内核安全编程(一)读写驱动程序1.1

最新推荐文章于 2023-06-13 23:05:05 发布

sh3llc0der

最新推荐文章于 2023-06-13 23:05:05 发布

阅读量1.4k

点赞数 1

分类专栏：驱动内核

本文链接：https://blog.csdn.net/sh3llc0der/article/details/15760573

版权

本文介绍了内核安全编程中的读写驱动程序，讲解了DriverEntry和Driver_ReadWrite函数的实现，重点讨论了IO请求包(IRP)的处理，包括DO_BUFFERED_IO和DO_DIRECT_IO两种访问方式。同时，文章提到了IoGetCurrentIrpStackLocation函数和IO_STACK_LOCATION结构，以及ProbeForRead函数在确保地址合法性方面的关键作用，并指出一个与ProbeForRead相关的安全漏洞和潜在风险。

摘要由CSDN通过智能技术生成

内核安全编程(一)读写驱动程序1.1

读写驱动程序，即应用程序或者上层驱动程序发送主功能码为IRP_MJ_READ和IRP_MJ_WRITE的IO请求包(IRP)

DriverEntry函数如下：

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath)
{
	UNICODE_STRING DeviceName,Win32Device;
	PDEVICE_OBJECT DeviceObject = NULL;
	NTSTATUS status;
	unsigned i;

	KdPrint(("[DriverEntry]\n"));

	RtlInitUnicodeString(&DeviceName,L"\\Device\\Driver_write0");
	RtlInitUnicodeString(&Win32Device,L"\\DosDevices\\Driver_write0");

	for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
		DriverObject->MajorFunction[i] = Driver_writeDefaultHandler;

	DriverObject->MajorFunction[IRP_MJ_CREATE] = Driver_writeCreateClose;
	DriverObject->MajorFunction[IRP_MJ_CLOSE] = Driver_writeCreateClose;
	DriverObject->MajorFunction[IRP_MJ_READ]=Driver_ReadWrite;
	DriverObject->MajorFunction[IRP_MJ_WRITE]=Driver_ReadWrite;
	//DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=Driver_DevControl;
	
	DriverObject->DriverUnload = Driver_writeUnload;
	status = IoCreateDevice(DriverObject,
							10