shadowssdt 地址数量遍历

最新推荐文章于 2020-09-05 19:03:12 发布

「已注销」

最新推荐文章于 2020-09-05 19:03:12 发布

阅读量625

点赞数

分类专栏：内核驱动全部集合

内核驱动全部集合专栏收录该内容

164 篇文章 34 订阅

订阅专栏

#include "ntddk.h"    
//SSDT结构体
typedef struct ServiceDescriptorTable {
	unsigned int *ServiceTableBase;
	unsigned int *ServiceCounterTable;
	unsigned int NumberOfServices;
	unsigned int *ParamTableBase;
}ServiceDescriptorTable, *PServiceDescriptorTable;
PServiceDescriptorTable KeServiceDescriptorTableShadow;
NTSYSAPI
BOOLEAN
NTAPI
KeAddSystemServiceTable(
IN PULONG_PTR Base,
IN PULONG Count OPTIONAL,
IN ULONG Limit,
IN PUCHAR Number,
IN ULONG Index
);
VOID MyUnload(PDRIVER_OBJECT    pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
}
PULONG getAddressOfShadowTable()
{
	PULONG p;
	//兼容XP，2003和WIN7
	//nt!KeAddSystemServiceTable+0x1a:
	//83de0022 8d8840dbdb83    lea     ecx,nt!KeServiceDescriptorTableShadow (83dbdb40)[eax]
	//83de0028 833900          cmp     dword ptr [ecx],0
	//83de002b 7546            jne     nt!KeAddSystemServiceTable+0x6b (83de0073)
	//8d88两个字节，所以+2
	p = (PULONG)((ULONG)KeAddSystemServiceTable + 0x1a + 2);
	return (PULONG)(*p);
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING Reg_Path)
{
		DbgPrint("address: 0x%X", getAddressOfShadowTable());
	KeServiceDescriptorTableShadow = (PServiceDescriptorTable)getAddressOfShadowTable();
	DbgPrint("num of services:%d", KeServiceDescriptorTableShadow[1].NumberOfServices);
	int j = KeServiceDescriptorTableShadow[1].NumberOfServices;
	//for (int i = 0; i <j; i++)
	//{
	//	KdPrint(("%x\n", KeServiceDescriptorTableShadow[1].ServiceTableBase[i]));
	//}
	pDriverObject->DriverUnload = MyUnload;
	return STATUS_SUCCESS;
}