IRP Hook检测

  1 BOOL IRPHookChk(IN PUNICODE_STRING pObjName) 
  2 { 
  3     PDRIVER_OBJECT pdrv = 0; 
  4     NTSTATUS status = ObReferenceObjectByName(pObjName,OBJ_CASE_INSENSITIVE,0,0,IoDriverObjectType,KernelMode,NULL,(PVOID *)&pdrv); 
  5     char szModulePath[256]; 
  6 
  7          ULONG dwRet; 
  8          PMODULES pmodule =(PMODULES)&pmodule; 
  9          ZwQuerySystemInformation(SystemModuleInformation,pmodule,0,&dwRet); 
 10          pmodule=(PMODULES)ExAllocatePoolWithTag(NonPagedPool,dwRet,'mod'); 
 11          ZwQuerySystemInformation(SystemModuleInformation,pmodule,dwRet,NULL); 
 12 
 13         for (int j=0;j<pmodule->dwNumberOfModules;j++) 
 14         { 
 15             if ((ULONG)pdrv->DriverStart >= (ULONG)pmodule->smi[j].Base  
 16         && (ULONG)pdrv->DriverStart< (ULONG)pmodule->smi[j].Base +  (ULONG)pmodule->smi[j].Size) 
 17             { 
 18                 strcpy(szModulePath,pmodule->smi[j].ImageName); 
 19                 break; 
 20 
 21             } 
 22         } 
 23 
 24 
 25      for (int i=0 ;i<IRP_MJ_MAXIMUM_FUNCTION;i++) 
 26      { 
 27          for (int j=0 ;j<pmodule->dwNumberOfModules;j++) 
 28          { 
 29              if ( (ULONG)pdrv->MajorFunction[i] > (ULONG)pmodule->smi[j].Base  
 30          &&  (ULONG)pdrv->MajorFunction[i] <   (ULONG)pmodule->smi[j].Base +  (ULONG)pmodule->smi[j].Size) 
 31              { 
 32                  if (j==0) 
 33                  { 
 34                      //在内核里，直接放行 
 35                      continue; 
 36                  } 
 37                 if (strcmp(szModulePath,pmodule->smi[j].ImageName)!=0) 
 38                 { 
 39                     DbgPrint("%wZ   %d  0x%x  %s  %s\n ",pObjName,i,pdrv->MajorFunction[i],szModulePath,pmodule->smi[j].ImageName); 
 40                 } 
 41             } 
 42         } 
 43     } 
 44 
 45 
 46     ObfDereferenceObject(pdrv); 
 47      ExFreePoolWithTag(pmodule,'mod'); 
 48 
 49     return TRUE; 
 50 } 
 51