Windows两种遍历所有内核模块的方法
作者:小编日期:2022-04-10浏览:110分类:电脑教程
测试环境
Windows10 X64(本机) + Windows X64(测试机) + Windows XP(测试机)
下面是具体代码与实现:
#include "ntifs.h" #ifdef _M_X32 //0xa8 bytes (sizeof) typedef struct _LDR_DATA_TABLE_ENTRY { struct _LIST_ENTRY InLoadOrderLinks; //0x0 struct _LIST_ENTRY InMemoryOrderLinks; //0x8 struct _LIST_ENTRY InInitializationOrderLinks; //0x10 VOID* DllBase; //0x18 VOID* EntryPoint; //0x1c ULONG SizeOfImage; //0x20 struct _UNICODE_STRING FullDllName; //0x24 struct _UNICODE_STRING BaseDllName; //0x2c union { UCHAR FlagGroup[4]; //0x34 ULONG Flags; //0x34 struct { ULONG PackagedBinary : 1; //0x34 ULONG MarkedForRemoval : 1; //0x34 ULONG ImageDll : 1; //0x34 ULONG LoadNotificationsSent : 1; //0x34 ULONG TelemetryEntryProcessed : 1; //0x34 ULONG ProcessStaticImport : 1; //0x34 ULONG InLegacyLists : 1; //0x34 ULONG InIndexes : 1; //0x34 ULONG ShimDll : 1; //0x34 ULONG InExceptionTable : 1; //0x34 ULONG ReservedFlags1 : 2; //0x34 ULONG LoadInProgress : 1; //0x34 ULONG LoadConfigProcessed : 1; //0x34 ULONG EntryProcessed : 1; //0x34 ULONG ProtectDelayLoad : 1; //0x34 ULONG ReservedFlags3 : 2; //0x34 ULONG DontCallForThreads : 1; //0x34 ULONG ProcessAttachCalled : 1; //0x34 ULONG ProcessAttachFailed : 1; //0x34 ULONG CorDeferredValidate : 1; //0x34 ULONG CorImage : 1; //0x34 ULONG DontRelocate : 1; //0x34 ULONG CorILOnly : 1; //0x34 ULONG ChpeImage : 1; //0x34 ULONG ReservedFlags5 : 2; //0x34 ULONG Redirected : 1; //0x34 ULONG ReservedFlags6 : 2; //0x34 ULONG CompatDatabaseProcessed : 1; //0x34 }; }; USHORT ObsoleteLoadCount; //0x38 USHORT TlsIndex; //0x3a struct _LIST_ENTRY HashLinks; //0x3c ULONG TimeDateStamp; //0x44 struct _ACTIVATION_CONTEXT* EntryPointActivationContext; //0x48 VOID* Lock; //0x4c struct _LDR_DDAG_NODE* DdagNode; //0x50 struct _LIST_ENTRY NodeModuleLink; //0x54 struct _LDRP_LOAD_CONTEXT* LoadContext; //0x5c VOID* ParentDllBase; //0x60 VOID* SwitchBackContext; //0x64 struct _RTL_BALANCED_NODE BaseAddressIndexNode; //0x68 struct _RTL_BALANCED_NODE MappingInfoIndexNode; //0x74 ULONG OriginalBase; //0x80 union _LARGE_INTEGER LoadTime; //0x88 ULONG BaseNameHashValue; //0x90 enum _LDR_DLL_LOAD_REASON LoadReason; //0x94 ULONG ImplicitPathOptions; //0x98 ULONG ReferenceCount; //0x9c ULONG DependentLoadFlags; //0xa0 UCHAR SigningLevel; //0xa4 }LDR_DATA_TABLE_ENTRY,*PLDR_DATA_TABLE_ENTRY; #else //0x138 bytes (sizeof) typedef struct _LDR_DATA_TABLE_ENTRY { struct _LIST_ENTRY InLoadOrderLinks; //0x0 struct _LIST_ENTRY InMemoryOrderLinks; //0x10 struct _LIST_ENTRY InInitializationOrderLinks; //0x20 VOID* DllBase; //0x30 VOID* EntryPoint; //0x38 ULONG SizeOfImage; //0x40 struct _UNICODE_STRING FullDllName; //0x48 struct _UNICODE_STRING BaseDllName; //0x58 union { UCHAR FlagGroup[4]; //0x68 ULONG Flags; //0x68 struct { ULONG PackagedBinary : 1; //0x68 ULONG MarkedForRemoval : 1; //0x68 ULONG ImageDll : 1; //0x68 ULONG LoadNotificationsSent : 1; //0x68 ULONG TelemetryEntryProcessed : 1; //0x68 ULONG ProcessStaticImport : 1; //0x68 ULONG InLegacyLists : 1; //0x68 ULONG InIndexes : 1; //0x68 ULONG ShimDll : 1; //0x68 ULONG InExceptionTable : 1; //0x68 ULONG ReservedFlags1 : 2; //0x68 ULONG LoadInProgress : 1; //0x68 ULONG LoadConfigProcessed : 1; //0x68 ULONG EntryProcessed : 1; //0x68 ULONG ProtectDelayLoad : 1; //0x68 ULONG ReservedFlags3 : 2; //0x68 ULONG DontCallForThreads : 1; //0x68 ULONG ProcessAttachCalled : 1; //0x68 ULONG ProcessAttachFailed : 1; //0x68 ULONG CorDeferredValidate : 1; //0x68 ULONG CorImage : 1; //0x68 ULONG DontRelocate : 1; //0x68 ULONG CorILOnly : 1; //0x68 ULONG ChpeImage : 1; //0x68 ULONG ChpeEmulatorImage : 1; //0x68 ULONG ReservedFlags5 : 1; //0x68 ULONG Redirected : 1; //0x68 ULONG ReservedFlags6 : 2; //0x68 ULONG CompatDatabaseProcessed : 1; //0x68 }; }; USHORT ObsoleteLoadCount; //0x6c USHORT TlsIndex; //0x6e struct _LIST_ENTRY HashLinks; //0x70 ULONG TimeDateStamp; //0x80 struct _ACTIVATION_CONTEXT* EntryPointActivationContext; //0x88 VOID* Lock; //0x90 struct _LDR_DDAG_NODE* DdagNode; //0x98 struct _LIST_ENTRY NodeModuleLink; //0xa0 struct _LDRP_LOAD_CONTEXT* LoadContext; //0xb0 VOID* ParentDllBase; //0xb8 VOID* SwitchBackContext; //0xc0 struct _RTL_BALANCED_NODE BaseAddressIndexNode; //0xc8 struct _RTL_BALANCED_NODE MappingInfoIndexNode; //0xe0 ULONGLONG OriginalBase; //0xf8 union _LARGE_INTEGER LoadTime; //0x100 ULONG BaseNameHashValue; //0x108 enum _LDR_DLL_LOAD_REASON LoadReason; //0x10c ULONG ImplicitPathOptions; //0x110 ULONG ReferenceCount; //0x114 ULONG DependentLoadFlags; //0x118 UCHAR SigningLevel; //0x11c ULONG CheckSum; //0x120 VOID* ActivePatchImageBase; //0x128 enum _LDR_HOT_PATCH_STATE HotPatchState; //0x130 }LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY; #endif typedef __kernel_entry NTSTATUS funNtQuerySystemInformation( char SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength ); #define WORD unsigned short #define BYTE unsigned char typedef struct _SYSTEM_MODULE { ULONG Reserved1; ULONG Reserved2; PVOID ImageBaseAddress; size_t ImageSize; size_t Flags; WORD Id; WORD Rank; WORD w018; WORD NameOffset; BYTE Name[MAXIMUM_FILENAME_LENGTH]; } SYSTEM_MODULE, * PSYSTEM_MODULE; typedef struct _SYSTEM_MODULE_INFORMATION { size_t ModulesCount; SYSTEM_MODULE Modules[0]; } SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION; void PrintAllMoudleBySection(PDRIVER_OBJECT driver) { LDR_DATA_TABLE_ENTRY* ldr = driver->DriverSection; LIST_ENTRY* Var_Ldr = ldr; do { DbgPrint("%wZ %x\n", &ldr->BaseDllName, ldr->DllBase); ldr = ldr->InLoadOrderLinks.Flink; } while (Var_Ldr != ldr); } void PrintAllMoudleByNtQuerySystemInformation() { UNICODE_STRING DstUnicodeString; RtlInitUnicodeString(&DstUnicodeString, L"NtQuerySystemInformation"); funNtQuerySystemInformation* NtQuerySystemInformation = MmGetSystemRoutineAddress(&DstUnicodeString); if (NtQuerySystemInformation == NULL) { DbgPrint("获取地址失败\n"); return STATUS_UNSUCCESSFUL; } SYSTEM_MODULE_INFORMATION* SystemInformation; unsigned int SystemInfoSize = 0x1000; unsigned int ReturnLength = 0; do { SystemInformation = ExAllocatePoolWithTag(PagedPool, SystemInfoSize, " kdD"); if (SystemInformation == NULL) { DbgPrint("分配内存失败\n"); return STATUS_UNSUCCESSFUL; } NTSTATUS Status = NtQuerySystemInformation(0xB, SystemInformation, SystemInfoSize, &ReturnLength); if (NT_SUCCESS(Status)) { break; } else if (Status != STATUS_INFO_LENGTH_MISMATCH) { return STATUS_INFO_LENGTH_MISMATCH; } else { ExFreePoolWithTag(SystemInformation, " kdD"); SystemInfoSize <<= 1; } } while (1); DbgPrint("\n\n****************************************************************\n\n\n"); for (size_t i = 0; i < SystemInformation->ModulesCount; i++) { unsigned char* Name = SystemInformation->Modules[i].NameOffset + SystemInformation->Modules[i].Name; DbgPrint("%s %x\n", Name, SystemInformation->Modules[i].ImageBaseAddress); } ExFreePoolWithTag(SystemInformation, " kdD"); } NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path) { driver->Flags |= 0x20; driver->DriverUnload = DriverUnload; PrintAllMoudleBySection(driver); PrintAllMoudleByNtQuerySystemInformation(); DbgPrint("Hello Wolrd!\n"); return STATUS_SUCCESS; }
猜你还喜欢
- 05-15 用CMD命令U盘NTFS转FAT32格式出现CONVERT无法供NTFS驱动器使用怎么办
- 05-15 Win10 KB5013942更新安装失败怎么办?
- 05-15 Win10最近打开过的文件记录怎么清除掉
- 05-15 Win10系统特殊符号怎么打?
- 05-15 Win10里的开始菜单怎么删除项目?
- 05-11 win7物理内存占用过高的解决办法
- 05-11 怎么在不格式化U盘的情况下转换U盘的格式
- 05-09 WYSIWYG Web Builder 17 (64-bit)汉化步骤
- 05-07 win10桌面上的图标和任务栏图标不见了怎么办
- 05-07 Windows任务管理器无法结束进程怎么办?教你一招强制结束!
- 05-07 Win10内置的摄像头功能不能用怎么办?
- 05-07 装Windows 10系统电脑配置最低要求
- 搜一下它不香吗
-
最新发布
热门推荐
随机推荐
- 1哔哩下载姬v1.5.2正式版
- 2GoldWave v6.63绿色汉化版
- 3U盘杀毒专家USBKiller v3.2绿色版
- 4PC剪映专业版3.0.0官方版
- 5零基础必看的web前端HTML+CSS
- 6蓝海公众号项目训练营视频课程
- 7腾讯发布首份可持续社会价值报告:用长期主义推动社会价值共创
- 8谷歌三星联手,用户步数等健康数据可跨 App 及设备同步
- 9字节跳动社交心:抖音上线“兴趣匹配”功能,打开陌生人/匿名社交玩法
- 10微软IE浏览器将于6月16日正式退役,Edge浏览器官方:被黑了这么多年终于要说再见啦