驱动下获取dll的函数地址

/************************************************************************ 
获取baiDLL中的函数地址 
lpFunctionName        函数名称
pDllName                DLL文件名称
************************************************************************/
/***************************************************************************************
*
*        原理：  R0下没有duLoadLibrary函数
*                        利用zhiZwCreateFile打开文件
*                        利用ZwCreateSection创建区段
*                        利用ZwMapViewOfSection映射dao区段到当前进程的虚拟内存
*                        定位PE Header地址
*                        定位第一个数据目录
*                        到EAT导出表
*                        搜索函数名，定位函数地址
****************************************************************************************/
DWORD GetDllFunctionId(char* lpFunctionName, PUNICODE_STRING pDllName) 
{ 
        HANDLE  hSection, hFile, hMod; 
        //        SECTION_IMAGE_INFORMATION sii; 
        IMAGE_DOS_HEADER* dosheader; 
        IMAGE_OPTIONAL_HEADER* opthdr; 
        IMAGE_EXPORT_DIRECTORY* pExportTable; 
        DWORD* arrayOfFunctionAddresses; 
        DWORD* arrayOfFunctionNames; 
        WORD* arrayOfFunctionOrdinals; 
        DWORD functionOrdinal; 
        DWORD Base, x, functionAddress; 
        char* functionName; 
        STRING  ntFunctionName, ntFunctionNameSearch; 
        PVOID BaseAddress = NULL; 
        SIZE_T size=0; 
         
        OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE}; 
        IO_STATUS_BLOCK iosb; 
        NTSTATUS status = STATUS_UNSUCCESSFUL;
         
        ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT); 
         
        oa.ObjectName = 0; 
        //小红伞杀ZwCreateSection +ZwMapViewOfSection
        ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile); 
         
        ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, 
                                                         MEM_TOP_DOWN, PAGE_READWRITE); 
        ZwClose(hFile); 
         
        hMod = BaseAddress; 
                                 
        dosheader = (IMAGE_DOS_HEADER *)hMod; 
                                 
        opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24); 
                                 
        pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. 
                 
                VirtualAddress); 
                                 
        arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions); 
                                 
        arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames); 
                                 
        arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals); 
                                 
        Base = pExportTable->Base; 
                                 
        RtlInitString(&ntFunctionNameSearch, lpFunctionName); 
                                 
        for(x = 0; x < pExportTable->NumberOfFunctions; x++) 
                                { 
                functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]); 
                 
                RtlInitString(&ntFunctionName, functionName); 
                 
                functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; 
                functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]); 
                if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0) 
                { 
                        ZwClose(hSection); 
                        return functionAddress; 
                } 
        } 
                                 
        ZwClose(hSection); 
        return 0; 
} 
 
/************************************************************************ 
根据DLL中函数的地址 找到在SSDT中索引号
lpFunctionName        函数名称
************************************************************************/
PVOID*  GetSSDTFunctionAddress(char* lpFunctionName){
        DWORD FunctionId = 0;
        ULONG Pread = 0;
        UNICODE_STRING DllName;
        RtlInitUnicodeString(&DllName,L"\\Device\\HarddiskVolume1\\Windows\\System32\\ntdll.dll");
        FunctionId=GetDllFunctionId(lpFunctionName,&DllName);
        Pread=*((WORD *)(FunctionId+1));
         
        return (KeServiceDescriptorTable->ServiceTable[Pread]);
}