InsertHeadList和CONTAINING_RECORD

LIST_ENTRY定义一个双向链表的数据结构:

typedef struct _LIST_ENTRY {
  struct _LIST_ENTRY  *Flink;
  struct _LIST_ENTRY  *Blink;
} LIST_ENTRY, *PLIST_ENTRY;

 由函数InitializeListHead (BUEList)进行初始化。

假设需要插入某个数据结构

strct B_U_E{

LIST_ENTRY BUELink;

...

...

} BUE;
 

然后开始插入BUE的某个实例对象:调用InsertHeadList()函数。

BUE abue = ...

InsertHeadList(&BUEList, &abue->BUELink);

这样就完成插入动作。

 

现在要从LIST当中读取BUE的某个对象数据。CONTAINING_RECORD 这个宏。

#define CONTAININT_RECORD(address, type, field) \
             ((type*)((PCHAR)(address) - (PCHAR)(&((type*)0)->field)))

 这个宏用于取得内存中任何结构体的首地址,要提供的参数是:结构体中某个成员(field)的地址address、结构体的类型type、提供地址那个成 员的名字field。

所以,假如我们想读取第一个数据:

Link = BUEList.Flink;
            
            while (Link != &BUEList)
            {
                bue= CONTAINING_RECORD(Link,BUE, BUELink);
 

       Link = Link->Flink;
         }

 这样就完成数据的读取操作。

 不知道有没有疏漏之处。

详细注释代码 bool hook_function(void* target_function, void* hooked_function,void* trampoline, void** origin_function) { unsigned __int64 physical_address = MmGetPhysicalAddress(target_function).QuadPart; // // Check if function exist in physical memory // if (physical_address == NULL) { LogError("Requested virtual memory doesn't exist in physical one"); return false; } // // Check if page isn't already hooked // PLIST_ENTRY current = &g_vmm_context->ept_state->hooked_page_list; while (&g_vmm_context->ept_state->hooked_page_list != current->Flink) { current = current->Flink; __ept_hooked_page_info* hooked_page_info = CONTAINING_RECORD(current, __ept_hooked_page_info, hooked_page_list); if (hooked_page_info->pfn_of_hooked_page == GET_PFN(physical_address)) { LogInfo("Page already hooked"); __ept_hooked_function_info* hooked_function_info = pool_manager::request_pool<__ept_hooked_function_info*>(pool_manager::INTENTION_TRACK_HOOKED_FUNCTIONS, TRUE, sizeof(__ept_hooked_function_info)); if (hooked_function_info == nullptr) { LogError("There is no pre-allocated pool for hooked function struct"); return false; } // // If we are hooking code cave for second trampoline // then origin function in null and we don't have to get pool for trampoline // if(origin_function != nullptr) { hooked_function_info->first_trampoline_address = pool_manager::request_pool<unsigned __int8*>(pool_manager::INTENTION_EXEC_TRAMPOLINE, TRUE, 100); if (hooked_function_info->first_trampoline_address == nullptr) { pool_manager::release_pool(hooked_function_info); LogError("There is no pre-allocated pool for trampoline"); return false; } } hooked_function_info->virtual_address = target_function; hooked_function_info->second_trampoline_address = trampoline; hooked_function_info->fake_page_contents = hooked_page_info->fake_page_contents; if (hook_instruction_memory(hooked_function_info, target_function, hooked_function, trampoline, origin_function) == false) { if(hooked_function_info->first_trampoline_address != nullptr) pool_manager::release_pool(hooked_function_info->first_trampoline_address); pool_manager::release_pool(hooked_function_info); LogError("Hook failed"); return false; } // Track all hooked functions within page InsertHeadList(&hooked_page_info->hooked_functions_list, &hooked_function_info->hooked_function_list); return true; } } if (is_page_splitted(physical_address) == false) { void* split_buffer = pool_manager::request_pool<void*>(pool_manager::INTENTION_SPLIT_PML2, true, sizeof(__ept_dynamic_split)); if (split_buffer == nullptr) { LogError("There is no preallocated pool for split"); return false; } if (split_pml2(split_buffer, physical_address) == false) { pool_manager::release_pool(split_buffer); LogError("Split failed"); return false; } } __ept_pte* target_page = get_pml1_entry(physical_address); if (target_page == nullptr) { LogError("Failed to get PML1 entry of the target address"); return false; } __ept_hooked_page_info* hooked_page_info = pool_manager::request_pool<__ept_hooked_page_info*>(pool_manager::INTENTION_TRACK_HOOKED_PAGES, true, sizeof(__ept_hooked_page_info)); if (hooked_page_info == nullptr) { LogError("There is no preallocated pool for hooked page info"); return false; } InitializeListHead(&hooked_page_info->hooked_functions_list); __ept_hooked_function_info* hooked_function_info = pool_manager::request_pool<__ept_hooked_function_info*>(pool_manager::INTENTION_TRACK_HOOKED_FUNCTIONS, true, sizeof(__ept_hooked_function_info)); if (hooked_function_info == nullptr) { pool_manager::release_pool(hooked_page_info); LogError("There is no preallocated pool for hooked function info"); return false; } // // If we are hooking code cave for second trampoline // then origin function in null and we don't have to get pool for trampoline // if (origin_function != nullptr) { hooked_function_info->first_trampoline_address = pool_manager::request_pool<unsigned __int8*>(pool_manager::INTENTION_EXEC_TRAMPOLINE, TRUE, 100); if (hooked_function_info->first_trampoline_address == nullptr) { pool_manager::release_pool(hooked_page_info); pool_manager::release_pool(hooked_function_info); LogError("There is no pre-allocated pool for trampoline"); return false; } } hooked_page_info->pfn_of_hooked_page = GET_PFN(physical_address); hooked_page_info->pfn_of_fake_page_contents = GET_PFN(MmGetPhysicalAddress(hooked_page_info->fake_page_contents).QuadPart); hooked_page_info->entry_address = target_page; hooked_page_info->entry_address->execute = 0; hooked_page_info->entry_address->read = 1; hooked_page_info->entry_address->write = 1; hooked_page_info->original_entry = *target_page; hooked_page_info->changed_entry = *target_page; hooked_page_info->changed_entry.read = 0; hooked_page_info->changed_entry.write = 0; hooked_page_info->changed_entry.execute = 1; hooked_page_info->changed_entry.physical_address = hooked_page_info->pfn_of_fake_page_contents; RtlCopyMemory(&hooked_page_info->fake_page_contents, PAGE_ALIGN(target_function), PAGE_SIZE); hooked_function_info->virtual_address = target_function; hooked_function_info->second_trampoline_address = trampoline; hooked_function_info->fake_page_contents = hooked_page_info->fake_page_contents; if(hook_instruction_memory(hooked_function_info, target_function, hooked_function, trampoline, origin_function) == false) { if (hooked_function_info->first_trampoline_address != nullptr) pool_manager::release_pool(hooked_function_info->first_trampoline_address); pool_manager::release_pool(hooked_function_info); pool_manager::release_pool(hooked_page_info); LogError("Hook failed"); return false; } // Track all hooked functions InsertHeadList(&hooked_page_info->hooked_functions_list, &hooked_function_info->hooked_function_list); // Track all hooked pages InsertHeadList(&g_vmm_context->ept_state->hooked_page_list, &hooked_page_info->hooked_page_list); invept_single_context(g_vmm_context->ept_state->ept_pointer->all); return true; }
最新发布
08-07
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值