windows10 x64 驱动测试
在任意内核空间存放 ULONG x = 0x123456;
NTSTATUS DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("Driver Exit \r\n");
return STATUS_SUCCESS;
}
ULONG x = 0x123456;
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Regedit)
{
DbgPrint("Driver Load \r\n");
DbgPrint("x = %p\n",&x);
//HideThread("Project3.exe");
DriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
#x的内核地址为:fffff8052b103000 ##在附加任何用户程序的process地址 可以查看到 fffff805
2b103000 00123456
kd> .process ffffbf0f64cac080
kd> dd ffffF8052B103000
fffff805`2b103000 00123456 00000000 604e4127 00000965
fffff805`2b103010 9fb1bed8 fffff69a 00000000 00000000
fffff805`2b103020 00000000 00000000 00000000 00000000
fffff805`2b103030 00000000 00000000 00000000 00000000
fffff805`2b103040 00000000 00000000 00000000 00000000
fffff805`2b103050 00000000 00000000 00000000 00000000
fffff805`2b103060 00000000 00000000 00000000 00000000
fffff805`2b103070 00000000 00000000 00000000 00000000
fffff805`2b103000 00123456 表明了还是共享内核空间
windows10 x64 内核模块遍历
一
kd> dt _DRIVER_OBJECT FFFFBF0F66179950
nt!_DRIVER_OBJECT
+0x000 Type : 0n4
+0x002 Size : 0n336
+0x008 DeviceObject : (null)
+0x010 Flags : 0x12
+0x018 DriverStart : 0xfffff805`2b120000 Void
+0x020 DriverSize : 0x7000
+0x028 DriverSection : 0xffffbf0f`6124e280 Void
+0x030 DriverExtension : 0xffffbf0f`66179aa0 _DRIVER_EXTENSION
+0x038 DriverName : _UNICODE_STRING "\Driver\MyDriver2"
+0x048 HardwareDatabase : 0xfffff805`13144990 _UNICODE_STRING "\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM"
+0x050 FastIoDispatch : (null)
+0x058 DriverInit : 0xfffff805`2b125000 long MyDriver2!GsDriverEntry+0
+0x060 DriverStartIo : (null)
+0x068 DriverUnload : 0xfffff805`2b121060 void MyDriver2!DriverUnload+0
+0x070 MajorFunction : [28] 0xfffff805`127596a0 long nt!IopInvalidDeviceRequest+0
注: +0x028 DriverSection : 0xffffbf0f`6124e280 指向一个_LDR_DATA_TABLE_ENTRY结构体
结构体InLoadOrderLinks 指向下一个内核模块,可以遍历所有内核模块
二
kd> dt _LDR_DATA_TABLE_ENTRY 0xffffbf0f`6124e280
nt!_LDR_DATA_TABLE_ENTRY
+0x000 InLoadOrderLinks : _LIST_ENTRY [ 0xfffff805`13040270 - 0xffffbf0f`6103b2c0 ]
+0x010 InMemoryOrderLinks : _LIST_ENTRY [ 0xfffff805`2b124000 - 0x00000000`00000030 ]
+0x020 InInitializationOrderLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
+0x030 DllBase : 0xfffff805`2b120000 Void
+0x038 EntryPoint : 0xfffff805`2b125000 Void
+0x040 SizeOfImage : 0x7000
+0x048 FullDllName : _UNICODE_STRING "\??\C:\Users\mirsun\Desktop\MyDriver2.sys"
+0x058 BaseDllName : _UNICODE_STRING "MyDriver2.sys"
+0x068 FlagGroup : [4] ""
+0x068 Flags : 0x49104000
+0x068 PackagedBinary : 0y0
+0x068 MarkedForRemoval : 0y0
+0x068 ImageDll : 0y0
+0x068 LoadNotificationsSent : 0y0
+0x068 TelemetryEntryProcessed : 0y0
+0x068 ProcessStaticImport : 0y0
+0x068 InLegacyLists : 0y0
+0x068 InIndexes : 0y0
+0x068 ShimDll : 0y0
+0x068 InExceptionTable : 0y0
+0x068 ReservedFlags1 : 0y00
+0x068 LoadInProgress : 0y0
+0x068 LoadConfigProcessed : 0y0
+0x068 EntryProcessed : 0y1
+0x068 ProtectDelayLoad : 0y0
+0x068 ReservedFlags3 : 0y00
+0x068 DontCallForThreads : 0y0