编程技术- 驱动开发：内核枚举进程与线程ObCall回调
推荐 原创在笔者上一篇文章《驱动开发：内核枚举Registry注册表回调》中我们通过特征码定位实现了对注册表回调的枚举，本篇文章LyShark将教大家如何枚举系统中的ProcessObCall进程回调以及ThreadObCall线程回调，之所以放在一起来讲解是因为这两中回调在枚举是都需要使用通用结构体_OB_CALLBACK以及_OBJECT_TYPE所以放在一起来讲解最好不过。
我们来看一款闭源ARK工具是如何实现的：
首先我们需要定义好结构体，结构体是微软公开的，如果有其它需要请自行去微软官方去查。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
typedef struct _OBJECT_TYPE_INITIALIZER
{
USHORT Length;
/
/
Uint2B
UCHAR ObjectTypeFlags;
/
/
UChar
ULONG ObjectTypeCode;
/
/
Uint4B
ULONG InvalidAttributes;
/
/
Uint4B
GENERIC_MAPPING GenericMapping;
/
/
_GENERIC_MAPPING
ULONG ValidAccessMask;
/
/
Uint4B
ULONG RetainAccess;
/
/
Uint4B
POOL_TYPE PoolType;
/
/
_POOL_TYPE
ULONG DefaultPagedPoolCharge;
/
/
Uint4B
ULONG DefaultNonPagedPoolCharge;
/
/
Uint4B
PVOID DumpProcedure;
/
/
Ptr64 void
PVOID OpenProcedure;
/
/
Ptr64
long
PVOID CloseProcedure;
/
/
Ptr64 void
PVOID DeleteProcedure;
/
/
Ptr64 void
PVOID ParseProcedure;
/
/
Ptr64
long
PVOID SecurityProcedure;
/
/
Ptr64
long
PVOID QueryNameProcedure;
/
/
Ptr64
long
PVOID OkayToCloseProcedure;
/
/
Ptr64 unsigned char
ULONG WaitObjectFlagMask;
/
/
Uint4B
USHORT WaitObjectFlagOffset;
/
/
Uint2B
USHORT WaitObjectPointerOffset;
/
/
Uint2B
}OBJECT_TYPE_INITIALIZER,
*
POBJECT_TYPE_INITIALIZER;
typedef struct _OBJECT_TYPE
{
LIST_ENTRY TypeList;
/
/
_LIST_ENTRY
UNICODE_STRING Name;
/
/
_UNICODE_STRING
PVOID DefaultObject;
/
/
Ptr64 Void
UCHAR Index;
/
/
UChar
ULONG TotalNumberOfObjects;
/
/
Uint4B
ULONG TotalNumberOfHandles;
/
/
Uint4B
ULONG HighWaterNumberOfObjects;
/
/
Uint4B
ULONG HighWaterNumberOfHandles;
/
/
Uint4B
OBJECT_TYPE_INITIALIZER TypeInfo;
/
/
_OBJECT_TYPE_INITIALIZER
EX_PUSH_LOCK TypeLock;
/
/
_EX_PUSH_LOCK
ULONG Key;
/
/
Uint4B
LIST_ENTRY CallbackList;
/
/
_LIST_ENTRY
}OBJECT_TYPE,
*
POBJECT_TYPE;
#pragma pack(1)
typedef struct _OB_CALLBACK
{
LIST_ENTRY ListEntry;
ULONGLONG Unknown;
HANDLE ObHandle;
PVOID ObTypeAddr;
PVOID PreCall;
PVOID PostCall;
}OB_CALLBACK,
*
POB_CALLBACK;
#pragma pack()
|
代码部分的实现很容易，由于进程与线程句柄的枚举很容易，直接通过(POBJECT_TYPE)(*PsProcessType))->CallbackList就可以拿到链表头结构，得到后将其解析为POB_CALLBACK并循环输出即可。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
#include <wdm.h>
#include <ntddk.h>
typedef struct _OBJECT_TYPE_INITIALIZER
{
USHORT Length;
/
/
Uint2B
UCHAR ObjectTypeFlags;
/
/
UChar
ULONG ObjectTypeCode;
/
/
Uint4B
ULONG InvalidAttributes;
/
/
Uint4B
GENERIC_MAPPING GenericMapping;
/
/
_GENERIC_MAPPING
ULONG ValidAccessMask;
/
/
Uint4B
ULONG RetainAccess;
/
/
Uint4B
POOL_TYPE PoolType;
/
/
_POOL_TYPE
ULONG DefaultPagedPoolCharge;
/
/
Uint4B
ULONG DefaultNonPagedPoolCharge;
/
/
Uint4B
PVOID DumpProcedure;
/
/
Ptr64 void
PVOID OpenProcedure;
/
/
Ptr64
long
PVOID CloseProcedure;
/
/
Ptr64 void
PVOID DeleteProcedure;
/
/
Ptr64 void
PVOID ParseProcedure;
/
/
Ptr64
long
PVOID SecurityProcedure;
/
/
Ptr64
long
PVOID QueryNameProcedure;
/
/
Ptr64
long
PVOID OkayToCloseProcedure;
/
/
Ptr64 unsigned char
ULONG WaitObjectFlagMask;
/
/
Uint4B
USHORT WaitObjectFlagOffset;
/
/
Uint2B
USHORT WaitObjectPointerOffset;
/
/
Uint2B
}OBJECT_TYPE_INITIALIZER,
*
POBJECT_TYPE_INITIALIZER;
typedef struct _OBJECT_TYPE
{
LIST_ENTRY TypeList;
/
/
_LIST_ENTRY
UNICODE_STRING Name;
/
/
_UNICODE_STRING
PVOID DefaultObject;
/
/
Ptr64 Void
UCHAR Index;
/
/
UChar
ULONG TotalNumberOfObjects;
/
/
Uint4B
ULONG TotalNumberOfHandles;
/
/
Uint4B
ULONG HighWaterNumberOfObjects;
/
/
Uint4B
ULONG HighWaterNumberOfHandles;
/
/
Uint4B
OBJECT_TYPE_INITIALIZER TypeInfo;
/
/
_OBJECT_TYPE_INITIALIZER
EX_PUSH_LOCK TypeLock;
/
/
_EX_PUSH_LOCK
ULONG Key;
/
/
Uint4B
LIST_ENTRY CallbackList;
/
/
_LIST_ENTRY
}OBJECT_TYPE,
*
POBJECT_TYPE;
#pragma pack(1)
typedef struct _OB_CALLBACK
{
LIST_ENTRY ListEntry;
ULONGLONG Unknown;
HANDLE ObHandle;
PVOID ObTypeAddr;
PVOID PreCall;
PVOID PostCall;
}OB_CALLBACK,
*
POB_CALLBACK;
#pragma pack()
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
NTSTATUS status
=
STATUS_SUCCESS;
DbgPrint(
"hello lyshark.com \n"
);
POB_CALLBACK pObCallback
=
NULL;
/
/
直接获取 CallbackList 链表
LIST_ENTRY CallbackList
=
((POBJECT_TYPE)(
*
PsProcessType))
-
>CallbackList;
/
/
开始遍历
pObCallback
=
(POB_CALLBACK)CallbackList.Flink;
do
{
if
(FALSE
=
=
MmIsAddressValid(pObCallback))
{
break
;
}
if
(NULL !
=
pObCallback
-
>ObHandle)
{
/
/
显示
DbgPrint(
"[LyShark.com] ObHandle = %p | PreCall = %p | PostCall = %p \n"
, pObCallback
-
>ObHandle, pObCallback
-
>PreCall, pObCallback
-
>PostCall);
}
/
/
获取下一链表信息
pObCallback
=
(POB_CALLBACK)pObCallback
-
>ListEntry.Flink;
}
while
(CallbackList.Flink !
=
(PLIST_ENTRY)pObCallback);
return
status;
}
|
运行这段驱动程序，即可得到进程句柄回调:
当然了如上是进程句柄的枚举，如果是想要输出线程句柄，则只需要替换代码中的PsProcessType为((POBJECT_TYPE)(*PsThreadType))->CallbackList即可，修改后的代码如下。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
#include <wdm.h>
#include <ntddk.h>
typedef struct _OBJECT_TYPE_INITIALIZER
{
USHORT Length;
/
/
Uint2B
UCHAR ObjectTypeFlags;
/
/
UChar
ULONG ObjectTypeCode;
/
/
Uint4B
ULONG InvalidAttributes;
/
/
Uint4B
GENERIC_MAPPING GenericMapping;
/
/
_GENERIC_MAPPING
ULONG ValidAccessMask;
/
/
Uint4B
ULONG RetainAccess;
/
/
Uint4B
POOL_TYPE PoolType;
/
/
_POOL_TYPE
ULONG DefaultPagedPoolCharge;
/
/
Uint4B
ULONG DefaultNonPagedPoolCharge;
/
/
Uint4B
PVOID DumpProcedure;
/
/
Ptr64 void
PVOID OpenProcedure;
/
/
Ptr64
long
PVOID CloseProcedure;
/
/
Ptr64 void
PVOID DeleteProcedure;
/
/
Ptr64 void
PVOID ParseProcedure;
/
/
Ptr64
long
PVOID SecurityProcedure;
/
/
Ptr64
long
PVOID QueryNameProcedure;
/
/
Ptr64
long
PVOID OkayToCloseProcedure;
/
/
Ptr64 unsigned char
ULONG WaitObjectFlagMask;
/
/
Uint4B
USHORT WaitObjectFlagOffset;
/
/
Uint2B
USHORT WaitObjectPointerOffset;
/
/
Uint2B
}OBJECT_TYPE_INITIALIZER,
*
POBJECT_TYPE_INITIALIZER;
typedef struct _OBJECT_TYPE
{
LIST_ENTRY TypeList;
/
/
_LIST_ENTRY
UNICODE_STRING Name;
/
/
_UNICODE_STRING
PVOID DefaultObject;
/
/
Ptr64 Void
UCHAR Index;
/
/
UChar
ULONG TotalNumberOfObjects;
/
/
Uint4B
ULONG TotalNumberOfHandles;
/
/
Uint4B
ULONG HighWaterNumberOfObjects;
/
/
Uint4B
ULONG HighWaterNumberOfHandles;
/
/
Uint4B
OBJECT_TYPE_INITIALIZER TypeInfo;
/
/
_OBJECT_TYPE_INITIALIZER
EX_PUSH_LOCK TypeLock;
/
/
_EX_PUSH_LOCK
ULONG Key;
/
/
Uint4B
LIST_ENTRY CallbackList;
/
/
_LIST_ENTRY
}OBJECT_TYPE,
*
POBJECT_TYPE;
#pragma pack(1)
typedef struct _OB_CALLBACK
{
LIST_ENTRY ListEntry;
ULONGLONG Unknown;
HANDLE ObHandle;
PVOID ObTypeAddr;
PVOID PreCall;
PVOID PostCall;
}OB_CALLBACK,
*
POB_CALLBACK;
#pragma pack()
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
NTSTATUS status
=
STATUS_SUCCESS;
DbgPrint(
"hello lyshark.com \n"
);
POB_CALLBACK pObCallback
=
NULL;
/
/
直接获取 CallbackList 链表
LIST_ENTRY CallbackList
=
((POBJECT_TYPE)(
*
PsThreadType))
-
>CallbackList;
/
/
开始遍历
pObCallback
=
(POB_CALLBACK)CallbackList.Flink;
do
{
if
(FALSE
=
=
MmIsAddressValid(pObCallback))
{
break
;
}
if
(NULL !
=
pObCallback
-
>ObHandle)
{
/
/
显示
DbgPrint(
"[LyShark] ObHandle = %p | PreCall = %p | PostCall = %p \n"
, pObCallback
-
>ObHandle, pObCallback
-
>PreCall, pObCallback
-
>PostCall);
}
/
/
获取下一链表信息
pObCallback
=
(POB_CALLBACK)pObCallback
-
>ListEntry.Flink;
}
while
(CallbackList.Flink !
=
(PLIST_ENTRY)pObCallback);
return
status;
}
|
运行这段驱动程序，即可得到线程句柄回调:
更多【 驱动开发：内核枚举进程与线程ObCall回调】相关视频教程：www.yxfzedu.com
相关文章推荐
- 攻防演练中红队常用的攻击方法之横向移动（上） - 企业安全
- 攻防演练中红队常用的攻击方法之横向移动（中） - 企业安全
- 双周连载 | 暗网分析报告Part 1：他们无法保护你 - 企业安全
- CTF简单算法反解 - Android安全
- 零零信安-D&D数据泄露报警日报【第201期】 - 软件逆向
- BinaryAI更新布告｜自定义比对功能灵活实现“异样”速判 - 企业安全
- 零零信安-D&D数据泄露报警日报【第202期】 - 软件逆向
- Xposed过滤某论坛APP广告 - Android安全
- 与钓鱼佬的交谈 - 软件逆向
- x64dbg快速找call插件 - 软件逆向
- 2023SCTF-Syclang-关于中间指令的分析 - CTF对抗
- 对抗再升级，“Xidu”新变种利用云笔记平台躲避检测 - 企业安全
- 零零信安-D&D数据泄露报警日报【第203期】 - 软件逆向
- 纯小白对一个类似于利用SMC技术病毒中Windows API解析 - 软件逆向
- 华云安漏洞安全周报【第141期】 - 企业安全
- “浅谈资产-安全-管理”之价值篇：善事而利器 - 企业安全
- 开源共建，360推出WatchAD2.0域威胁感知系统新版本 - 企业安全
- BinaryAI二进制比对功能设计与实现｜大模型下函数的语义匹配 - 企业安全
- 更高更妙的抓包——从Chrome源码学习使用Cronet 通讯组件的app的通用抓包方法 - Android安全
- 新手上路，记录一个某编辑010软件的注册破解过程 - 软件逆向
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多