_LDR_DATA_TABLE_ENTRY结构体

最新推荐文章于 2023-12-29 18:32:49 发布

彼岸Zz

最新推荐文章于 2023-12-29 18:32:49 发布

阅读量1.3k

点赞数

分类专栏：编程学习内核文章标签： c++

本文链接：https://blog.csdn.net/weixin_41693985/article/details/128409340

版权

编程学习同时被 2 个专栏收录

3 篇文章

订阅专栏

内核

3 篇文章

订阅专栏

本文解析了Windows内核中LDR_DATA_TABLE_ENTRY的数据结构，并介绍了PsGetProcessImageFileName函数的使用，涉及进程加载信息和回调操作。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

typedef struct _LDR_DATA_TABLE_ENTRY
{
	LIST_ENTRY64	InLoadOrderLinks;
	LIST_ENTRY64	InMemoryOrderLinks;
	LIST_ENTRY64	InInitializationOrderLinks;
	PVOID			DllBase;
	PVOID			EntryPoint;
	ULONG			SizeOfImage;
	UNICODE_STRING	FullDllName;
	UNICODE_STRING	BaseDllName;
	ULONG			Flags;
	USHORT			LoadCount;
	USHORT			TlsIndex;
	PVOID			SectionPointer;
	ULONG			CheckSum;
	PVOID			LoadeImports;
	PVOID			EntryPointActivationContext;
	PVOID			PatchInformation;
	LIST_ENTRY64	ForwarderLinks;
	LIST_ENTRY64	ServiceTagLinks;
	LIST_ENTRY64	StaticLinks;
	PVOID			ContextInformation;
	ULONG			OriginalBase;
	LARGE_INTEGER	LoadTime;
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENYRY;

PsGetProcessImageFileName函数声明

NTKERNELAPI
UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);

注册例：

PLDR_DATA_TABLE_ENYRY  pldr = (PLDR_DATA_TABLE_ENYRY)driver->DriverSection;
	pldr->Flags |= 0x20;

	OB_CALLBACK_REGISTRATION ob = { 0 };
	OB_OPERATION_REGISTRATION oor = { 0 };

	UNICODE_STRING attd = { 0 };

	ob.Version = ObGetFilterVersion();
	ob.OperationRegistrationCount = 1;
	ob.OperationRegistration = &oor;
	RtlInitUnicodeString(&attd,L"321999");
	ob.RegistrationContext = NULL;




	oor.ObjectType = PsProcessType;
	oor.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
	oor.PreOperation = ProtectProcess;
	oor.PostOperation = NULL;
	status = ObRegisterCallbacks(&ob, &_HANDLE);

PreOperation例程函数：

typedef OB_PREOP_CALLBACK_STATUS
(*POB_PRE_OPERATION_CALLBACK) (
    _In_ PVOID RegistrationContext,
    _Inout_ POB_PRE_OPERATION_INFORMATION OperationInformation
    );