zoukankan      html  css  js  c++  java
  • 读取SSDT当前函数地址

    #include "ntddk.h"
    VOID DriverUnload(PDRIVER_OBJECT driver)
    {   
        DbgPrint("卸载成功\n\r");
    }
    typedef struct _ServiceDescriptorTable {
        PVOID ServiceTableBase;
        PVOID ServiceCounterTable;
        unsigned int NumberOfServices;
        PVOID ParamTableBase; 
    }*PServiceDescriptorTable; 
    extern PServiceDescriptorTable KeServiceDescriptorTable;
    
    NTSTATUS DriverEntry(PDRIVER_OBJECT driver,PUNICODE_STRING str)
    {
    
    LONG *SSDT_Adr,STB_addr,SSDT_NtOpenProcess_dangqian_Addr;
    
        __asm
        {
            int 3
        }
    DbgPrint("加载成功\n");
    STB_addr=(LONG)KeServiceDescriptorTable->ServiceTableBase;
    DbgPrint("当前服务表基址ServiceTableBase地址为%x \n",STB_addr);
    SSDT_Adr=(PLONG)(STB_addr+0x7A*4);
    DbgPrint("当前STB_addr+0x7A*4=%x \n",SSDT_Adr);
    SSDT_NtOpenProcess_dangqian_Addr=*SSDT_Adr;
    DbgPrint("当前SSDT_NtOpenProcess_Cur_Addr地址为%x\n",SSDT_NtOpenProcess_dangqian_Addr);
    driver->DriverUnload=DriverUnload;
    return STATUS_SUCCESS;
    }


  • 相关阅读:
    nginx一键安装脚本
    nginx动静分离之后,设置默认主页
    日志备份
    cc高防主机部署
    原型和原型链
    Git&Github分支
    Git&Github基础
    传输层协议TCP&UDP
    本地库与远程库交互
    SVG
  • 原文地址:https://www.cnblogs.com/blogg/p/3157921.html
Copyright © 2011-2022 走看看