02 读GDT表、字符串操作、遍历内核模块

读取GDT表

#include <ntddk.h>

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
	pDriver->DriverUnload = DriverUnload;
	DbgPrint("load GDT table\n");

	//read gdtr
	char gdt[6];
	__asm
	{
		sgdt gdt
	}

	USHORT length = *(short*)gdt;
	UINT32 baseAddress = *(int*)&gdt[2];

	UINT32* mem = ExAllocatePoolWithTag(NonPagedPool, length, NULL);
	if (mem == NULL)
	{
		DbgPrint("内存申请失败~~\n");
	}
	else
	{
		RtlMoveMemory(mem, baseAddress,length);
		DbgPrint("\n打印数据\n");
		for (int i = 0; i < length / 4; i+=2)
		{
			DbgPrint("%08x`%08x\n", mem[i + 1], mem[i]);
		}
		ExFreePool(mem);
	}
	return STATUS_SUCCESS;
}

字符串操作

#include <ntddk.h>

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{

	UNICODE_STRING ustr;
	UNICODE_STRING ustrTr;
	ANSI_STRING astr;
	ANSI_STRING astrCompare;
	ANSI_STRING astrTr;

	//init
	RtlInitUnicodeString(&ustr, L"day day up~~");
	RtlInitAnsiString(&astr, "good good study~~");
	RtlInitAnsiString(&astrCompare, "good good study~~");
	DbgPrint("Unicode : %wZ\n", &ustr);
	DbgPrint("ANSI : %Z\n", &astr);

	//compare
	BOOLEAN flag1 = RtlCompareString(&astrCompare, &astr, TRUE);
	BOOLEAN flag2 = RtlCompareString(&astrCompare, &astr, FALSE);
	DbgPrint("RtlCompareString : %d %d", flag1, flag2);

	//translate
	RtlAnsiStringToUnicodeString(&ustrTr, &astr, TRUE);
	RtlUnicodeStringToAnsiString(&astrTr, &ustr, TRUE);

	DbgPrint("%wZ\n%Z", &ustrTr, &astrTr);

	pDriver->DriverUnload = DriverUnload;	
	return STATUS_SUCCESS;
}

为什么DISPATCH_LEVEL不能访问分页内存

分页内存在内存紧张的时候物理页会被放置到文件，如果再次访问的时候需要走缺页异常处理程序（IRQL = 1）
DISPATCH_LEVEL (IRQL = 2)
缺页异常处理程序无法中断DISPATCH_LEVEL，会导致蓝屏

遍历内核模块

#include <ntddk.h>

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	DbgPrint("over\n");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
	
	LIST_ENTRY* list = (LIST_ENTRY*)pDriver->DriverSection;
	LIST_ENTRY* current_entry = list;
	PDRIVER_OBJECT obj;

	DbgPrint("\n=====================================================\n");
	while (1)
	{
		PUNICODE_STRING name = (PUNICODE_STRING)((int)current_entry + 0x2c);
		UINT32 DllBase = *(UINT32*)((int)current_entry + 0x18);
		UINT32 ImgSize = *(UINT32*)((int)current_entry + 0x20);
		DbgPrint("DriverName : %wZ\nDllBase : %x\nImgSize : %x\n======\n", name, DllBase, ImgSize);

		current_entry = current_entry->Blink;
		if (current_entry == list)
		{
			break;
		}
	}

	pDriver->DriverUnload = DriverUnload;	
	return STATUS_SUCCESS;
}