编程技术- 驱动开发：Win10枚举完整SSDT地址表
推荐 原创在前面的博文《驱动开发：Win10内核枚举SSDT表基址》中已经教大家如何寻找SSDT表基地址了，找到后我们可根据序号获取到指定SSDT函数的原始地址，而如果需要输出所有SSDT表信息，则可以定义字符串列表，以此循环调用GetSSDTFunctionAddress()函数得到，当然在此之间也可以调用系统提供的MmGetSystemRoutineAddress()函数顺便把当前地址拿到，并通过循环方式得到完整的SSDT列表。
调用MmGetSystemRoutineAddress()得到当前地址很容易实现，只需要将函数名字符串通过RtlInitUnicodeString()格式化一下即可。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
VOID UnDriver(PDRIVER_OBJECT driver)
{
DbgPrint((
"驱动程序卸载成功! \n"
));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
DbgPrint(
"hello lyshark.com \n"
);
/
/
获取SSDT起源地址
UNICODE_STRING uncode;
RtlInitUnicodeString(&uncode, L
"NtOpenFile"
);
PULONGLONG source_address
=
MmGetSystemRoutineAddress(&uncode);
DbgPrint(
"[LyShark] NtOpenFile起源地址 = %p \n"
, source_address);
DriverObject
-
>DriverUnload
=
UnDriver;
return
STATUS_SUCCESS;
}
|
代码获得NtOpenFile这个函数的内存地址，输出效果如下所示：
根据上一章节的内容扩展，枚举完整SSDT表我们可以这样来实现。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
#pragma intrinsic(__readmsr)
typedef struct _SYSTEM_SERVICE_TABLE
{
PVOID ServiceTableBase;
PVOID ServiceCounterTableBase;
ULONGLONG NumberOfServices;
PVOID ParamTableBase;
} SYSTEM_SERVICE_TABLE,
*
PSYSTEM_SERVICE_TABLE;
ULONGLONG ssdt_base_aadress;
PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable;
typedef UINT64(__fastcall
*
SCFN)(UINT64, UINT64);
SCFN scfn;
/
/
解密算法
VOID DecodeSSDT()
{
UCHAR strShellCode[
36
]
=
"\x48\x8B\xC1\x4C\x8D\x12\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x4E\x8B\x14\x17\x4D\x63\x1C\x82\x49\x8B\xC3\x49\xC1\xFB\x04\x4D\x03\xD3\x49\x8B\xC2\xC3"
;
/
*
48
:
8BC1
| mov rax,rcx | rcx
=
index
4C
:
8D12
| lea r10,qword ptr ds:[rdx] | rdx
=
ssdt
8BF8
| mov edi,eax |
C1EF
07
| shr edi,
7
|
83E7
20
|
and
edi,
20
|
4E
:
8B1417
| mov r10,qword ptr ds:[rdi
+
r10] |
4D
:
631C82
| movsxd r11,dword ptr ds:[r10
+
rax
*
4
] |
49
:
8BC3
| mov rax,r11 |
49
:C1FB
04
| sar r11,
4
|
4D
:
03D3
| add r10,r11 |
49
:
8BC2
| mov rax,r10 |
C3 | ret |
*
/
scfn
=
ExAllocatePool(NonPagedPool,
36
);
memcpy(scfn, strShellCode,
36
);
}
/
/
获取 KeServiceDescriptorTable 首地址
ULONGLONG GetKeServiceDescriptorTable()
{
/
/
设置起始位置
PUCHAR StartSearchAddress
=
(PUCHAR)__readmsr(
0xC0000082
)
-
0x1806FE
;
/
/
设置结束位置
PUCHAR EndSearchAddress
=
StartSearchAddress
+
0x8192
;
/
/
DbgPrint(
"扫描起始地址: %p --> 扫描结束地址: %p \n"
, StartSearchAddress, EndSearchAddress);
PUCHAR ByteCode
=
NULL;
UCHAR OpCodeA
=
0
, OpCodeB
=
0
, OpCodeC
=
0
;
ULONGLONG addr
=
0
;
ULONG templong
=
0
;
for
(ByteCode
=
StartSearchAddress; ByteCode < EndSearchAddress; ByteCode
+
+
)
{
/
/
使用MmIsAddressValid()函数检查地址是否有页面错误
if
(MmIsAddressValid(ByteCode) && MmIsAddressValid(ByteCode
+
1
) && MmIsAddressValid(ByteCode
+
2
))
{
OpCodeA
=
*
ByteCode;
OpCodeB
=
*
(ByteCode
+
1
);
OpCodeC
=
*
(ByteCode
+
2
);
/
/
对比特征值 寻找 nt!KeServiceDescriptorTable 函数地址
/
/
LyShark.com
/
/
4c
8d
15
e5
9e
3b
00
lea r10,[nt!KeServiceDescriptorTable (fffff802`
64da4880
)]
/
/
4c
8d
1d
de
20
3a
00
lea r11,[nt!KeServiceDescriptorTableShadow (fffff802`
64d8ca80
)]
if
(OpCodeA
=
=
0x4c
&& OpCodeB
=
=
0x8d
&& OpCodeC
=
=
0x15
)
{
/
/
获取高位地址fffff802
memcpy(&templong, ByteCode
+
3
,
4
);
/
/
与低位
64da4880
地址相加得到完整地址
addr
=
(ULONGLONG)templong
+
(ULONGLONG)ByteCode
+
7
;
return
addr;
}
}
}
return
0
;
}
/
/
得到函数相对偏移地址
ULONG GetOffsetAddress(ULONGLONG FuncAddr)
{
ULONG dwtmp
=
0
;
PULONG ServiceTableBase
=
NULL;
if
(KeServiceDescriptorTable
=
=
NULL)
{
KeServiceDescriptorTable
=
(PSYSTEM_SERVICE_TABLE)GetKeServiceDescriptorTable();
}
ServiceTableBase
=
(PULONG)KeServiceDescriptorTable
-
>ServiceTableBase;
dwtmp
=
(ULONG)(FuncAddr
-
(ULONGLONG)ServiceTableBase);
return
dwtmp <<
4
;
}
/
/
根据序号得到函数地址
ULONGLONG GetSSDTFunctionAddress(ULONGLONG NtApiIndex)
{
ULONGLONG ret
=
0
;
if
(ssdt_base_aadress
=
=
0
)
{
/
/
得到ssdt基地址
ssdt_base_aadress
=
GetKeServiceDescriptorTable();
}
if
(scfn
=
=
NULL)
{
DecodeSSDT();
}
ret
=
scfn(NtApiIndex, ssdt_base_aadress);
return
ret;
}
/
/
查询函数系统地址
ULONG_PTR QueryFunctionSystemAddress(PWCHAR name)
{
UNICODE_STRING na;
ULONG_PTR address;
RtlInitUnicodeString(&na, name);
address
=
(ULONG_PTR)MmGetSystemRoutineAddress(&na);
return
address;
}
VOID UnDriver(PDRIVER_OBJECT driver)
{
DbgPrint((
"驱动程序卸载成功! \n"
));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
DbgPrint(
"hello lyshark.com \n"
);
char
*
SSDT[
464
]
=
{
"NtAccessCheck"
,
"NtWorkerFactoryWorkerReady"
,
"NtAcceptConnectPort"
,
"NtMapUserPhysicalPagesScatter"
,
"NtWaitForSingleObject"
,
"NtCallbackReturn"
,
"NtReadFile"
,
"NtDeviceIoControlFile"
,
"NtWriteFile"
,
"NtRemoveIoCompletion"
,
"NtReleaseSemaphore"
,
"NtReplyWaitReceivePort"
,
"NtReplyPort"
,
"NtSetInformationThread"
,
"NtSetEvent"
,
"NtClose"
,
"NtQueryObject"
,
"NtQueryInformationFile"
,
"NtOpenKey"
,
"NtEnumerateValueKey"
,
"NtFindAtom"
,
"NtQueryDefaultLocale"
,
"NtQueryKey"
,
"NtQueryValueKey"
,
"NtAllocateVirtualMemory"
,
"NtQueryInformationProcess"
,
"NtWaitForMultipleObjects32"
,
"NtWriteFileGather"
,
"NtSetInformationProcess"
,
"NtCreateKey"
,
"NtFreeVirtualMemory"
,
"NtImpersonateClientOfPort"
,
"NtReleaseMutant"
,
"NtQueryInformationToken"
,
"NtRequestWaitReplyPort"
,
"NtQueryVirtualMemory"
,
"NtOpenThreadToken"
,
"NtQueryInformationThread"
,
"NtOpenProcess"
,
"NtSetInformationFile"
,
"NtMapViewOfSection"
,
"NtAccessCheckAndAuditAlarm"
,
"NtUnmapViewOfSection"
,
"NtReplyWaitReceivePortEx"
,
"NtTerminateProcess"
,
"NtSetEventBoostPriority"
,
"NtReadFileScatter"
,
"NtOpenThreadTokenEx"
,
"NtOpenProcessTokenEx"
,
"NtQueryPerformanceCounter"
,
"NtEnumerateKey"
,
"NtOpenFile"
,
"NtDelayExecution"
,
"NtQueryDirectoryFile"
,
"NtQuerySystemInformation"
,
"NtOpenSection"
,
"NtQueryTimer"
,
"NtFsControlFile"
,
"NtWriteVirtualMemory"
,
"NtCloseObjectAuditAlarm"
,
"NtDuplicateObject"
,
"NtQueryAttributesFile"
,
"NtClearEvent"
,
"NtReadVirtualMemory"
,
"NtOpenEvent"
,
"NtAdjustPrivilegesToken"
,
"NtDuplicateToken"
,
"NtContinue"
,
"NtQueryDefaultUILanguage"
,
"NtQueueApcThread"
,
"NtYieldExecution"
,
"NtAddAtom"
,
"NtCreateEvent"
,
"NtQueryVolumeInformationFile"
,
"NtCreateSection"
,
"NtFlushBuffersFile"
,
"NtApphelpCacheControl"
,
"NtCreateProcessEx"
,
"NtCreateThread"
,
"NtIsProcessInJob"
,
"NtProtectVirtualMemory"
,
"NtQuerySection"
,
"NtResumeThread"
,
"NtTerminateThread"
,
"NtReadRequestData"
,
"NtCreateFile"
,
"NtQueryEvent"
,
"NtWriteRequestData"
,
"NtOpenDirectoryObject"
,
"NtAccessCheckByTypeAndAuditAlarm"
,
"NtQuerySystemTime"
,
"NtWaitForMultipleObjects"
,
"NtSetInformationObject"
,
"NtCancelIoFile"
,
"NtTraceEvent"
,
"NtPowerInformation"
,
"NtSetValueKey"
,
"NtCancelTimer"
,
"NtSetTimer"
,
"NtAccessCheckByType"
,
"NtAccessCheckByTypeResultList"
,
"NtAccessCheckByTypeResultListAndAuditAlarm"
,
"NtAccessCheckByTypeResultListAndAuditAlarmByHandle"
,
"NtAcquireProcessActivityReference"
,
"NtAddAtomEx"
,
"NtAddBootEntry"
,
"NtAddDriverEntry"
,
"NtAdjustGroupsToken"
,
"NtAdjustTokenClaimsAndDeviceGroups"
,
"NtAlertResumeThread"
,
"NtAlertThread"
,
"NtAlertThreadByThreadId"
,
"NtAllocateLocallyUniqueId"
,
"NtAllocateReserveObject"
,
"NtAllocateUserPhysicalPages"
,
"NtAllocateUuids"
,
"NtAllocateVirtualMemoryEx"
,
"NtAlpcAcceptConnectPort"
,
"NtAlpcCancelMessage"
,
"NtAlpcConnectPort"
,
"NtAlpcConnectPortEx"
,
"NtAlpcCreatePort"
,
"NtAlpcCreatePortSection"
,
"NtAlpcCreateResourceReserve"
,
"NtAlpcCreateSectionView"
,
"NtAlpcCreateSecurityContext"
,
"NtAlpcDeletePortSection"
,
"NtAlpcDeleteResourceReserve"
,
"NtAlpcDeleteSectionView"
,
"NtAlpcDeleteSecurityContext"
,
"NtAlpcDisconnectPort"
,
"NtAlpcImpersonateClientContainerOfPort"
,
"NtAlpcImpersonateClientOfPort"
,
"NtAlpcOpenSenderProcess"
,
"NtAlpcOpenSenderThread"
,
"NtAlpcQueryInformation"
,
"NtAlpcQueryInformationMessage"
,
"NtAlpcRevokeSecurityContext"
,
"NtAlpcSendWaitReceivePort"
,
"NtAlpcSetInformation"
,
"NtAreMappedFilesTheSame"
,
"NtAssignProcessToJobObject"
,
"NtAssociateWaitCompletionPacket"
,
"NtCallEnclave"
,
"NtCancelIoFileEx"
,
"NtCancelSynchronousIoFile"
,
"NtCancelTimer2"
,
"NtCancelWaitCompletionPacket"
,
"NtCommitComplete"
,
"NtCommitEnlistment"
,
"NtCommitRegistryTransaction"
,
"NtCommitTransaction"
,
"NtCompactKeys"
,
"NtCompareObjects"
,
"NtCompareSigningLevels"
,
"NtCompareTokens"
,
"ArbPreprocessEntry"
,
"NtCompressKey"
,
"NtConnectPort"
,
"NtConvertBetweenAuxiliaryCounterAndPerformanceCounter"
,
"ArbAddReserved"
,
"NtCreateDebugObject"
,
"NtCreateDirectoryObject"
,
"NtCreateDirectoryObjectEx"
,
"NtCreateEnclave"
,
"NtCreateEnlistment"
,
"NtCreateEventPair"
,
"NtCreateIRTimer"
,
"NtCreateIoCompletion"
,
"NtCreateJobObject"
,
"ArbAddReserved"
,
"NtCreateKeyTransacted"
,
"NtCreateKeyedEvent"
,
"NtCreateLowBoxToken"
,
"NtCreateMailslotFile"
,
"NtCreateMutant"
,
"NtCreateNamedPipeFile"
,
"NtCreatePagingFile"
,
"NtCreatePartition"
,
"NtCreatePort"
,
"NtCreatePrivateNamespace"
,
"NtCreateProcess"
,
"NtCreateProfile"
,
"NtCreateProfileEx"
,
"NtCreateRegistryTransaction"
,
"NtCreateResourceManager"
,
"NtCreateSectionEx"
,
"NtCreateSemaphore"
,
"NtCreateSymbolicLinkObject"
,
"NtCreateThreadEx"
,
"NtCreateTimer"
,
"NtCreateTimer2"
,
"NtCreateToken"
,
"NtCreateTokenEx"
,
"NtCreateTransaction"
,
"NtCreateTransactionManager"
,
"NtCreateUserProcess"
,
"NtCreateWaitCompletionPacket"
,
"NtCreateWaitablePort"
,
"NtCreateWnfStateName"
,
"NtCreateWorkerFactory"
,
"NtDebugActiveProcess"
,
"NtDebugContinue"
,
"NtDeleteAtom"
,
"NtDeleteBootEntry"
,
"NtDeleteDriverEntry"
,
"NtDeleteFile"
,
"NtDeleteKey"
,
"NtDeleteObjectAuditAlarm"
,
"NtDeletePrivateNamespace"
,
"NtDeleteValueKey"
,
"NtDeleteWnfStateData"
,
"NtDeleteWnfStateName"
,
"NtDisableLastKnownGood"
,
"NtDisplayString"
,
"NtDrawText"
,
"NtEnableLastKnownGood"
,
"NtEnumerateBootEntries"
,
"NtEnumerateDriverEntries"
,
"NtEnumerateSystemEnvironmentValuesEx"
,
"NtEnumerateTransactionObject"
,
"NtExtendSection"
,
"NtFilterBootOption"
,
"NtFilterToken"
,
"NtFilterTokenEx"
,
"NtFlushBuffersFileEx"
,
"NtFlushInstallUILanguage"
,
"ArbPreprocessEntry"
,
"NtFlushKey"
,
"NtFlushProcessWriteBuffers"
,
"NtFlushVirtualMemory"
,
"NtFlushWriteBuffer"
,
"NtFreeUserPhysicalPages"
,
"NtFreezeRegistry"
,
"NtFreezeTransactions"
,
"NtGetCachedSigningLevel"
,
"NtGetCompleteWnfStateSubscription"
,
"NtGetContextThread"
,
"NtGetCurrentProcessorNumber"
,
"NtGetCurrentProcessorNumberEx"
,
"NtGetDevicePowerState"
,
"NtGetMUIRegistryInfo"
,
"NtGetNextProcess"
,
"NtGetNextThread"
,
"NtGetNlsSectionPtr"
,
"NtGetNotificationResourceManager"
,
"NtGetWriteWatch"
,
"NtImpersonateAnonymousToken"
,
"NtImpersonateThread"
,
"NtInitializeEnclave"
,
"NtInitializeNlsFiles"
,
"NtInitializeRegistry"
,
"NtInitiatePowerAction"
,
"NtIsSystemResumeAutomatic"
,
"NtIsUILanguageComitted"
,
"NtListenPort"
,
"NtLoadDriver"
,
"NtLoadEnclaveData"
,
"NtLoadKey"
,
"NtLoadKey2"
,
"NtLoadKeyEx"
,
"NtLockFile"
,
"NtLockProductActivationKeys"
,
"NtLockRegistryKey"
,
"NtLockVirtualMemory"
,
"NtMakePermanentObject"
,
"NtMakeTemporaryObject"
,
"NtManageHotPatch"
,
"NtManagePartition"
,
"NtMapCMFModule"
,
"NtMapUserPhysicalPages"
,
"NtMapViewOfSectionEx"
,
"NtModifyBootEntry"
,
"NtModifyDriverEntry"
,
"NtNotifyChangeDirectoryFile"
,
"NtNotifyChangeDirectoryFileEx"
,
"NtNotifyChangeKey"
,
"NtNotifyChangeMultipleKeys"
,
"NtNotifyChangeSession"
,
"NtOpenEnlistment"
,
"NtOpenEventPair"
,
"NtOpenIoCompletion"
,
"NtOpenJobObject"
,
"NtOpenKeyEx"
,
"NtOpenKeyTransacted"
,
"NtOpenKeyTransactedEx"
,
"NtOpenKeyedEvent"
,
"NtOpenMutant"
,
"NtOpenObjectAuditAlarm"
,
"NtOpenPartition"
,
"NtOpenPrivateNamespace"
,
"NtOpenProcessToken"
,
"NtOpenRegistryTransaction"
,
"NtOpenResourceManager"
,
"NtOpenSemaphore"
,
"NtOpenSession"
,
"NtOpenSymbolicLinkObject"
,
"NtOpenThread"
,
"NtOpenTimer"
,
"NtOpenTransaction"
,
"NtOpenTransactionManager"
,
"NtPlugPlayControl"
,
"NtPrePrepareComplete"
,
"NtPrePrepareEnlistment"
,
"NtPrepareComplete"
,
"NtPrepareEnlistment"
,
"NtPrivilegeCheck"
,
"NtPrivilegeObjectAuditAlarm"
,
"NtPrivilegedServiceAuditAlarm"
,
"NtPropagationComplete"
,
"NtPropagationFailed"
,
"NtPulseEvent"
,
"NtQueryAuxiliaryCounterFrequency"
,
"NtQueryBootEntryOrder"
,
"NtQueryBootOptions"
,
"NtQueryDebugFilterState"
,
"NtQueryDirectoryFileEx"
,
"NtQueryDirectoryObject"
,
"NtQueryDriverEntryOrder"
,
"NtQueryEaFile"
,
"NtQueryFullAttributesFile"
,
"NtQueryInformationAtom"
,
"NtQueryInformationByName"
,
"NtQueryInformationEnlistment"
,
"NtQueryInformationJobObject"
,
"NtQueryInformationPort"
,
"NtQueryInformationResourceManager"
,
"NtQueryInformationTransaction"
,
"NtQueryInformationTransactionManager"
,
"NtQueryInformationWorkerFactory"
,
"NtQueryInstallUILanguage"
,
"NtQueryIntervalProfile"
,
"NtQueryIoCompletion"
,
"NtQueryLicenseValue"
,
"NtQueryMultipleValueKey"
,
"NtQueryMutant"
,
"NtQueryOpenSubKeys"
,
"NtQueryOpenSubKeysEx"
,
"CmpCleanUpHigherLayerKcbCachesPreCallback"
,
"NtQueryQuotaInformationFile"
,
"NtQuerySecurityAttributesToken"
,
"NtQuerySecurityObject"
,
"NtQuerySecurityPolicy"
,
"NtQuerySemaphore"
,
"NtQuerySymbolicLinkObject"
,
"NtQuerySystemEnvironmentValue"
,
"NtQuerySystemEnvironmentValueEx"
,
"NtQuerySystemInformationEx"
,
"NtQueryTimerResolution"
,
"NtQueryWnfStateData"
,
"NtQueryWnfStateNameInformation"
,
"NtQueueApcThreadEx"
,
"NtRaiseException"
,
"NtRaiseHardError"
,
"NtReadOnlyEnlistment"
,
"NtRecoverEnlistment"
,
"NtRecoverResourceManager"
,
"NtRecoverTransactionManager"
,
"NtRegisterProtocolAddressInformation"
,
"NtRegisterThreadTerminatePort"
,
"NtReleaseKeyedEvent"
,
"NtReleaseWorkerFactoryWorker"
,
"NtRemoveIoCompletionEx"
,
"NtRemoveProcessDebug"
,
"NtRenameKey"
,
"NtRenameTransactionManager"
,
"NtReplaceKey"
,
"NtReplacePartitionUnit"
,
"NtReplyWaitReplyPort"
,
"NtRequestPort"
,
"NtResetEvent"
,
"NtResetWriteWatch"
,
"NtRestoreKey"
,
"NtResumeProcess"
,
"NtRevertContainerImpersonation"
,
"NtRollbackComplete"
,
"NtRollbackEnlistment"
,
"NtRollbackRegistryTransaction"
,
"NtRollbackTransaction"
,
"NtRollforwardTransactionManager"
,
"NtSaveKey"
,
"NtSaveKeyEx"
,
"NtSaveMergedKeys"
,
"NtSecureConnectPort"
,
"NtSerializeBoot"
,
"NtSetBootEntryOrder"
,
"NtSetBootOptions"
,
"NtSetCachedSigningLevel"
,
"NtSetCachedSigningLevel2"
,
"NtSetContextThread"
,
"NtSetDebugFilterState"
,
"NtSetDefaultHardErrorPort"
,
"NtSetDefaultLocale"
,
"NtSetDefaultUILanguage"
,
"NtSetDriverEntryOrder"
,
"NtSetEaFile"
,
"NtSetHighEventPair"
,
"NtSetHighWaitLowEventPair"
,
"NtSetIRTimer"
,
"NtSetInformationDebugObject"
,
"NtSetInformationEnlistment"
,
"NtSetInformationJobObject"
,
"NtSetInformationKey"
,
"NtSetInformationResourceManager"
,
"NtSetInformationSymbolicLink"
,
"NtSetInformationToken"
,
"NtSetInformationTransaction"
,
"NtSetInformationTransactionManager"
,
"NtSetInformationVirtualMemory"
,
"NtSetInformationWorkerFactory"
,
"NtSetIntervalProfile"
,
"NtSetIoCompletion"
,
"NtSetIoCompletionEx"
,
"BvgaSetVirtualFrameBuffer"
,
"NtSetLowEventPair"
,
"NtSetLowWaitHighEventPair"
,
"NtSetQuotaInformationFile"
,
"NtSetSecurityObject"
,
"NtSetSystemEnvironmentValue"
,
"NtSetSystemEnvironmentValueEx"
,
"NtSetSystemInformation"
,
"NtSetSystemPowerState"
,
"NtSetSystemTime"
,
"NtSetThreadExecutionState"
,
"NtSetTimer2"
,
"NtSetTimerEx"
,
"NtSetTimerResolution"
,
"NtSetUuidSeed"
,
"NtSetVolumeInformationFile"
,
"NtSetWnfProcessNotificationEvent"
,
"NtShutdownSystem"
,
"NtShutdownWorkerFactory"
,
"NtSignalAndWaitForSingleObject"
,
"NtSinglePhaseReject"
,
"NtStartProfile"
,
"NtStopProfile"
,
"NtSubscribeWnfStateChange"
,
"NtSuspendProcess"
,
"NtSuspendThread"
,
"NtSystemDebugControl"
,
"NtTerminateEnclave"
,
"NtTerminateJobObject"
,
"NtTestAlert"
,
"NtThawRegistry"
,
"NtThawTransactions"
,
"NtTraceControl"
,
"NtTranslateFilePath"
,
"NtUmsThreadYield"
,
"NtUnloadDriver"
,
"NtUnloadKey"
,
"NtUnloadKey2"
,
"NtUnloadKeyEx"
,
"NtUnlockFile"
,
"NtUnlockVirtualMemory"
,
"NtUnmapViewOfSectionEx"
,
"NtUnsubscribeWnfStateChange"
,
"NtUpdateWnfStateData"
,
"NtVdmControl"
,
"NtWaitForAlertByThreadId"
,
"NtWaitForDebugEvent"
,
"NtWaitForKeyedEvent"
,
"NtWaitForWorkViaWorkerFactory"
,
"NtWaitHighEventPair"
,
"NtWaitLowEventPair"
};
for
(size_t lyshark
=
0
; lyshark <
464
; lyshark
+
+
)
{
/
/
获取起源地址
ANSI_STRING ansi
=
{
0
};
UNICODE_STRING uncode
=
{
0
};
ULONGLONG ssdt_address
=
GetKeServiceDescriptorTable();
/
/
DbgPrint(
"SSDT基地址 = %p \n"
, ssdt_address);
/
/
根据序号得到函数地址
ULONGLONG address
=
GetSSDTFunctionAddress(lyshark);
ULONG offset
=
GetOffsetAddress(address);
RtlInitAnsiString(&ansi, SSDT[lyshark]);
RtlAnsiStringToUnicodeString(&uncode, &ansi, TRUE);
PULONGLONG source_address
=
MmGetSystemRoutineAddress(&uncode);
DbgPrint(
"[LyShark] 序号 => [%d] | 当前地址 => %p | 起源地址 => %p | 相对地址 => %p | SSDT => %s \n"
, lyshark, address, source_address, offset, SSDT[lyshark]);
}
DriverObject
-
>DriverUnload
=
UnDriver;
return
STATUS_SUCCESS;
}
|
我们运行这段程序，即可得到整个系统中所有的SSDT表地址信息；
在WinDBG中可看到完整的输出内容，当然有些函数没有被导出，起源地址是拿不到的。
更多【 驱动开发：Win10枚举完整SSDT地址表】相关视频教程：www.yxfzedu.com
相关文章推荐
- Android安全- 60秒学会用eBPF-BCC hook系统调用 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 编程技术-驱动保护-EAC内核调试检测分析 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- Android安全-Android 系统源码下载编译刷机 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- Android安全-编译frida16.0.2 python 模块 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 软件逆向-DASCTF X GFCTF 2022十月挑战赛 cuteRE WriteUp - 游戏逆向 游戏开发 编程技术 加壳脱壳
- Android安全-攻防世界Mobile通关记录_apk逆向12_RememberOther_Ph0en1x-100_ill-intentions_wp - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 编程技术- 驱动开发：内核运用LoadImage屏蔽驱动 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 软件逆向-wibu证书 - 安全证书（一） - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 二进制漏洞-CVE-2018-17463详细分析及复现 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- CTF对抗-2022秋季赛题目提交 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- Android安全-某当网apk加固脱个so - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 软件逆向-360ini.dll注入explorer技术分析 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 二进制漏洞-CVE-2022-23613复现与漏洞利用可能性尝试 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 编程技术-过EAC HV检测 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 智能设备-Qiling框架模拟运行固件配合IDA动态调试 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 编程技术- 驱动开发：内核枚举进程与线程ObCall回调 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 编程技术-AVL/红黑树 C++ 递归实现/非递归实现 源码+视频教程 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- Android安全-Frida编译2022 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 软件逆向-Windows 下的逆向分析-实战1 - 游戏逆向 游戏开发 编程技术 加壳脱壳
- 二进制漏洞-libFuzzer使用总结教程 - 游戏逆向 游戏开发 编程技术 加壳脱壳
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多
- 科技-伊朗黑客对以色列科技和教育领域发起破坏性网络攻击
- 科技-SOLIDWORKS 2024新产品发布会暨SOLIDWORKS 创新日活动-硕迪科技
- 科技-擎创动态 | 开箱即用！擎创科技联合中科可控推出大模型一体机
- 科技-亚马逊云科技大语言模型下的六大创新应用功能
- 科技-【亚马逊云科技产品测评】活动征文｜亚马逊云科技AWS之EC2详细测评
- mysql-java八股文(mysql篇)
- 计算机视觉-计算机视觉与深度学习 | 基于视觉惯性紧耦合的SLAM后端优化算法
- c++-【C++】从入门到精通第三弹——友元函数与静态类成员
- spring boot-java 企业工程管理系统软件源码+Spring Cloud + Spring Boot +二次开发+ MybatisPlus + Redis
- 科技-企业财务数字化转型的机遇有哪些？_光点科技
