通过 ZwQuerySystemInformation 枚举内核模块和基地址

forwe

Driver.h

1. #ifdef __cplusplus
   
2. extern "C"
   
3. {
   
4. #endif
   
5. #include <ntddk.h>
   
6. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
   
7. 
   
8. #ifdef __cplusplus
   
9. }
   
10. #endif
    
11. 
    
12. #define PAGEDCODE code_seg("PAGE")
    
13. #define LOCKEDCODE code_seg()
    
14. #define INITCODE code_seg("INIT")
    
15. 
    
16. #define PAGEDDATA data_seg("PAGE")
    
17. #define LOCKEDDATA data_seg()
    
18. #define INITDATA data_seg("INIT")
    
19. 
    
20. #define arraysize(p) (sizeof(p)/sizeof((p)[0]))
    
21. 
    
22. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);
    
23. 
    
24. typedef enum _SYSTEM_INFORMATION_CLASS {
    
25.         SystemBasicInformation,
    
26.         SystemProcessorInformation,             // obsolete...delete
    
27.         SystemPerformanceInformation,
    
28.         SystemTimeOfDayInformation,
    
29.         SystemPathInformation,
    
30.         SystemProcessInformation,
    
31.         SystemCallCountInformation,
    
32.         SystemDeviceInformation,
    
33.         SystemProcessorPerformanceInformation,
    
34.         SystemFlagsInformation,
    
35.         SystemCallTimeInformation,
    
36.         SystemModuleInformation,
    
37.         SystemLocksInformation,
    
38.         SystemStackTraceInformation,
    
39.         SystemPagedPoolInformation,
    
40.         SystemNonPagedPoolInformation,
    
41.         SystemHandleInformation,
    
42.         SystemObjectInformation,
    
43.         SystemPageFileInformation,
    
44.         SystemVdmInstemulInformation,
    
45.         SystemVdmBopInformation,
    
46.         SystemFileCacheInformation,
    
47.         SystemPoolTagInformation,
    
48.         SystemInterruptInformation,
    
49.         SystemDpcBehaviorInformation,
    
50.         SystemFullMemoryInformation,
    
51.         SystemLoadGdiDriverInformation,
    
52.         SystemUnloadGdiDriverInformation,
    
53.         SystemTimeAdjustmentInformation,
    
54.         SystemSummaryMemoryInformation,
    
55.         SystemMirrorMemoryInformation,
    
56.         SystemPerformanceTraceInformation,
    
57.         SystemObsolete0,
    
58.         SystemExceptionInformation,
    
59.         SystemCrashDumpStateInformation,
    
60.         SystemKernelDebuggerInformation,
    
61.         SystemContextSwitchInformation,
    
62.         SystemRegistryQuotaInformation,
    
63.         SystemExtendServiceTableInformation,
    
64.         SystemPrioritySeperation,
    
65.         SystemVerifierAddDriverInformation,
    
66.         SystemVerifierRemoveDriverInformation,
    
67.         SystemProcessorIdleInformation,
    
68.         SystemLegacyDriverInformation,
    
69.         SystemCurrentTimeZoneInformation,
    
70.         SystemLookasideInformation,
    
71.         SystemTimeSlipNotification,
    
72.         SystemSessionCreate,
    
73.         SystemSessionDetach,
    
74.         SystemSessionInformation,
    
75.         SystemRangeStartInformation,
    
76.         SystemVerifierInformation,
    
77.         SystemVerifierThunkExtend,
    
78.         SystemSessionProcessInformation,
    
79.         SystemLoadGdiDriverInSystemSpace,
    
80.         SystemNumaProcessorMap,
    
81.         SystemPrefetcherInformation,
    
82.         SystemExtendedProcessInformation,
    
83.         SystemRecommendedSharedDataAlignment,
    
84.         SystemComPlusPackage,
    
85.         SystemNumaAvailableMemory,
    
86.         SystemProcessorPowerInformation,
    
87.         SystemEmulationBasicInformation,
    
88.         SystemEmulationProcessorInformation,
    
89.         SystemExtendedHandleInformation,
    
90.         SystemLostDelayedWriteInformation,
    
91.         SystemBigPoolInformation,
    
92.         SystemSessionPoolTagInformation,
    
93.         SystemSessionMappedViewInformation,
    
94.         SystemHotpatchInformation,
    
95.         SystemObjectSecurityMode,
    
96.         SystemWatchdogTimerHandler,
    
97.         SystemWatchdogTimerInformation,
    
98.         SystemLogicalProcessorInformation,
    
99.         SystemWow64SharedInformation,
    
100.         SystemRegisterFirmwareTableInformationHandler,
     
101.         SystemFirmwareTableInformation,
     
102.         SystemModuleInformationEx,
     
103.         SystemVerifierTriageInformation,
     
104.         SystemSuperfetchInformation,
     
105.         SystemMemoryListInformation,
     
106.         SystemFileCacheInformationEx,
     
107.         MaxSystemInfoClass  // MaxSystemInfoClass should always be the last enum
     
108. } SYSTEM_INFORMATION_CLASS;
     
109. 
     
110. 
     
111. EXTERN_C NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation (
     
112.                                                   __in SYSTEM_INFORMATION_CLASS SystemInformationClass,
     
113.                                                   __out_bcount_opt(SystemInformationLength) PVOID SystemInformation,
     
114.                                                   __in ULONG SystemInformationLength,
     
115.                                                   __out_opt PULONG ReturnLength
     
116.                                                   );
     
117. 
     
118. 
     
119. typedef struct _RTL_PROCESS_MODULE_INFORMATION {
     
120.         HANDLE Section;                 // Not filled in
     
121.         PVOID MappedBase;
     
122.         PVOID ImageBase;
     
123.         ULONG ImageSize;
     
124.         ULONG Flags;
     
125.         USHORT LoadOrderIndex;
     
126.         USHORT InitOrderIndex;
     
127.         USHORT LoadCount;
     
128.         USHORT OffsetToFileName;
     
129.         UCHAR  FullPathName[256];
     
130. } RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
     
131. 
     
132. typedef struct _RTL_PROCESS_MODULES {
     
133.         ULONG NumberOfModules;
     
134.         RTL_PROCESS_MODULE_INFORMATION Modules[1];
     
135. } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

复制代码

Driver.cpp

1. #include "Driver.h"
   
2. 
   
3. 
   
4. VOID EnumSysImageBase()
   
5. {
   
6.         ULONG uSize = 0x10000;
   
7.         PVOID pMoudleInfo = ExAllocatePool(NonPagedPool, uSize);
   
8.         if (pMoudleInfo == NULL)
   
9.         {
   
10.                 return;
    
11.         }
    
12. 
    
13.         NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, pMoudleInfo, uSize, NULL);
    
14. 
    
15.         if (!NT_SUCCESS(status))
    
16.         {
    
17.                 ExFreePool(pMoudleInfo);
    
18.                 return;
    
19.         }
    
20. 
    
21.         ULONG uNumberOfModules = *(PULONG)pMoudleInfo;
    
22.         if (uNumberOfModules == 0)
    
23.         {
    
24.                 ExFreePool(pMoudleInfo);
    
25.                 return;
    
26.         }
    
27. 
    
28.         PRTL_PROCESS_MODULE_INFORMATION pStart = (PRTL_PROCESS_MODULE_INFORMATION)((ULONG)pMoudleInfo + sizeof(ULONG));
    
29. 
    
30.         for (ULONG i = 0; i < uNumberOfModules; i++)
    
31.         {
    
32.                 PUCHAR pszFullName = pStart->FullPathName;
    
33.                 ULONG uOffsetName = pStart->OffsetToFileName;
    
34.                 PUCHAR pszSysName = pszFullName + uOffsetName;
    
35. 
    
36.                 ULONG uImageBase = (ULONG)pStart->ImageBase;
    
37. 
    
38.                 KdPrint(("pszSysName:%s---uImageBase:%X\n", pszSysName, uImageBase));
    
39. 
    
40.                 pStart++;
    
41.         }
    
42. 
    
43.         if (pMoudleInfo != NULL)
    
44.         {
    
45.                 ExFreePool(pMoudleInfo);
    
46.         }
    
47. 
    
48.         return;
    
49. }
    
50. 
    
51. 
    
52. ULONG GetSysImageBase(PCHAR pszSysName)
    
53. {
    
54.         ULONG uImageBase = 0;
    
55. 
    
56.         ULONG uSize = 0x10000;
    
57.         PVOID pMoudleInfo = ExAllocatePool(NonPagedPool, uSize);
    
58.         if (pMoudleInfo == NULL)
    
59.         {
    
60.                 return 0;
    
61.         }
    
62. 
    
63.         NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, pMoudleInfo, uSize, NULL);
    
64. 
    
65.         if (!NT_SUCCESS(status))
    
66.         {
    
67.                 ExFreePool(pMoudleInfo);
    
68.                 return 0;
    
69.         }
    
70. 
    
71.         ULONG uNumberOfModules = *(PULONG)pMoudleInfo;
    
72.         if (uNumberOfModules == 0)
    
73.         {
    
74.                 ExFreePool(pMoudleInfo);
    
75.                 return 0;
    
76.         }
    
77. 
    
78.         PRTL_PROCESS_MODULE_INFORMATION pStart = (PRTL_PROCESS_MODULE_INFORMATION)((ULONG)pMoudleInfo + sizeof(ULONG));
    
79. 
    
80.         for (ULONG i = 0; i < uNumberOfModules; i++)
    
81.         {
    
82.                 PUCHAR pszFullName = pStart->FullPathName;
    
83.                 ULONG uOffsetName = pStart->OffsetToFileName;
    
84.                 PUCHAR pszFileName = pszFullName + uOffsetName;
    
85. 
    
86.                 if (_stricmp((const char *)pszFileName, (const char *)pszSysName) == 0)
    
87.                 {
    
88.                         uImageBase = (ULONG)pStart->ImageBase;
    
89.                         break;
    
90.                 }
    
91. 
    
92.                 pStart++;
    
93.         }
    
94. 
    
95.         if (pMoudleInfo != NULL)
    
96.         {
    
97.                 ExFreePool(pMoudleInfo);
    
98.         }
    
99. 
    
100.         return uImageBase;
     
101. }
     
102. 
     
103. #pragma INITCODE
     
104. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
     
105. {
     
106.     NTSTATUS status = STATUS_SUCCESS;
     
107. 
     
108.         EnumSysImageBase();
     
109. 
     
110.         ULONG uImageBase = GetSysImageBase("ntoskrnl.exe");
     
111.         KdPrint(("ntoskrnl.exe:%X\n", uImageBase));
     
112. 
     
113.     DriverObject->DriverUnload = DriverUnload;
     
114.     return status;
     
115. }
     
116. 
     
117. #pragma PAGEDCODE
     
118. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
     
119. {
     
120.   
     
121.     KdPrint(("DriverEntry unLoading...\n"));
     
122.   
     
123. }

复制代码