32位/64位WINDOWS驱动之遍历Process,Thread Object勾子遍历驱动模块

a756598009

已于 2023-07-09 14:02:16 修改

阅读量483

点赞数 1

分类专栏： MFCC++编程驱动开发文章标签： windows 单片机 stm32 驱动开发服务器嵌入式硬件

于 2023-07-09 14:01:29 首次发布

本文链接：https://blog.csdn.net/a756598009/article/details/131622257

版权

32位/64位WINDOWS驱动之遍历Process,Thread Object勾子遍历驱动模块

PsLoadedModuleList是Windows加载的所有内核模块构成的链表的表头，
利用它可以枚举所有这些模块的信息，这些信息可用在AntiRootkit等方面

一、驱动层添加一个筛选器为遍历对象回调勾子信息，在加一个遍历对象回调勾子信息.c文件

在这里插入图片描述
代码如下：

#include<ntifs.h>

static ULONG ObjectCallbackListOffset = 0;
extern PSHORT NtBuildNumber;
//根据地址 判断所属驱动模块
BOOLEAN ObGetDriverNameByPoint(ULONG_PTR Point,OUT WCHAR* szDriverName);
//获取PsLoadedModuleList地址，方便判断地址所属模块
PVOID GetPsLoadedListModule();
PVOID GetMovPoint(PVOID pCallPoint);

//获取未文档化的函数
PVOID GetUndocumentFunctionAddress(IN PUNICODE_STRING pFunName,
	IN PUCHAR pStartAddress,
	IN UCHAR* pFeatureCode,
	IN ULONG FeatureCodeNum,
	ULONG SerSize,
	UCHAR SegCode,
	ULONG AddNum,
	BOOLEAN ByName);

//遍历所有 进程  线程  注册的ObRegisterCallBacks回调
ULONG EnumObRegisterCallBacks();




typedef struct _LDR_DATA
{
   
	/*0x000*/     struct _LIST_ENTRY InLoadOrderLinks;
	/*0x010*/     struct _LIST_ENTRY InMemoryOrderLinks;
	/*0x020*/     struct _LIST_ENTRY InInitializationOrderLinks;
	/*0x030*/     VOID*        DllBase;
	/*0x038*/     VOID*        EntryPoint;
	/*0x040*/     ULONG32      SizeOfImage;
	/*0x044*/     UINT8        _PADDING0_[0x4];
	/*0x048*/     struct _UNICODE_STRING FullDllName;
	/*0x058*/     struct _UNICODE_STRING BaseDllName;
	/*0x068*/     ULONG32      Flags;
	/*0x06C*/     UINT16       LoadCount;
	/*0x06E*/     UINT16       TlsIndex;
	union
	{
   
		/*0x070*/         struct _LIST_ENTRY HashLinks;
		struct
		{
   
			/*0x070*/             VOID*        SectionPointer;
			/*0x078*/             ULONG32      CheckSum;
			/*0x07C*/             UINT8        _PADDING1_[0x4];
		};
	};
	union
	{
   
		/*0x080*/         ULONG32      TimeDateStamp;
		/*0x080*/         VOID*        LoadedImports;
	};
	/*0x088*/     struct _ACTIVATION_CONTEXT* EntryPointActivationContext;
	/*0x090*/     VOID*        PatchInformation;
	/*0x098*/     struct _LIST_ENTRY ForwarderLinks;
	/*0x0A8*/     struct _LIST_ENTRY ServiceTagLinks;
	/*0x0B8*/     struct _LIST_ENTRY StaticLinks;
	/*0x0C8*/     VOID*        ContextInformation;
	/*0x0D0*/     UINT64       OriginalBase;
	/*0x0D8*/     union _LARGE_INTEGER LoadTime;
}LDR_DATA, *PLDR_DATA;

//这里字节对齐要采用默认，不要按1对齐，这样才符合32位和64位结构体
typedef struct _LDR_DATA_TABLE_ENTRY
{
   
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;//模块基址
	PVOID EntryPoint;//入口点
	ULONG SizeOfImage;//模块大小
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	union
	{
   
		LIST_ENTRY HashLinks;
		struct
		{
   
			PVOID SectionPointer;
			ULONG CheckSum;
		};
	};
	union
	{
   
		struct
		{
   
			ULONG TimeDateStamp;
		};
		struct
		{
   
			PVOID LoadedImports;
		};
	};
	struct _ACTIVATION_CONTEXT * EntryPointActivationContext;
	PVOID PatchInformation;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _OPERATION_INFO_ENTRY
{
   
	LIST_ENTRY    ListEntry;
	OB_OPERATION  Operation;
	ULONG         Flags;
	PVOID         Object;
	POBJECT_TYPE  ObjectType;
	ACCESS_MASK   AccessMask;
	ULONG32 time;
} OPERATION_INFO_ENTRY, *POPERATION_INFO_ENTRY;

typedef struct _CALL_BACK_INFO
{
   
	ULONG64 Unknow;
	ULONG64 Unknow1;
	UNICODE_STRING AltitudeString;
	LIST_ENTRY NextEntryItemList; //(callbacklist) 跟上面开头的那个一样 存储下一个callbacklist
	ULONG64 Operations;
	PVOID ObHandle; //存储详细的数据 版本号 POB_OPERATION_REGISTRATION AltitudeString 也就是本身节点CALL_BACK_INFO 注销时也使用这个 注意是指针 //CALL_BACK_INFO
	PVOID ObjectType;
	ULONG64 PreCallbackAddr;
	ULONG64 PostCallbackAddr;
}CALL_BACK_INFO, *PCALL_BACK_INFO;

typedef struct _OB_CALLBACK
{
   
	LIST_ENTRY	ListEntry;
	ULONG64		Operations;
	PCALL_BACK_INFO		ObHandle;
	ULONG64		ObjTypeAddr;
	ULONG64		PreCall;
	ULONG64		PostCall;
} OB_CALLBACK, *POB_CALLBACK;



BOOLEAN GetVersionAndHardCode()
{
   
	BOOLEAN b