zoukankan      html  css  js  c++  java
  • 读取SSDT当前函数地址

    #include "ntddk.h"
    VOID DriverUnload(PDRIVER_OBJECT driver)
    {   
        DbgPrint("卸载成功\n\r");
    }
    typedef struct _ServiceDescriptorTable {
        PVOID ServiceTableBase;
        PVOID ServiceCounterTable;
        unsigned int NumberOfServices;
        PVOID ParamTableBase; 
    }*PServiceDescriptorTable; 
    extern PServiceDescriptorTable KeServiceDescriptorTable;
    
    NTSTATUS DriverEntry(PDRIVER_OBJECT driver,PUNICODE_STRING str)
    {
    
    LONG *SSDT_Adr,STB_addr,SSDT_NtOpenProcess_dangqian_Addr;
    
        __asm
        {
            int 3
        }
    DbgPrint("加载成功\n");
    STB_addr=(LONG)KeServiceDescriptorTable->ServiceTableBase;
    DbgPrint("当前服务表基址ServiceTableBase地址为%x \n",STB_addr);
    SSDT_Adr=(PLONG)(STB_addr+0x7A*4);
    DbgPrint("当前STB_addr+0x7A*4=%x \n",SSDT_Adr);
    SSDT_NtOpenProcess_dangqian_Addr=*SSDT_Adr;
    DbgPrint("当前SSDT_NtOpenProcess_Cur_Addr地址为%x\n",SSDT_NtOpenProcess_dangqian_Addr);
    driver->DriverUnload=DriverUnload;
    return STATUS_SUCCESS;
    }


  • 相关阅读:
    练习4.22、4.23、4.24
    练习4.20
    练习4.17、4.18、4.19
    mysql基础语句
    mysql的innodb存储引擎
    git
    mysql集群7.4.1
    批量执行命令
    cnetos 7 mariadb 集群报错分析解答
    windows_agent 添加
  • 原文地址:https://www.cnblogs.com/blogg/p/3157921.html
Copyright © 2011-2022 走看看