通过ZwSetSystemInformation在驱动中加载驱动

pureman_mega

于 2020-07-04 12:28:53 发布

阅读量926

点赞数

分类专栏： windows inners

本文链接：https://blog.csdn.net/pureman_mega/article/details/107120731

版权

windows inners 专栏收录该内容

38 篇文章 3 订阅

订阅专栏

环境：win7 32 ,材料: ntoskrnl.exe , spldr.sys spsys.sys

看到一个文件叫spldr.sys,loader for security processor,一个加载器。于是就进去看看如何实现的。在spldr.sys 里面看到字符串

SystemRoot\system32\drivers\spsys.sys ，应该就是要加载这个驱动了。再看字符串的引用位置，发现调用ZwSetSystemInformation,应该就是通过这个函数来加载驱动的。下面是调用情况（详情请参考spldr.sys）:

DRIVER_OBJECT      DriverObject;
UNICODE_STRING     RegistryPath;
NTSTATUS Load()
{
      #define SystemUnloadGdiDriver            0x1b
      #define SystemLoadGdiDriverInSystemSpace 0x36
      typedef NTSTATUS (*n_DriverEntry)(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPathy);
      typedef struct _LOAD_GDI_DRIVER_INFORMATION
      {
          UNICODE_STRING      DriverPath={0};  //the driver path
          ULONG               DriverStart;     //the DriverStart in _driver_object struct
          PVOID               DriverInfo;      //os use this DriverInfo to manage the loaded gdi drivers,DriverInfo should be a struct which contains info of the loaded gdi driver
          PVOID               DriverEntry;     //address of DriverEntry of the loaded driver
          PVOID               ExportDirectory; //address of export directory of the loaded driver
          ULONG               SizeOfImage;     //size of the loaded driver image
      }LOAD_GDI_DRIVER_INFORMATION,*PLOAD_GDI_DRIVER_INFORMATION;
      
      NTSTATUS                        status=STATUS_SUCCESS;
      LOAD_GDI_DRIVER_INFORMATION     LoadGdiDriverInfo={0};

      RtlInitUnicodeString(&LoadGdiDriverInfo.DriverPath,L"\\SystemRoot\\system32\\drivers\\spsys.sys");

      status=ZwSetSystemInformation(SystemLoadGdiDriverInSystemSpace,&LoadGdiDriverInfo,sizeof(LOAD_GDI_DRIVER_INFORMATION));
      if(status>=0)
      {
           //the driver image is loaded into the system space
           //and then call the driver's DriverEntry
           //part of DriverObject and RegistryPath should be filled before pass to DriverEntry
           status=((n_DriverEntry)LoadGdiDriverInfo.DriverEntry) (&DriverObject,&RegistryPath);
           if(!status)
           {
                 //the DriverEntry fails
                 //unload the loaded gdi driver
                 ZwSetSystemInformation(SystemUnloadGdiDriver,LoadGdiDriverInfo.DriverInfo,0x4);
           }
      }
      return status;
}