typedef struct _LDR_DATA_TABLE_ENTRY
{
LIST_ENTRY64 InLoadOrderLinks;
LIST_ENTRY64 InMemoryOrderLinks;
LIST_ENTRY64 InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
PVOID SectionPointer;
ULONG CheckSum;
PVOID LoadeImports;
PVOID EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY64 ForwarderLinks;
LIST_ENTRY64 ServiceTagLinks;
LIST_ENTRY64 StaticLinks;
PVOID ContextInformation;
ULONG OriginalBase;
LARGE_INTEGER LoadTime;
}LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENYRY;
PsGetProcessImageFileName函数声明
NTKERNELAPI
UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
注册例:
PLDR_DATA_TABLE_ENYRY pldr = (PLDR_DATA_TABLE_ENYRY)driver->DriverSection;
pldr->Flags |= 0x20;
OB_CALLBACK_REGISTRATION ob = { 0 };
OB_OPERATION_REGISTRATION oor = { 0 };
UNICODE_STRING attd = { 0 };
ob.Version = ObGetFilterVersion();
ob.OperationRegistrationCount = 1;
ob.OperationRegistration = &oor;
RtlInitUnicodeString(&attd,L"321999");
ob.RegistrationContext = NULL;
oor.ObjectType = PsProcessType;
oor.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
oor.PreOperation = ProtectProcess;
oor.PostOperation = NULL;
status = ObRegisterCallbacks(&ob, &_HANDLE);
PreOperation例程函数:
typedef OB_PREOP_CALLBACK_STATUS
(*POB_PRE_OPERATION_CALLBACK) (
_In_ PVOID RegistrationContext,
_Inout_ POB_PRE_OPERATION_INFORMATION OperationInformation
);