Windows驱动 - 链表 LIST_ENTRY

0x00 函数

InitializeListHead //初始化链表头

InsertTailList  //加入到链表尾

RemoveTailList  //从链表尾移除

IsListEmpty //判断链表是否为空

PsSetCreateProcessNotifyRoutine    //设置进程创建/关闭时的回调

ExAllocatePool  //申请内存

RtlZeroMemory   //内存置零

RtlCopyMemory   //拷贝内存

ExFreePool  //释放申请的内存

PsLookupProcessByProcessId //根据ProcessId查询EPROCESS

PsGetProcessImageFileName  //获取进程名

ObDereferenceObject //释放EPROCESS

CONTAINING_RECORD //根据成员指针,结构体,成员获取结构体的地址

 

0x01 结构体

LIST_ENTRY  //链表结构体

 

 

0x01 代码

 

#include <ntifs.h>

#include <ntddk.h>

#include <wdm.h>

 

NTKERNELAPI UCHAR* PsGetProcessImageFileName(__in PEPROCESS Process);

 

 

typedef struct _MY_LIST

{

 

    HANDLE ProcessId;

    LIST_ENTRY ListEntry;

    UCHAR ProcessName[50];

 

 

} MY_LIST, * PMY_LIST;

 

 

LIST_ENTRY ListEntryHead;

 

 

void PcreateProcessNotifyRoutine(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create)

{

 

    PEPROCESS Process = NULL;

    PCHAR ProcessName = NULL;

 

    if (Create) //创建

    {

        PMY_LIST myList =  ExAllocatePool(NonPagedPool,sizeof(MY_LIST));  //申请内存

 

        if (myList)

        {

 

            RtlZeroMemory(myList, sizeof(MY_LIST));

 

            myList->ProcessId = ProcessId;

 

 

            PsLookupProcessByProcessId(ProcessId,&Process);    //根据进程ID获取EPROCESS

            if (Process)

            {

                ProcessName = PsGetProcessImageFileName(Process);

                if (ProcessName)

                {

                   RtlCopyMemory(myList->ProcessName, ProcessName,strlen(ProcessName));

                }

 

                ObDereferenceObject(Process);  //释放获取的EPROCESS

 

            }

           

            DbgPrint("ProcessId -> %p , ProcessName -> %s", myList->ProcessId, myList->ProcessName);

 

            InsertTailList(&ListEntryHead,&myList->ListEntry); //插入至链表

 

                  

 

        }

 

 

    }

 

    return;

 

}

 

 

 

 

void DriverUnload(PDRIVER_OBJECT DriverObject)

{

    PMY_LIST myList = NULL;

    PLIST_ENTRY temp = NULL;

 

 

    while (!IsListEmpty(&ListEntryHead))

    {

        temp = ListEntryHead.Blink;

 

        RemoveTailList(&ListEntryHead);    //移除

 

        if (temp)

        {

            //查询

            myList = CONTAINING_RECORD(temp, MY_LIST, ListEntry);

 

            if (myList)

            {

 

                //打印

                DbgPrint("DriverUnload -> RemoveTailList -> %p %s ", myList->ProcessId, myList->ProcessName);

 

                //释放

                ExFreePool(myList);

 

 

            }

 

        }

 

    }

 

 

    PsSetCreateProcessNotifyRoutine(PcreateProcessNotifyRoutine, TRUE); //设置进程创建通知例程.TRUE -> 删除例程,也可以理解为关闭例程

    DbgPrint("DriverUnload");

 

 

}

 

 

 

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)

{

 

    NTSTATUS status = STATUS_SUCCESS;

 

    DriverObject->DriverUnload = DriverUnload;

 

    InitializeListHead(&ListEntryHead);    //初始化链表头

 

    PsSetCreateProcessNotifyRoutine(PcreateProcessNotifyRoutine,FALSE);   //设置进程创建通知例程.FALSE -> 添加例程,也可以理解为启用例程

 

    return status;

 

}

 

0x02 扩展

Lookaside -> 适用于:1 申请的内存空间较小, 2 申请的内存空间长度不定

工具: KernelPoolMonitor -> 查看ExAllocatePoolWithTag根据标记分配的内存

PsGetCurrentProcess //得到当前进程EPROCESS

RtlCompareMemory       //内存比较

RtlEqualMemory  //内存比较

RemoveEntryList //移除链表