdn.net/EXPENF/article/details/42745767

版权

//rlTenD.cpp
#include <ntddk.h><span style="font-family: Arial, Helvetica, sans-serif;">//加在这里要比加载头文件中好</span>
#include "SSDTHOOK.h"//加在这里要比加载头文件中好
#include "rlTenD.h"


NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING str)
{
	//驱动 ->驱动卸载=卸载驱动
	pDriver->DriverUnload = UnloadDriver;
	//调试输出
	DbgPrint("Loading MyDriver...\r");


	ULONG uAddr = GetSSDTAddr(0x42);
	if (uAddr)
	{
		KdPrint(("NtCreateFile: 0x%08x\r", uAddr));
	}
	return STATUS_SUCCESS;
}

void UnloadDriver(PDRIVER_OBJECT pDriver)
{
	//调试输出
	DbgPrint("unLoading MyDriver...\r");

}

===================================================================================================

//rlTenD.h


void UnloadDriver(PDRIVER_OBJECT pDriver);

===================================================================================================

//SSDTHOOK.cpp
#include "SSDTHOOK.h"

ULONG GetSSDTAddr(ULONG uIndex)
{
	ULONG uAddr = *(PULONG)((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
	return uAddr;
 }

===================================================================================================

//SSDTHOOK.cpp
#pragma once

#ifdef __cplusplus
exern "C"
#endif
#include <ntddk.h>
#include <string.h>
#ifdef __cplusplus
};
#endif

typedef struct _SDT_ENTRY
{
	PVOID *ServiceTableBase;
	PULONG ServiceCounterTableBase; //Used only in checked build
	ULONG NumberOfServices;
	PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;


EXTERN_C SDT_ENTRY *KeServiceDescriptorTable;

ULONG GetSSDTAddr(ULONG uIndex);