针对《对抗内存搜索对象-教主》一文中山寨OBJECT_TYPE隐藏技术的检测方法:
方法1:
[Windows XP sp2]
nt!_OBJECT_TYPE
+0x000 Mutex : _ERESOURCE
+0x038 TypeList : _LIST_ENTRY [ 0x821a55f0 - 0x821a55f0 ]
+0x040 Name : _UNICODE_STRING "Driver"
+0x048 DefaultObject : 0x805598c0
+0x04c Index : 0x1a
+0x050 TotalNumberOfObjects : 0x61
+0x054 TotalNumberOfHandles : 0
+0x058 HighWaterNumberOfObjects : 0x67
+0x05c HighWaterNumberOfHandles : 1
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0ac Key : 0x76697244
+0x0b0 ObjectLocks : [4] _ERESOURCE
+0x000 Mutex : _ERESOURCE
+0x038 TypeList : _LIST_ENTRY [ 0x821a55f0 - 0x821a55f0 ]
+0x040 Name : _UNICODE_STRING "Driver"
+0x048 DefaultObject : 0x805598c0
+0x04c Index : 0x1a
+0x050 TotalNumberOfObjects : 0x61
+0x054 TotalNumberOfHandles : 0
+0x058 HighWaterNumberOfObjects : 0x67
+0x05c HighWaterNumberOfHandles : 1
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0ac Key : 0x76697244
+0x0b0 ObjectLocks : [4] _ERESOURCE
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : Uint2B
+0x002 UseDefaultObject : UChar
+0x003 CaseInsensitive : UChar
+0x004 InvalidAttributes : Uint4B
+0x008 GenericMapping : _GENERIC_MAPPING
+0x018 ValidAccessMask : Uint4B
+0x01c SecurityRequired : UChar
+0x01d MaintainHandleCount : UChar
+0x01e MaintainTypeList : UChar
+0x020 PoolType : _POOL_TYPE
+0x024 DefaultPagedPoolCharge : Uint4B
+0x028 DefaultNonPagedPoolCharge : Uint4B
+0x02c DumpProcedure : Ptr32 void
+0x030 OpenProcedure : Ptr32 long
+0x034 CloseProcedure : Ptr32 void
+0x038 DeleteProcedure : Ptr32 void
+0x03c ParseProcedure : Ptr32 long
+0x040 SecurityProcedure : Ptr32 long
+0x044 QueryNameProcedure : Ptr32 long
+0x048 OkayToCloseProcedure : Ptr32 unsigned char
以上红色部分即可作为OBJECT_TYPE的特征,在查找对象的时候不直接比较OBJECT_TYPE的地址,而是按照地址找到OBJECT_TYPE_INITIALIZER,将之与*IoDriverObjectType的OBJECT_TYPE_INITIALIZER的xxxProcedure进行比较,相同即为DRIVER_OBJECT的OBJECT_HEADER。
方法2:
首先搜索内存中Type对象,然后搜索要找的内核对象,凡是size符合搜索的内核对象但是Type不符的,记录为可疑对象。