根据特征码找到未导出的内核函数 PspTerminateProcess

使用的是一个UINT32数组来存放shellcode没有考虑全局变量的问题

#include <ntifs.h>
typedef NTSTATUS(*pFunTerminateProcess)(IN PEPROCESS Process, IN NTSTATUS ExitStatus);

typedef struct _LDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID      DllBase;
	PVOID      EntryPoint;
	ULONG32    SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	UINT32   Unknow[17];

}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

VOID __stdcall UnLoad(PDRIVER_OBJECT pDriver) {
	DbgPrint("Driver 卸载成功\r\n");
}
PVOID FindFunByShellcode(UINT32 startAddr, PUINT32 shellcode,UINT32 length) {

	UINT32 addrRange = 0x100000;

	for (int i = 0; i < addrRange; i++) {
		PUINT32 temp = (PUINT32)(startAddr + i);
		if (*temp == shellcode[0]) {
			PVOID retValue = temp;
			for (int j = 1; j < length; j++) {
				temp++;
				if (*temp == shellcode[j]) {
					if (j == (length-1)) {
						DbgPrint("Function Found Address:%x\r\n", temp);
						return retValue;
					}
					continue;
				} else {
					break;	
				}
			}
		}
	}
	DbgPrint("404 Function Not Found\r\n");
	return NULL;
}
VOID FindFunByShellcodeTest() {
	UINT32 shelcode[8] = { 0x8b55ff8b, 0xa16456ec, 0x00000124, 0x3b08758b, 0x07754470, 0x00000db8, 0x575aebc0, 0x0248be8d };
	pFunTerminateProcess TerminateProcess = FindFunByShellcode(0x805C0000, shelcode, 8);
	PEPROCESS hProcess;
	//PsLookupProcessByProcessId 根据PID获取句柄
	if (PsLookupProcessByProcessId((HANDLE)1388, &hProcess) == STATUS_SUCCESS) {
		TerminateProcess(hProcess, 0);
	} else {
		DbgPrint("404 Not Found\r\n");
	}
	
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath) {
	pDriver->DriverUnload = UnLoad;
	//PrintKernelModule(pDriver);
	FindFunByShellcodeTest();
	return STATUS_SUCCESS;
}