|
|
本帖最后由 Krueger 于 2020-8-1 23:14 编辑
我正在嘗試列出模塊win32k.sys (C:\Windows \ System32 \ win32k.sys) 的所有功能，但只返回了某些功能。
例如，如果您繼續使用PC Hunter ARK：Ring0掛鉤> Shadow SSDT可以看到至少列出了825個條目 (Windows 7 32bit) 。
雖然下面的代碼在執行時僅返回253個條目。
我如何獲得PC Hunter的相同結果？ 我看了看模塊的出口表，對嗎？ 還是大多數是導入函數（導入表）？
- #include <ntddk.h>
- #include <windef.h>
- #include <ntimage.h>
- DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)
- {
- #define SEC_IMAGE 0x1000000
- HANDLE hThread, hSection, hFile, hMod;
- SECTION_IMAGE_INFORMATION sii;
- IMAGE_DOS_HEADER* dosheader;
- IMAGE_OPTIONAL_HEADER* opthdr;
- IMAGE_EXPORT_DIRECTORY* pExportTable;
- DWORD* arrayOfFunctionAddresses;
- DWORD* arrayOfFunctionNames;
- WORD* arrayOfFunctionOrdinals;
- DWORD functionOrdinal;
- DWORD Base, x, functionAddress;
- char* functionName;
- STRING ntFunctionName, ntFunctionNameSearch;
- PVOID BaseAddress = NULL;
- SIZE_T size = 0;
- OBJECT_ATTRIBUTES oa = { sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE };
- IO_STATUS_BLOCK iosb;
- ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);
- oa.ObjectName = 0;
- ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0, PAGE_EXECUTE, SEC_IMAGE, hFile);
- ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);
- ZwClose(hFile);
- hMod = BaseAddress;
- dosheader = (IMAGE_DOS_HEADER *)hMod;
- opthdr = (IMAGE_OPTIONAL_HEADER *)((BYTE*)hMod + dosheader->e_lfanew + 24);
- pExportTable = (IMAGE_EXPORT_DIRECTORY*)((BYTE*)hMod + opthdr->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
- arrayOfFunctionAddresses = (DWORD*)((BYTE*)hMod + pExportTable->AddressOfFunctions);
- arrayOfFunctionNames = (DWORD*)((BYTE*)hMod + pExportTable->AddressOfNames);
- arrayOfFunctionOrdinals = (WORD*)((BYTE*)hMod + pExportTable->AddressOfNameOrdinals);
- Base = pExportTable->Base;
- RtlInitString(&ntFunctionNameSearch, lpFunctionName);
- DbgPrint("NumberOfEntries: %d", pExportTable->NumberOfFunctions);
- for (x = 0; x < pExportTable->NumberOfFunctions; x++)
- {
- functionName = (char*)((BYTE*)hMod + arrayOfFunctionNames[x]);
- DbgPrint("FuncName: %s\n", functionName);
- RtlInitString(&ntFunctionName, functionName);
- functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1;
- functionAddress = (DWORD)((BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);
- if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)
- {
- ZwClose(hSection);
- return functionAddress;
- }
- }
- ZwClose(hSection);
- return 0;
- }
- //---------------------- DriverEntry() -------------------------
- UNICODE_STRING dllName;
- RtlInitUnicodeString(&dllName, L"\\Device\\HarddiskVolume1\\Windows\\System32\\win32k.sys");
- GetDllFunctionAddress(ANSI_NULL, &dllName);
輸出量:
參考代碼 > https://www.geek-share.com/detail/2388547280.html
|
|
发表于 2020-8-1 08:43:45
楼主
发表于 2020-8-6 00:00:06
