遍历idt表_数组

最新推荐文章于 2024-08-23 17:49:52 发布

转载最新推荐文章于 2024-08-23 17:49:52 发布 · 749 阅读

内核驱动全部集合专栏收录该内容

164 篇文章

订阅专栏

#include "ntddk.h"
#define WORD	USHORT
#define DWORD	ULONG
#define MAKELONG(a, b)      ((LONG)(((WORD)(((DWORD_PTR)(a)) & 0xffff)) \
	| ((DWORD)((WORD)(((DWORD_PTR)(b)) & 0xffff))) << 16))
typedef struct _IDTR{
	USHORT   IDT_limit;
	USHORT   IDT_LOWbase;
	USHORT   IDT_HIGbase;
}IDTR, *PIDTR;
typedef struct _IDTENTRY
{
	unsigned short LowOffset;
	unsigned short selector;
	unsigned char retention : 5;
	unsigned char zero1 : 3;
	unsigned char gate_type : 1;
	unsigned char zero2 : 1;
	unsigned char interrupt_gate_size : 1;
	unsigned char zero3 : 1;
	unsigned char zero4 : 1;
	unsigned char DPL : 2;
	unsigned char P : 1;
	unsigned short HiOffset;
} IDTENTRY, *PIDTENTRY;

VOID MyUnload(PDRIVER_OBJECT	pDriverObject)
{
	KdPrint(("驱动卸载成功\n"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT	pDriverObject, PUNICODE_STRING Reg_Path)
{
	IDTR idt;
	DWORD dizhi0;
	IDTENTRY*dizhi1;

	int i = 0;
	__asm
	{
		SIDT idt
	}
	dizhi0 = MAKELONG(idt.IDT_LOWbase, idt.IDT_HIGbase);
	KdPrint(("idt数组的地址%x\n", dizhi0));
	KdPrint(("idt数组的个数%d\n", idt.IDT_limit/8));

	dizhi1 = (IDTENTRY*)MAKELONG(idt.IDT_LOWbase, idt.IDT_HIGbase);
	for (i = 0; i <=idt.IDT_limit / 8;i++)
	{
		KdPrint(("%d:%x 由高:%x 低:%x \n", i, MAKELONG(dizhi1[i].LowOffset, dizhi1[i].HiOffset),dizhi1[i].HiOffset, dizhi1[i].LowOffset));
	}
	pDriverObject->DriverUnload = MyUnload;
	return STATUS_SUCCESS;
}