#define CLEANXCB(p/*PSCB*/) {p->CleanupCount = 0;p->Fcb->CleanupCount = 0;p->Fcb->LinkCount = 1;}
NTSTATUS NT5FuckChildren(PSCB pScb)//XP
{
PULONG pExact = NULL ,pExact_Bak = NULL;
PLCB pLcb = NULL;
LIST_ENTRY *pList = NULL,*pNew = NULL;
PSCB pMyScb = NULL;
char Sign = 0;
if (!pScb || 0x703 != *(PUSHORT)pScb){
DbgPrint("pScb为NULL或者非文件夹不用Fuck!\n");
return 0;
}
DbgPrint("----------------进入目录分析----------------\n");
CLEANXCB(pScb)
pExact_Bak = pExact = ((PCHAR)pScb + 0x160) ;
//DbgPrint("pExact %X *pExact %X\n",pExact,*pExact);
if (*pExact == (ULONG)pExact){
DbgPrint("此SCB无子LCB!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
pLcb = (PLCB)(*pExact - 0x8);
//DbgPrint("PLCB%XpLcb->ScbLinks.Flink%XpLcb->ScbLinks.Blink%X\n",pLcb,pLcb->ScbLinks.Flink,pLcb->ScbLinks.Blink);
if (pLcb->NodeTypeCode != 0x70B){
DbgPrint("此LCB错误!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
while(pLcb->ScbLinks.Flink != pExact ){
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,pLcb->CleanupCount,pLcb->Scb);
//===============================================================================
pNew = pList = & ((PFCB)((PCHAR)pLcb+0x14))->ScbQueue;
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = CONTAINING_RECORD(pList->Flink,SCB, FcbLinks.Flink);
DbgPrint("----------------MySCB %X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
//--------------------------
CLEANXCB(pMyScb)
//-------------------------
if (0x703 == pMyScb->Header.NodeTypeCode) {//此SCB代表一个目录
DbgPrint("\t");
NT5FuckChildren(pMyScb);
}
pList = pList->Flink;
}
//=================================================================================
pLcb = ( ((PUCHAR)pLcb->ScbLinks.Flink) -0x8);
}
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,pLcb->CleanupCount,pLcb->Scb);
pNew = pList = & ((PFCB)pLcb->CleanupCount)->ScbQueue;
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = CONTAINING_RECORD(pList->Flink,SCB, FcbLinks.Flink);
DbgPrint("----------------MySCB: %X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
CLEANXCB(pMyScb)
if (0x703 == pMyScb->Header.NodeTypeCode) {//此SCB代表一个目录
DbgPrint("\t");
NT5FuckChildren(pMyScb);
}
pList = pList->Flink;
}
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_SUCCESS;
}
#defineNT7CLEANXCB(p/*PSCB*/){*(PULONG)((PUCHAR)p+0x60)=0;*(PULONG)(((PUCHAR)(*(PULONG)(( PUCHAR)p + 0x50))) + 0xC4) = 0;}
NTSTATUS NT7FuckChildren(PSCB pScb)
{
PULONG pExact = NULL ,pExact_Bak = NULL;
PLCB pLcb = NULL;
LIST_ENTRY *pList = NULL,*pNew = NULL;
PSCB pMyScb = NULL;
char Sign = 0;
DbgPrint("----------------进入目录分析----------------\n");
NT7CLEANXCB(pScb)
pExact_Bak = pExact = (PULONG)((PCHAR)pScb + 0x168) ;
//DbgPrint("pExact %X *pExact %X\n",pExact,*pExact);
if (*pExact == (ULONG)pExact){
DbgPrint("此SCB无子LCB!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
pLcb = (PLCB)(*pExact - 0x8);
//DbgPrint("PLCB%XpLcb->ScbLinks.Flink%XpLcb->ScbLinks.Blink%X\n",pLcb,pLcb->ScbLinks.Flink,pLcb->ScbLinks.Blink);
if (pLcb->NodeTypeCode != 0x70B){
DbgPrint("此LCB错误!\n");
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_UNSUCCESSFUL;
}
while( (PULONG)pLcb->ScbLinks.Flink != pExact /*&& (PULONG) pLcb->ScbLinks.Blink != pExact */){
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,*(PULONG)(( PUCHAR)pLcb + 0x18),pLcb->Scb);
//===============================================================================
pNew = pList = & ((PFCB)(*(PULONG)(( PUCHAR)pLcb + 0x18)))->LcbQueue;//实际为ScbQueue
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = (PSCB)((PUCHAR)pList->Flink - 0x48);
DbgPrint("----------------My SCB%X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
//--------------------------
NT7CLEANXCB(pMyScb)
//-------------------------
if (0x703 == *(PUSHORT)(pMyScb)) {//此SCB代表一个目录
DbgPrint("\t");
NT7FuckChildren(pMyScb);
}
pList = pList->Flink;
}
// =================================================================================
pLcb = (PLCB)( ((PUCHAR)pLcb->ScbLinks.Flink) -0x8);
}
DbgPrint("-->LCB: %X FCB: %X SCB: %X\n",pLcb,*(PULONG)(( PUCHAR)pLcb + 0x18),pLcb->Scb);
//===============================================================================
pNew = pList = & ((PFCB)(*(PULONG)(( PUCHAR)pLcb + 0x18)))->LcbQueue;
while(!((pList->Blink ==pNew || pList->Flink ==pNew) || pList->Flink==NULL)){
pMyScb = (PSCB)((PUCHAR)pList->Flink - 0x48);
DbgPrint("----------------My SCB%X NodeTypeCode:%X\n",pMyScb,pMyScb->Header.NodeTypeCode);
//--------------------------
NT7CLEANXCB(pMyScb)
//-------------------------
if (0x703 == *(PUSHORT)(pMyScb)) {//此SCB代表一个目录
DbgPrint("\t");
NT7FuckChildren(pMyScb);
}
pList = pList->Flink;
}
DbgPrint("----------------目录分析完毕----------------\n");
return STATUS_SUCCESS;
}
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
