遍历驱动类型

最新推荐文章于 2024-10-28 14:09:58 发布
转载最新推荐文章于 2024-10-28 14:09:58 发布 · 418 阅读
164 篇文章
订阅专栏

#include"ntifs.h"
typedef VOID(__stdcall FUNCT_00A4_0EDA_DumpProcedure) (VOID*, struct _OBJECT_DUMP_CONTROL*);
typedef LONG32(__stdcall FUNCT_000F_0EE2_OpenProcedure) (enum _OB_OPEN_REASON, CHAR, struct _EPROCESS*, VOID*, ULONG32*, ULONG32);
typedef VOID(__stdcall FUNCT_00A4_0EF0_CloseProcedure) (struct _EPROCESS*, VOID*, ULONG32, ULONG32);
typedef VOID(__stdcall FUNCT_00A4_0665_Free_InterfaceReference_InterfaceDereference_DeleteProcedure_WorkerRoutine_Callback_ReleaseFromLazyWrite_ReleaseFromReadAhead) (VOID*);
typedef LONG32(__stdcall FUNCT_000F_0EF6_ParseProcedure) (VOID*, VOID*, struct _ACCESS_STATE*, CHAR, ULONG32, struct _UNICODE_STRING*, struct _UNICODE_STRING*, VOID*, struct _SECURITY_QUALITY_OF_SERVICE*, VOID**);
typedef LONG32(__stdcall FUNCT_000F_0F02_SecurityProcedure) (VOID*, enum _SECURITY_OPERATION_CODE, ULONG32*, VOID*, ULONG32*, VOID**, enum _POOL_TYPE, struct _GENERIC_MAPPING*, CHAR);
typedef LONG32(__stdcall FUNCT_000F_0F13_QueryNameProcedure) (VOID*, UINT8, struct _OBJECT_NAME_INFORMATION*, ULONG32, ULONG32*, CHAR);
typedef UINT8(__stdcall FUNCT_0067_0F1B_OkayToCloseProcedure) (struct _EPROCESS*, VOID*, VOID*, CHAR);

typedef struct _OBJECT_TYPE_INITIALIZER                                                                                                                             // 25 elements, 0x50 bytes (sizeof) 
{
	/*0x000*/     UINT16       Length;
	union                                                                                                                                                           // 2 elements, 0x1 bytes (sizeof)   
	{
		/*0x002*/         UINT8        ObjectTypeFlags;
		struct                                                                                                                                                      // 7 elements, 0x1 bytes (sizeof)   
		{
			/*0x002*/             UINT8        CaseInsensitive : 1;                                                                                                                       // 0 BitPosition                    
			/*0x002*/             UINT8        UnnamedObjectsOnly : 1;                                                                                                                    // 1 BitPosition                    
			/*0x002*/             UINT8        UseDefaultObject : 1;                                                                                                                      // 2 BitPosition                    
			/*0x002*/             UINT8        SecurityRequired : 1;                                                                                                                      // 3 BitPosition                    
			/*0x002*/             UINT8        MaintainHandleCount : 1;                                                                                                                   // 4 BitPosition                    
			/*0x002*/             UINT8        MaintainTypeList : 1;                                                                                                                      // 5 BitPosition                    
			/*0x002*/             UINT8        SupportsObjectCallbacks : 1;                                                                                                               // 6 BitPosition                    
		};
	};
	/*0x004*/     ULONG32      ObjectTypeCode;
	/*0x008*/     ULONG32      InvalidAttributes;
	/*0x00C*/     struct _GENERIC_MAPPING GenericMapping;                                                                                                                         // 4 elements, 0x10 bytes (sizeof)  
	/*0x01C*/     ULONG32      ValidAccessMask;
	/*0x020*/     ULONG32      RetainAccess;
	/*0x024*/     enum _POOL_TYPE PoolType;
	/*0x028*/     ULONG32      DefaultPagedPoolCharge;
	/*0x02C*/     ULONG32      DefaultNonPagedPoolCharge;
	/*0x030*/     FUNCT_00A4_0EDA_DumpProcedure* DumpProcedure;
	/*0x034*/     FUNCT_000F_0EE2_OpenProcedure* OpenProcedure;
	/*0x038*/     FUNCT_00A4_0EF0_CloseProcedure* CloseProcedure;
	/*0x03C*/     FUNCT_00A4_0665_Free_InterfaceReference_InterfaceDereference_DeleteProcedure_WorkerRoutine_Callback_ReleaseFromLazyWrite_ReleaseFromReadAhead* DeleteProcedure;
	/*0x040*/     FUNCT_000F_0EF6_ParseProcedure* ParseProcedure;
	/*0x044*/     FUNCT_000F_0F02_SecurityProcedure* SecurityProcedure;
	/*0x048*/     FUNCT_000F_0F13_QueryNameProcedure* QueryNameProcedure;
	/*0x04C*/     FUNCT_0067_0F1B_OkayToCloseProcedure* OkayToCloseProcedure;
}OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;                                                                                                                    // 2 elements, 0x1 bytes (sizeof)   


typedef struct _OBJECT_TYPE                   // 12 elements, 0x88 bytes (sizeof) 
{
	/*0x000*/     struct _LIST_ENTRY TypeList;              // 2 elements, 0x8 bytes (sizeof)   
	/*0x008*/     struct _UNICODE_STRING Name;              // 3 elements, 0x8 bytes (sizeof)   
	/*0x010*/     VOID*        DefaultObject;
	/*0x014*/     UINT8        Index;
	/*0x015*/     UINT8        _PADDING0_[0x3];
	/*0x018*/     ULONG32      TotalNumberOfObjects;
	/*0x01C*/     ULONG32      TotalNumberOfHandles;
	/*0x020*/     ULONG32      HighWaterNumberOfObjects;
	/*0x024*/     ULONG32      HighWaterNumberOfHandles;
	/*0x028*/     struct _OBJECT_TYPE_INITIALIZER TypeInfo; // 25 elements, 0x50 bytes (sizeof) 
	/*0x078*/      EX_PUSH_LOCK TypeLock;            // 7 elements, 0x4 bytes (sizeof)   
	/*0x07C*/     ULONG32      Key;
	/*0x080*/     struct _LIST_ENTRY CallbackList;          // 2 elements, 0x8 bytes (sizeof)   
}OBJECT_TYPE, *POBJECT_TYPE;
POBJECT_TYPE shuchu_OBJECT_TYPE;

VOID xiezai1(PDRIVER_OBJECT qudongduixiang)
{
	ExFreePool(shuchu_OBJECT_TYPE);
	KdPrint(("驱动卸载"));
}

NTSTATUS DriverEntry(PDRIVER_OBJECT qudongduixiang, PUNICODE_STRING zhucebiao)
{
	KdPrint(("驱动开始"));

	UNICODE_STRING mingzi;
	UNICODE_STRING mingzi_linshi;
	PVOID m_obgetobjecttype;
	ULONG *ObTypeIndexTable;
	ULONG i = 2;

	shuchu_OBJECT_TYPE = ExAllocatePool(NonPagedPool, sizeof(OBJECT_TYPE));
	RtlInitUnicodeString(&mingzi, L"ObGetObjectType");
	RtlInitUnicodeString(&mingzi_linshi, L"process");
	
	m_obgetobjecttype = MmGetSystemRoutineAddress(&mingzi);
	if (MmIsAddressValid(m_obgetobjecttype))
	{
		KdPrint(("m_obgetobjecttype %x", m_obgetobjecttype));
		ObTypeIndexTable = *(ULONG**)((ULONG)m_obgetobjecttype + 15);
		while (ObTypeIndexTable[i])
		{
			RtlCopyMemory(shuchu_OBJECT_TYPE, (POBJECT_TYPE)ObTypeIndexTable[i], sizeof(OBJECT_TYPE));
			KdPrint(("ObTypeIndexTable[%d %x]:%wZ  __%wZ", i, i, ObTypeIndexTable[i] + 8, &shuchu_OBJECT_TYPE->Name));
			if (RtlCompareUnicodeString(&shuchu_OBJECT_TYPE->Name, &mingzi_linshi,TRUE)==0)
			{
				KdPrint(("OpenProcedure%x", shuchu_OBJECT_TYPE->TypeInfo.OpenProcedure));
				KdPrint(("CloseProcedure%x", shuchu_OBJECT_TYPE->TypeInfo.CloseProcedure));
				KdPrint(("DeleteProcedure%x", shuchu_OBJECT_TYPE->TypeInfo.DeleteProcedure));
			}
			i++;
		}
	}
	//实体对象 根据 对象头 能查找标号 进而得到名字
	qudongduixiang->DriverUnload = xiezai1;
	return STATUS_SUCCESS;

}