读取GDT表
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
pDriver->DriverUnload = DriverUnload;
DbgPrint("load GDT table\n");
char gdt[6];
__asm
{
sgdt gdt
}
USHORT length = *(short*)gdt;
UINT32 baseAddress = *(int*)&gdt[2];
UINT32* mem = ExAllocatePoolWithTag(NonPagedPool, length, NULL);
if (mem == NULL)
{
DbgPrint("内存申请失败~~\n");
}
else
{
RtlMoveMemory(mem, baseAddress,length);
DbgPrint("\n打印数据\n");
for (int i = 0; i < length / 4; i+=2)
{
DbgPrint("%08x`%08x\n", mem[i + 1], mem[i]);
}
ExFreePool(mem);
}
return STATUS_SUCCESS;
}
字符串操作
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
UNICODE_STRING ustr;
UNICODE_STRING ustrTr;
ANSI_STRING astr;
ANSI_STRING astrCompare;
ANSI_STRING astrTr;
RtlInitUnicodeString(&ustr, L"day day up~~");
RtlInitAnsiString(&astr, "good good study~~");
RtlInitAnsiString(&astrCompare, "good good study~~");
DbgPrint("Unicode : %wZ\n", &ustr);
DbgPrint("ANSI : %Z\n", &astr);
BOOLEAN flag1 = RtlCompareString(&astrCompare, &astr, TRUE);
BOOLEAN flag2 = RtlCompareString(&astrCompare, &astr, FALSE);
DbgPrint("RtlCompareString : %d %d", flag1, flag2);
RtlAnsiStringToUnicodeString(&ustrTr, &astr, TRUE);
RtlUnicodeStringToAnsiString(&astrTr, &ustr, TRUE);
DbgPrint("%wZ\n%Z", &ustrTr, &astrTr);
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
为什么DISPATCH_LEVEL不能访问分页内存
分页内存在内存紧张的时候物理页会被放置到文件,如果再次访问的时候需要走缺页异常处理程序(IRQL = 1)
DISPATCH_LEVEL (IRQL = 2)
缺页异常处理程序无法中断DISPATCH_LEVEL,会导致蓝屏
遍历内核模块
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
LIST_ENTRY* list = (LIST_ENTRY*)pDriver->DriverSection;
LIST_ENTRY* current_entry = list;
PDRIVER_OBJECT obj;
DbgPrint("\n=====================================================\n");
while (1)
{
PUNICODE_STRING name = (PUNICODE_STRING)((int)current_entry + 0x2c);
UINT32 DllBase = *(UINT32*)((int)current_entry + 0x18);
UINT32 ImgSize = *(UINT32*)((int)current_entry + 0x20);
DbgPrint("DriverName : %wZ\nDllBase : %x\nImgSize : %x\n======\n", name, DllBase, ImgSize);
current_entry = current_entry->Blink;
if (current_entry == list)
{
break;
}
}
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}