-
-
[求助]求遍历shadowssdt函数的地址
-
发表于:
2017-5-15 21:46
2905
-
apg教程有遍历 shadowssdt函数地址 但是看的是翻录 找不到源码
网上搜了2天 找不到 代码是切换到有gui进程 得到的地址 那个 不会
还有遍历 也不会 像ssdt一样遍历 函数名地址吗
我会蓝屏
#include "ntddk.h"
//SSDT结构体
typedef struct ServiceDescriptorTable {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTable;
unsigned int NumberOfServices;
unsigned int *ParamTableBase;
}ServiceDescriptorTable, *PServiceDescriptorTable;
PServiceDescriptorTable KeServiceDescriptorTableShadow;
NTSYSAPI
BOOLEAN
NTAPI
KeAddSystemServiceTable(
IN PULONG_PTR Base,
IN PULONG Count OPTIONAL,
IN ULONG Limit,
IN PUCHAR Number,
IN ULONG Index
);
VOID MyUnload(PDRIVER_OBJECT pDriverObject)
{
KdPrint(("驱动卸载成功\n"));
}
PULONG getAddressOfShadowTable()
{
PULONG p;
//兼容XP，2003和WIN7
//nt!KeAddSystemServiceTable+0x1a:
//83de0022 8d8840dbdb83 lea ecx,nt!KeServiceDescriptorTableShadow (83dbdb40)[eax]
//83de0028 833900 cmp dword ptr [ecx],0
//83de002b 7546 jne nt!KeAddSystemServiceTable+0x6b (83de0073)
//8d88两个字节，所以+2
p = (PULONG)((ULONG)KeAddSystemServiceTable + 0x1a + 2);
return (PULONG)(*p);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING Reg_Path)
{
DbgPrint("address: 0x%X", getAddressOfShadowTable());
KeServiceDescriptorTableShadow = (PServiceDescriptorTable)getAddressOfShadowTable();
DbgPrint("num of services:%d", KeServiceDescriptorTableShadow[1].NumberOfServices);
int j = KeServiceDescriptorTableShadow[1].NumberOfServices;
//for (int i = 0; i <j; i++)
//{
// KdPrint(("%x\n", KeServiceDescriptorTableShadow[1].ServiceTableBase[i]));
//} 是这样遍历吗 会蓝屏
pDriverObject->DriverUnload = MyUnload;
return STATUS_SUCCESS;
}网上找不到 切换到有gui进程 遍历函数名地址 的 代码 遇到这里卡主了
求求大牛 贴出来 学习
[培训]科锐逆向工程师培训第53期2025年7月8日开班！
