使用驱动来枚举DPC

WIN7 X86

驱动

#include<ntifs.h>
#include <WinDef.h>

#define DEVICE_NAME L"\\Device\\wangliang"
#define SYM_NAME L"\\??\\wangliang"

#define _COMM_ID 0x12345678

typedef struct _CommPackage {
	ULONG64 id;
	ULONG64 pid;
	ULONG DPCobject;
	ULONG DeferredRoutine;
	ULONG Timerobject;
	ULONG Period;

}CommPackage, * PCommPackage;

typedef struct _KTIMER_TABLE_ENTRY
{
	UINT64			Lock;
	LIST_ENTRY		Entry;
	ULARGE_INTEGER	Time;
} KTIMER_TABLE_ENTRY, * PKTIMER_TABLE_ENTRY;

typedef struct _DPC_TIMER_ENTRY_INFORMATION
{
	UINT_PTR TimerObject;
	UINT_PTR RealDpc;
	UINT_PTR Cycle;       // 周期
	UINT_PTR TimeDispatch;
} DPC_TIMER_ENTRY_INFORMATION, * PDPC_TIMER_ENTRY_INFORMATION;

typedef struct _DPC_TIMER_INFORMATION
{
	UINT32                      NumberOfDpcTimers;
	DPC_TIMER_ENTRY_INFORMATION DpcTimerEntry[1];
} DPC_TIMER_INFORMATION, * PDPC_TIMER_INFORMATION;

typedef NTSTATUS(NTAPI* CommCallback)(PCommPackage package);
CommCallback gCommCallback = NULL;

NTSTATUS DefDispatch(DEVICE_OBJECT* DeviceObject, IRP* Irp)
{
	Irp->IoStatus.Status = STATUS_SUCCESS;
	IoCompleteRequest(Irp, 0);
	return STATUS_SUCCESS;
}

VOID DriverUnload(PDRIVER_OBJECT pDriver) {
	UNICODE_STRING symName = { 0 };
	RtlInitUnicodeString(&symName, SYM_NAME);
	IoDeleteSymbolicLink(&symName);

	IoDeleteDevice(pDriver->DeviceObject);

	DbgPrint("Driver UnLoad!");
}


typedef
BOOLEAN(*pfnKeSetTimer)(
	__inout PKTIMER Timer,
	__in LARGE_INTEGER DueTime,
	__in_opt PKDPC Dpc);


#define IOCTL_ARKPROTECT_ENUMDPCTIMER      (UINT32)CTL_CODE(FILE_DEVICE_ARKPROTECT, 0x824, METHOD_NEITHER, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

NTSTATUS process_enum(DEVICE_OBJECT* DeviceObject, IRP* Irp) {
	
	
	PIO_STACK_LOCATION ioStack = IoGetCurrentIrpStackLocation(Irp);
	LARGE_INTEGER ByteOffset = ioStack->Parameters.Read.ByteOffset;
	int Length = ioStack->Parameters.Read.Length;
	PCommPackage package = Irp-> UserBuffer;
	NTSTATUS status = STATUS_UNSUCCESSFUL;

	PLIST_ENTRY KiTimerTableListHead = 0;

	UINT32   CpuNumber = KeNumberProcessors;	// 全局变量 CPU个数
	UINT32 i = 0;
	for (i = 0; i < CpuNumber; i++)
	{
		BOOLEAN   bOk = FALSE;
		PUINT_PTR KiWaitAlwaysAddress = NULL;
		PUINT_PTR KiWaitNeverAddress = NULL;
		UINT_PTR  PrcbAddress = 0;
		PUCHAR    TimerEntries = NULL;

		KeSetSystemAffinityThread(i + 1);	// 使当前线程运行在第一个处理器上



		_asm 
		{
		push eax
		mov eax,FS:[0x20]
		mov PrcbAddress,eax
		pop eax
		};

		KeRevertToUserAffinityThread();	  // 恢复处理器


		TimerEntries = (PUCHAR)(PrcbAddress + 0x1960 + 0x40);	// _KTIMER_TABLE_ENTRY
		

			UINT32 j = 0;
			KIRQL OldIrql = KeRaiseIrqlToDpcLevel();

			// 256个KTIMER_TABLE_ENTRY数组
			for (j = 0; j < 0x100; j++)
			{
				if (j == package->pid) {
					PLIST_ENTRY CurrentListEntry = (PLIST_ENTRY)(TimerEntries + sizeof(KTIMER_TABLE_ENTRY) * j + 0x4);  // 每次定位到数组的List_Entry成员
					if (CurrentListEntry && MmIsAddressValid(CurrentListEntry))
					{
						PLIST_ENTRY TravelListEntry;
						for (TravelListEntry = CurrentListEntry->Flink;
							MmIsAddressValid(TravelListEntry) && CurrentListEntry != TravelListEntry;
							TravelListEntry = TravelListEntry->Flink)
						{
							//获得首地址
							PKTIMER Timer = CONTAINING_RECORD(TravelListEntry, KTIMER, TimerListEntry);
							/*
							kd> dt _KTIMER
							nt!_KTIMER
							+0x000 Header           : _DISPATCHER_HEADER
							+0x018 DueTime          : _ULARGE_INTEGER
							+0x020 TimerListEntry   : _LIST_ENTRY
							+0x030 Dpc              : Ptr64 _KDPC
							+0x038 Processor        : Uint4B
							+0x03c Period           : Uint4B
							*/
							PKDPC RealDpc = Timer->Dpc;
							if (MmIsAddressValid(Timer) && MmIsAddressValid(RealDpc) && MmIsAddressValid(RealDpc->DeferredRoutine))
							{
								//DbgBreakPoint();
								//if (DpcTimerCount > dti->NumberOfDpcTimers)
								//{
								//DbgPrintEx(77, 0, "DPC对象:%p\r\n", (UINT_PTR)RealDpc);
								//DbgPrintEx(77, 0, "DPC函数入口:%p\r\n", (UINT_PTR)RealDpc->DeferredRoutine);
								//DbgPrintEx(77, 0, "Timer对象:%p\r\n", (UINT_PTR)Timer);
								//DbgPrintEx(77, 0, "触发周期:%d\r\n:", Timer->Period);



								package->DPCobject = RealDpc;
								package->DeferredRoutine = RealDpc->DeferredRoutine;
								package->Timerobject = Timer;
								package->Period = Timer->Period;



							}
						}
					}
				}
			}
			KeLowerIrql(OldIrql);
	}


	Irp->IoStatus.Information = 0;
	Irp->IoStatus.Status = status;



	IoCompleteRequest(Irp, 0);

	return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING registeryPat) {
	UNICODE_STRING unName = { 0 };
	RtlInitUnicodeString(&unName, DEVICE_NAME);

	UNICODE_STRING symName = { 0 };
	RtlInitUnicodeString(&symName, SYM_NAME);

	PDEVICE_OBJECT pDevice = NULL;

	NTSTATUS status = IoCreateDevice(pDriver, NULL, &unName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDevice);

	if (!NT_SUCCESS(status))
	{
		DbgPrint("[db]:%x\r\n", status);
		return status;
	}

	status = IoCreateSymbolicLink(&symName, &unName);

	if (!NT_SUCCESS(status))
	{
		IoDeleteDevice(pDevice);
		DbgPrint("[db]:%x\r\n", status);
		return status;
	}

	pDevice->Flags &= ~DO_DEVICE_INITIALIZING;
	pDevice->Flags |= DO_BUFFERED_IO;

	pDriver->MajorFunction[IRP_MJ_CREATE] = DefDispatch;
	pDriver->MajorFunction[IRP_MJ_CLOSE] = DefDispatch;
	pDriver->MajorFunction[IRP_MJ_READ] = process_enum;

	pDriver->DriverUnload = DriverUnload;

	return STATUS_SUCCESS;

}

R3

#include <stdio.h>
#include <Windows.h>

#define SYM_NAME   "\\\\.\\wangliang"

typedef struct _CommPackage {
	ULONG64 id;
	ULONG64 pid;
	ULONG DPCobject;
	ULONG DeferredRoutine;
	ULONG Timerobject;
	ULONG Period;
	
}CommPackage, * PCommPackage;

#define _COMM_ID 0x12345678

int main()
{
	CommPackage packag;
	packag.id = _COMM_ID;
	packag.pid = (ULONG64)0;
	int j = 0;

	HANDLE hDevice = CreateFileA(SYM_NAME, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);


	if (hDevice == NULL || hDevice == INVALID_HANDLE_VALUE)
	{
		printf("%d", hDevice);
		system("pause");
		return 0;
	}

	DWORD p = 0;

	for (j = 0; j < 0x100; j++) {
		
		packag.DeferredRoutine = 0;
		packag.DPCobject = 0;
		packag.Period = 0;
		packag.Timerobject = 0;
		ReadFile(hDevice, &packag, sizeof(CommPackage), &p, NULL);

		if (packag.DPCobject != NULL && packag.DeferredRoutine != NULL) {
			printf("DPC对象:0x%x\r\n", packag.DPCobject);
			printf("DPC函数入口:0x%x\r\n", packag.DeferredRoutine);
			printf("Timer对象:0x%x\r\n", packag.Timerobject);
			printf("触发周期:%u\r\n", packag.Period);
		}
		
		packag.pid = packag.pid + 1;
	}
	


	CloseHandle(hDevice);

	system("pause");
	return 0;
}

截图效果