Windbg查看WFP驱动callout

kd> dp netio!gWfpGlobal L1

fffff801`96a63258 ffffe001`b9e025b0

kd> u netio!FeInitCalloutTable L10

NETIO!FeInitCalloutTable:

fffff801`96a22490 4053 push rbx

fffff801`96a22492 4883ec20 sub rsp,20h

fffff801`96a22496 488b05bb0d0400 mov rax,qword ptr [NETIO!gWfpGlobal (fffff801`96a63258)]

fffff801`96a2249d 33c9 xor ecx,ecx

fffff801`96a2249f ba57667043 mov edx,43706657h

fffff801`96a224a4 48898848010000 mov qword ptr [rax+148h],rcx

fffff801`96a224ab 48898850010000 mov qword ptr [rax+150h],rcx

fffff801`96a224b2 b900400100 mov ecx,14000h

fffff801`96a224b7 4c8b059a0d0400 mov r8,qword ptr [NETIO!gWfpGlobal (fffff801`96a63258)]

fffff801`96a224be 4981c050010000 add r8, 150h

fffff801`96a224c5 e8223dfeff call NETIO!WfpPoolAllocNonPaged (fffff801`96a061ec)

fffff801`96a224ca 488bd8 mov rbx,rax

 

kd> dps ffffe001`b9e025b0 + 0x150 L1

ffffe001`b9e02700 ffffe001`b9e07000

 

kd> !pool ffffe001`b9e07000

Pool page ffffe001b9e07000 region is Nonpaged pool

*ffffe001b9e07000 : large page allocation, tag is WfpC, size is 0x14000 bytes

Pooltag WfpC : WFP callouts, Binary : netio.sys

 

kd> u NETIO!InitDefaultCallout

NETIO!InitDefaultCallout:

fffff801`96a2251c 4053 push rbx

fffff801`96a2251e 4883ec20 sub rsp,20h

fffff801`96a22522 4c8d051f150400 lea r8,[NETIO!gFeCallout (fffff801`96a63a48)]

fffff801`96a22529 ba57667043 mov edx,43706657h

fffff801`96a2252e b950000000 mov ecx, 50h

fffff801`96a22533 e8b43cfeff call NETIO!WfpPoolAllocNonPaged HideDRV – Rootkit analysis

27

fffff801`96a22538 488bd8 mov rbx,rax

fffff801`96a2253b 4885c0 test rax,rax

 

kd> r $t0= ffffe001b9e07000 ; .for( r $t1=0; @$t1 < 0x30; r $t1=@$t1+1) {dps

@$t0+2*@$ptrsize L2; r $t0=@$t0+ 0x50 ;}

ffffe001`b9e07010 00000000`00000000

ffffe001`b9e07018 00000000`00000000

ffffe001`b9e07060 fffff801`971ab5c0 tcpip!IPSecInboundTransportFilterCalloutClassifyV4

ffffe001`b9e07068 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

ffffe001`b9e070b0 fffff801`971ab700 tcpip!IPSecInboundTransportFilterCalloutClassifyV6

ffffe001`b9e070b8 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

ffffe001`b9e07100 fffff801`971aaf70 tcpip!IPSecOutboundTransportFilterCalloutClassifyV4

ffffe001`b9e07108 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

ffffe001`b9e07150 fffff801`971b30d0 tcpip!IPSecOutboundTransportFilterCalloutClassifyV6

ffffe001`b9e07158 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

ffffe001`b9e071a0 fffff801`971b2990 tcpip!IPSecInboundTunnelFilterCalloutClassifyV4

ffffe001`b9e071a8 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

ffffe001`b9e071f0 fffff801`971b2a50 tcpip!IPSecInboundTunnelFilterCalloutClassifyV6

ffffe001`b9e071f8 fffff801`9712b060 tcpip!IPSecAleConnectCalloutNotify

[…]

ffffe001`b9e07c90 fffff801`97037500 tcpip!WfpAlepSetOptionsCalloutClassify

ffffe001`b9e07c98 fffff801`9707ce80 tcpip!FllAddGroup

ffffe001`b9e07ce0 00000000`00000000