驱动调用用户层代码

http://hi.baidu.com/%CE%F7%B7%E7%B9%AB%C9%E7/blog/item/0febbd355d0904bfd1a2d320.html

转贴一篇文章，原来找了好久的..... 驱动调用用户层代码

1、 KeUserModeCallBack

NTSTATUS
CallRing3()
{
    PLIST_ENTRY                Next;
    PPEB                    Peb;
    PLDR_DATA_TABLE_ENTRY    Entry;
    PVOID                    dll_addr, func_addr, pMem = NULL, OutputBuffer, lpTextAddr;
    UNICODE_STRING            us;
    NTSTATUS                status;
    ULONG                    OutputLength, dwSize = PAGE_SIZE, KernelCallbackTable = 0, TableIndex, dwUserCodeSize;
    MSGBOX_PARAMS            StackParams;

    Peb = GetCurrentProcessPeb();
if (Peb) {
// 鸯妁屙桢 忮玟?钿桧嚓钼? 礤 耱嚯 忭铖栩?桤戾礤龛 br />         // ?铒桉囗桢 PEB 桤 msdn :)
        KernelCallbackTable = *(ULONG*)((ULONG)Peb + 0x2C); 
        RtlInitUnicodeString(&us, L"user32.dll");

        Next = Peb->Ldr->InMemoryOrderModuleList.Flink;
while (Next != &Peb->Ldr->InMemoryOrderModuleList) {
            Entry = CONTAINING_RECORD(Next, LDR_DATA_TABLE_ENTRY, MemoryOrder);

if(!RtlCompareUnicodeString(&Entry->ModuleName, &us, TRUE)) {
                dll_addr = Entry->ModuleBaseAddress;
                func_addr = KernelGetProcAddress(dll_addr, "MessageBoxA");
                DbgPrint("user32.dll found at %x", dll_addr);
                DbgPrint("user32.dll->MessageBoxA found at %x", func_addr);

                status = ZwAllocateVirtualMemory((HANDLE)-1, &pMem, 0, &dwSize, MEM_COMMIT | MEM_RESERVE | MEM_TOP_DOWN, PAGE_READWRITE);
if (NT_SUCCESS(status)) {
                    DbgPrint("Memory allocated at %x", pMem);
*(ULONG*)pMem = (ULONG)pMem + 4;
                    TableIndex = ((ULONG)pMem - KernelCallbackTable) / sizeof(ULONG);
                    dwUserCodeSize = (ULONG)Ring3Code_End - (ULONG)Ring3Code;
                    lpTextAddr = (PVOID)((ULONG)pMem + 4 + dwUserCodeSize);

                    DbgPrint("KernelCallbackTable == %x", KernelCallbackTable);
                    DbgPrint("OurTableIndex == %x", TableIndex);

                    __try {

                        RtlCopyMemory((PVOID)((ULONG)pMem + 4), Ring3Code, dwUserCodeSize);
                        RtlCopyMemory(lpTextAddr, HELLOSTR, strlen(HELLOSTR));

                        RtlZeroMemory(&StackParams, sizeof(MSGBOX_PARAMS));
                        StackParams.MessageBoxA = func_addr;
                        StackParams.lpText = lpTextAddr;

                        DbgPrint("Call user mode...");
                        status = KeUserModeCallback( TableIndex, 
&StackParams, 
sizeof(MSGBOX_PARAMS), 
&OutputBuffer,
&OutputLength );
                        DbgPrint("KeUserModeCallback return %x", status);

                        }
                    __except (EXCEPTION_EXECUTE_HANDLER) {
                        DbgPrint("Exception");
                        }

                    ZwFreeVirtualMemory((HANDLE)-1, &pMem, &dwSize, MEM_DECOMMIT);
                    } // if
                            
break;
                } // if
                        
            Next = Next->Flink;
            } // while
        } // if Peb
    
return STATUS_DEVICE_CONFIGURATION_ERROR;
}

 

2、 apc

//=====================================================================================//
//Name: void RunProcess()                                                              //
//                                                                                     //
//Descripion: This routine retrieves the list of all processes running on the machine, //
//            searches for 'explorer.exe', gets one thread from it's PEPROCESS struct, //
//            then it queues an APC to that thread                                     //
//=====================================================================================//
void RunProcess(LPSTR lpProcess)
{
//全部定义为ULONG类型
    ULONG pTargetProcess;     //self explanatory
    ULONG pTargetThread;     //thread that can be either alerable or non-alertable
    ULONG pNotAlertableThread; //non-alertable thread
    ULONG pSystemProcess;     //May not necessarily be the 'System' process
    ULONG pTempThread;
    ULONG pNextEntry, pListHead, pThNextEntry,pThListHead; 


if(strlen(lpProcess)>300) return; //name not longer than 300 characters
//获得系统进程
    pSystemProcess =(ULONG)PsGetCurrentProcess(); //make sure you are running at IRQL PASSIVE_LEVEL

if(!pSystemProcess) 
    {
        DbgPrint("KernelExec -> Cannot find 'System' process!");
return;
    }
//获取进程列表头(+0x088 ActiveProcessLinks : _LIST_ENTRY)
    pListHead=pSystemProcess+0x88;
//得到下一个EPROCESS结构的ActiveProcessLinks偏移地址
    pNextEntry=*(ULONG*)pListHead;
if(!pNextEntry)
        DbgPrint("KernelExec -> No processes found!");
else
    {

while(pNextEntry != pListHead) //start looping through the available processes
        {    //得到EPROCESS的首地址
            pSystemProcess =pNextEntry-0x88;
//进程名偏移
//+0x174 ImageFileName:[16] UChar
            DbgPrint("ProcessName %s \n",(char*)pSystemProcess+0x174);
//Is this explorer.exe? 
                    if(_strnicmp((char*)pSystemProcess+0x174,"explorer.exe",12)==0)
                    {    //得到进程的EPROCESS结构的地址
                        pTargetProcess = pSystemProcess; //Yes,we have found it!
                        DbgPrint("yes,we have found explorer.exe!");

                        pTargetThread = pNotAlertableThread = 0;
//获取线程列表头
//+0x050 ThreadListHead   : _LIST_ENTRY
//也就是_KPROCESS(PCB)中ThreadListHead的偏移地址
                        pThListHead = pSystemProcess+0x50;
//得到ETHREAD结构中_KTHREAD(Tcb)的+0x1b0 ThreadListEntry : _LIST_ENTRY地址
                        pThNextEntry=*(ULONG *)pThListHead;
//Now we loop through it's threads, seeking an alertable thread
                        while(pThNextEntry != pThListHead)
                        {    //所属ETHREAD的首地址
                            pTempThread =pThNextEntry-0x1b0;
                            DbgPrint("ethread address is:0x%x\n",(ULONG *)pTempThread);
//线程ID
//ETHREAD+0x1ec Cid : _CLIENT_ID为进程ID
//再向下+4为线程ID
                            DbgPrint("thread Id is %d\n",*(ULONG *)(pTempThread+0x1f0));
//是否警告状态
//+0x164 Alertable : UChar
                            DbgPrint("Alertable is:%x",*(char *)(pTempThread+0x164));
//tcb=*(PKTHREAD)pTempThread;
                            if(*(char *)(pTempThread+0x164)) //Tcb is the KTHREAD of this ETHREAD and stands for 'Thread Control Block'
                            {
//Good, an alertable thread was found. 
//得到explorer.exe中符合条件的线程PKTHREAD(ETHREAD)结构的地址
                                pTargetThread =pTempThread;

                                DbgPrint("KernelExec -> Found alertable thread");
//We will be using this one, so break now
                                break;
                            }
else
                            {
//Didn't find an alertable thread yet, so we'll keep this one
//just in case we won't find ANY alertable threads
//至少需要一个非警告状态的线程
                                pNotAlertableThread =pTempThread;
                            }
//下一个线程块
                            pThNextEntry = *(ULONG *)pThNextEntry; //check next thread
                        }
break;    
                    }
//下一个进程块
            pNextEntry = *(ULONG *)pNextEntry; //get next process
        }
    }

if(!pTargetProcess)
    {
        DbgPrint("KernelExec -> Couldn't find Explorer.exe!"); 
return;
    }
if(!pTargetThread)
    {
//No alertable thread was found, so let's hope we've at least got a non-alertable one (we'll set its alertable flag ON)
//There's no problem with non-alertable threads, except for the fact that it takes
//a little longer for them to return from KernelMode. (that means our process execution will be delayed)
        pTargetThread = pNotAlertableThread;
    }

if(pTargetThread)
    {
        DbgPrint("KernelExec -> Targeted thread: 0x%p",pTargetThread);
//We have one thread (alertable or n/a), now install the APC
        InstallUserModeApc(lpProcess,pTargetThread,pTargetProcess);
    }
else
        DbgPrint("KernelExec -> No thread found!"); //Explorer exe with NO threads (???)*/
}

 

3、ExRaiseHardError

01 typedef enum _HARDERROR_RESPONSE_OPTION {
02 OptionAbortRetryIgnore,
03 OptionOk,
04 OptionOkCancel,
05 OptionRetryCancel,
06 OptionYesNo,
07 OptionYesNoCancel,
08 OptionShutdownSystem,
09 OptionExplorerTrayBaloon,
10 OptionCancelTryAgainContinue
11 } HARDERROR_RESPONSE_OPTION, *PHARDERROR_RESPONSE_OPTION;
12
13 typedef enum _HARDERROR_RESPONSE {
14 ResponseReturnToCaller,
15 ResponseNotHandled,
16 ResponseAbort,
17 ResponseCancel,
18 ResponseIgnore,
19 ResponseNo,
20 ResponseOk,
21 ResponseRetry,
22 ResponseYes,
23 ResponseTryAgain,
24 ResponseContinue
25 } HARDERROR_RESPONSE, *PHARDERROR_RESPONSE;
26
27 NTSTATUS
28 NTAPI
29 ExRaiseHardError(
30 IN NTSTATUS ErrorStatus,
31 IN ULONG NumberOfParameters,
32 IN ULONG UnicodeStringParameterMask,
33 IN PVOID Parameters,
34 IN ULONG ResponseOption,
35 OUT PULONG Response );
36
37
38 ULONG
39 DisplayMessage (
40 PWSTR MessageString,
41 ULONG ResponseOption
42 )
43 {
44 NTSTATUS St;
45 UNICODE_STRING Message;
46 PVOID Parameters[] = {
47 &Message, //内容
48 0, //这是传说中的窗体标题...
49 0,
50 0
51 };
52 ULONG Response = 0;
53
54 RtlInitUnicodeString (&Message, MessageString);
55
56 St = ExRaiseHardError (
57 STATUS_FATAL_APP_EXIT,
58 1,
59 1,
60 &Parameters,
61 ResponseOption,
62 &Response
63 );
64
65 return Response;
66 }
67
68
69 NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
70 {
71 ULONG r;
72 r = DisplayMessage (L"Do you want a girl?", OptionYesNo);
73 KdPrint(("The answer was %d \n", r));
74
75 return STATUS_UNSUCCESSFUL;
76 }

转载于:https://www.cnblogs.com/daxingxing/archive/2011/08/30/2159720.html