无符号驱动 加载时找入口点

WIN7

 dt _DRIVER_OBJECT
nt!_DRIVER_OBJECT
   +0x000 Type             : Int2B
   +0x002 Size             : Int2B
   +0x008 DeviceObject     : Ptr64 _DEVICE_OBJECT
   +0x010 Flags            : Uint4B
   +0x018 DriverStart      : Ptr64 Void
   +0x020 DriverSize       : Uint4B
   +0x028 DriverSection    : Ptr64 Void
   +0x030 DriverExtension  : Ptr64 _DRIVER_EXTENSION
   +0x038 DriverName       : _UNICODE_STRING
   +0x048 HardwareDatabase : Ptr64 _UNICODE_STRING
   +0x050 FastIoDispatch   : Ptr64 _FAST_IO_DISPATCH
   +0x058 DriverInit       : Ptr64     long 
   +0x060 DriverStartIo    : Ptr64     void 
   +0x068 DriverUnload     : Ptr64     void 
   +0x070 MajorFunction    : [28] Ptr64     long 

WIN7驱动程序的入口点在驱动对象结构体的+0x58处

IopLoadDriver在此函数中搜索0x58

nt!IopLoadDriver+0x9fe:
fffff800`042acc2e 488bd6          mov     rdx,rsi
fffff800`042acc31 488bcb          mov     rcx,rbx
fffff800`042acc34 ff5358          call    qword ptr [rbx+58h]     //call  DriverInit       
fffff800`042acc37 4c8b157a60daff  mov     r10,qword ptr [nt!PnpEtwHandle (fffff800`04052cb8)]
fffff800`042acc3e 8bf8            mov     edi,eax
fffff800`042acc40 898424e0000000  mov     dword ptr [rsp+0E0h],eax
fffff800`042acc47 4c3bd5          cmp     r10,rbp
fffff800`042acc4a 0f848e000000    je      nt!IopLoadDriver+0xaae (fffff800`042accde)

fffff800`042acc34 ff5358 这里下断点,单步就可以跟到驱动入口处了.

WIN 10

IopLoadDriver -> _guard_dispatch_icall -> jmp rax

19041以上 

IopLoadDriver ->PnpCallDriverEntry-> _guard_dispatch_icall -> jmp rax