NTCreateDEbugOBject for win8..1

最新推荐文章于 2025-06-09 09:36:19 发布

原创最新推荐文章于 2025-06-09 09:36:19 发布 · 1.4k 阅读

0 ·

CC 4.0 BY-SA版权

windwos内核同时被 2 个专栏收录

22 篇文章

订阅专栏

逆向

21 篇文章

订阅专栏

这段代码展示了如何在Windows 8.1上创建调试对象（Debug Object），通过调用ObCreateObject函数并初始化相关内存结构。代码中进行了适当的优化，减少了硬编码，并附带了调试过程的说明。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

这个代码可以在WIN8.1上面跑的  测试成功自己测试的时候呢把ObInsertObjectEx,DbgkDebugObjectType替换一下最后用符号连接就完美了
这个不像昨天的那个伪代码这个可以跑的我跟着调试了一遍代码也是没有用IDA了  IDA太坑
优化一下函数减少一个硬编码现在只有一个dbgobjecttype了
NTSTATUS NTCreateDebugObject(OUT PHANDLE DebugObjectHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN ULONG Flags){
  typedef NTSTATUS (__stdcall *OBCREATEOBJECT)(
   __in KPROCESSOR_MODE ProbeMode,
   __in POBJECT_TYPE ObjectType,
   __in POBJECT_ATTRIBUTES ObjectAttributes,
   __in KPROCESSOR_MODE OwnershipMode,
   __inout_opt PVOID ParseContext,
   __in ULONG ObjectBodySize,
   __in ULONG PagedPoolCharge,
   __in ULONG NonPagedPoolCharge,
   __out PVOID *Object
   );
  PHANDLE handle;
  UNICODE_STRING usFuncName;
  KPROCESSOR_MODE PreviousMode;
  OBCREATEOBJECT ObCreateObject;
  POBJECT_TYPE DebugObject;
  POBJECT_TYPE DbgkDebugObjectType=(POBJECT_TYPE)0x84939eb0 ;

  NTSTATUS status;
  RtlInitUnicodeString(&usFuncName,L"ObCreateObject");
  ObCreateObject = MmGetSystemRoutineAddress(&usFuncName);
  PreviousMode=ExGetPreviousMode();
  if (PreviousMode==KernelMode)
  {
   return STATUS_INVALID_PARAMETER;
  }
  if (Flags & 0xFFFFFFFE)
  {
   return STATUS_INVALID_PARAMETER;
  }

  status= ObCreateObject(PreviousMode,DbgkDebugObjectType,ObjectAttributes,PreviousMode,NULL,0x3c,0, 0,(PVOID)&DebugObject);
  if (!NT_SUCCESS(status))
  {
   return status;
  }
  *(ULONG*)((ULONG)DebugObject+0x10)=1;
  *(ULONG*)((ULONG)DebugObject+0x14)=0;
  *(ULONG*)((ULONG)DebugObject+0x18)=0;

    KeInitializeEvent((PRKEVENT)((ULONG)DebugObject+0x1c),1,0);

  *(ULONG*)((ULONG)DebugObject+0x30+4)= ((ULONG)DebugObject+0x30);
   *(ULONG*)((ULONG)DebugObject+0x30)=((ULONG)DebugObject+0x30);
    KeInitializeEvent((PRKEVENT)DebugObject,0,0);
    *(ULONG*)((ULONG)DebugObject+0x38)=2;

     status= ObInsertObject(DebugObject,NULL,DesiredAccess,0,NULL,&handle);
     if (!NT_SUCCESS(status))
     {
      return status;
     }
    KdPrint(("handle %X",handle));
    *(ULONG*)DebugObjectHandle=handle;

return 0;

}