MmGetSystemRoutineAddress函数获取内存地址

最新推荐文章于 2022-10-14 13:05:49 发布

郁闷的坦然

最新推荐文章于 2022-10-14 13:05:49 发布

阅读量2.4k

点赞数

CC 4.0 BY-SA版权

分类专栏：驱动

本文链接：https://blog.youkuaiyun.com/cmdasm/article/details/10261517

驱动专栏收录该内容

26 篇文章

订阅专栏

#include "ntddk.h"


ULONG GetCidAddr()
{

	PUCHAR addr;
	PUCHAR p;
	UNICODE_STRING pslookup;  
	ULONG cid;

	RtlInitUnicodeString (&pslookup, L"PsLookupProcessByProcessId");  
	//RtlInitUnicodeString (&pslookup, L"PsLookupProcessThreadbyCid");  
	addr = (PUCHAR) MmGetSystemRoutineAddress(&pslookup);//MmGetSystemRoutineAddress可以通过函数名获得函数地址
	KdPrint(("PsLookupProcessByProcessId addr=0x%x\r\n", addr));
	RtlInitUnicodeString (&pslookup, L"NtOpenProcess");
	addr = (PUCHAR) MmGetSystemRoutineAddress(&pslookup);//MmGetSystemRoutineAddress可以通过函数名获得函数地址
	KdPrint(("NtOpenProcess addr=0x%x\r\n", addr));
	for (p=addr;p<addr+PAGE_SIZE;p++)
	{
		if((*(PUSHORT)p==0x35ff)&&(*(p+6)==0xe8))
		{
			cid=*(PULONG)(p+2);
			return cid;
			//break;
		}
	}
	return 0;
}

VOID Uload(PDRIVER_OBJECT obj)
{
	KdPrint(("驱动被卸载咯\n"));
}


NTSTATUS DriverEntry( 
			IN PDRIVER_OBJECT  DriverObject, 
			IN PUNICODE_STRING  RegistryPath 
			)
{
	DriverObject->DriverUnload = Uload;
	GetCidAddr();
    

}