编程技术- 驱动开发：Win10枚举完整SSDT地址表
推荐 原创在前面的博文《驱动开发：Win10内核枚举SSDT表基址》中已经教大家如何寻找SSDT表基地址了，找到后我们可根据序号获取到指定SSDT函数的原始地址，而如果需要输出所有SSDT表信息，则可以定义字符串列表，以此循环调用GetSSDTFunctionAddress()函数得到，当然在此之间也可以调用系统提供的MmGetSystemRoutineAddress()函数顺便把当前地址拿到，并通过循环方式得到完整的SSDT列表。
调用MmGetSystemRoutineAddress()得到当前地址很容易实现，只需要将函数名字符串通过RtlInitUnicodeString()格式化一下即可。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
VOID UnDriver(PDRIVER_OBJECT driver)
{
DbgPrint((
"驱动程序卸载成功! \n"
));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
DbgPrint(
"hello lyshark.com \n"
);
/
/
获取SSDT起源地址
UNICODE_STRING uncode;
RtlInitUnicodeString(&uncode, L
"NtOpenFile"
);
PULONGLONG source_address
=
MmGetSystemRoutineAddress(&uncode);
DbgPrint(
"[LyShark] NtOpenFile起源地址 = %p \n"
, source_address);
DriverObject
-
>DriverUnload
=
UnDriver;
return
STATUS_SUCCESS;
}
|
代码获得NtOpenFile这个函数的内存地址，输出效果如下所示：
根据上一章节的内容扩展，枚举完整SSDT表我们可以这样来实现。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
/
/
署名权
/
/
right to sign one's name on a piece of work
/
/
PowerBy: LyShark
/
/
Email: me@lyshark.com
#include <ntifs.h>
#pragma intrinsic(__readmsr)
typedef struct _SYSTEM_SERVICE_TABLE
{
PVOID ServiceTableBase;
PVOID ServiceCounterTableBase;
ULONGLONG NumberOfServices;
PVOID ParamTableBase;
} SYSTEM_SERVICE_TABLE,
*
PSYSTEM_SERVICE_TABLE;
ULONGLONG ssdt_base_aadress;
PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable;
typedef UINT64(__fastcall
*
SCFN)(UINT64, UINT64);
SCFN scfn;
/
/
解密算法
VOID DecodeSSDT()
{
UCHAR strShellCode[
36
]
=
"\x48\x8B\xC1\x4C\x8D\x12\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x4E\x8B\x14\x17\x4D\x63\x1C\x82\x49\x8B\xC3\x49\xC1\xFB\x04\x4D\x03\xD3\x49\x8B\xC2\xC3"
;
/
*
48
:
8BC1
| mov rax,rcx | rcx
=
index
4C
:
8D12
| lea r10,qword ptr ds:[rdx] | rdx
=
ssdt
8BF8
| mov edi,eax |
C1EF
07
| shr edi,
7
|
83E7
20
|
and
edi,
20
|
4E
:
8B1417
| mov r10,qword ptr ds:[rdi
+
r10] |
4D
:
631C82
| movsxd r11,dword ptr ds:[r10
+
rax
*
4
] |
49
:
8BC3
| mov rax,r11 |
49
:C1FB
04
| sar r11,
4
|
4D
:
03D3
| add r10,r11 |
49
:
8BC2
| mov rax,r10 |
C3 | ret |
*
/
scfn
=
ExAllocatePool(NonPagedPool,
36
);
memcpy(scfn, strShellCode,
36
);
}
/
/
获取 KeServiceDescriptorTable 首地址
ULONGLONG GetKeServiceDescriptorTable()
{
/
/
设置起始位置
PUCHAR StartSearchAddress
=
(PUCHAR)__readmsr(
0xC0000082
)
-
0x1806FE
;
/
/
设置结束位置
PUCHAR EndSearchAddress
=
StartSearchAddress
+
0x8192
;
/
/
DbgPrint(
"扫描起始地址: %p --> 扫描结束地址: %p \n"
, StartSearchAddress, EndSearchAddress);
PUCHAR ByteCode
=
NULL;
UCHAR OpCodeA
=
0
, OpCodeB
=
0
, OpCodeC
=
0
;
ULONGLONG addr
=
0
;
ULONG templong
=
0
;
for
(ByteCode
=
StartSearchAddress; ByteCode < EndSearchAddress; ByteCode
+
+
)
{
/
/
使用MmIsAddressValid()函数检查地址是否有页面错误
if
(MmIsAddressValid(ByteCode) && MmIsAddressValid(ByteCode
+
1
) && MmIsAddressValid(ByteCode
+
2
))
{
OpCodeA
=
*
ByteCode;
OpCodeB
=
*
(ByteCode
+
1
);
OpCodeC
=
*
(ByteCode
+
2
);
/
/
对比特征值 寻找 nt!KeServiceDescriptorTable 函数地址
/
/
LyShark.com
/
/
4c
8d
15
e5
9e
3b
00
lea r10,[nt!KeServiceDescriptorTable (fffff802`
64da4880
)]
/
/
4c
8d
1d
de
20
3a
00
lea r11,[nt!KeServiceDescriptorTableShadow (fffff802`
64d8ca80
)]
if
(OpCodeA
=
=
0x4c
&& OpCodeB
=
=
0x8d
&& OpCodeC
=
=
0x15
)
{
/
/
获取高位地址fffff802
memcpy(&templong, ByteCode
+
3
,
4
);
/
/
与低位
64da4880
地址相加得到完整地址
addr
=
(ULONGLONG)templong
+
(ULONGLONG)ByteCode
+
7
;
return
addr;
}
}
}
return
0
;
}
/
/
得到函数相对偏移地址
ULONG GetOffsetAddress(ULONGLONG FuncAddr)
{
ULONG dwtmp
=
0
;
PULONG ServiceTableBase
=
NULL;
if
(KeServiceDescriptorTable
=
=
NULL)
{
KeServiceDescriptorTable
=
(PSYSTEM_SERVICE_TABLE)GetKeServiceDescriptorTable();
}
ServiceTableBase
=
(PULONG)KeServiceDescriptorTable
-
>ServiceTableBase;
dwtmp
=
(ULONG)(FuncAddr
-
(ULONGLONG)ServiceTableBase);
return
dwtmp <<
4
;
}
/
/
根据序号得到函数地址
ULONGLONG GetSSDTFunctionAddress(ULONGLONG NtApiIndex)
{
ULONGLONG ret
=
0
;
if
(ssdt_base_aadress
=
=
0
)
{
/
/
得到ssdt基地址
ssdt_base_aadress
=
GetKeServiceDescriptorTable();
}
if
(scfn
=
=
NULL)
{
DecodeSSDT();
}
ret
=
scfn(NtApiIndex, ssdt_base_aadress);
return
ret;
}
/
/
查询函数系统地址
ULONG_PTR QueryFunctionSystemAddress(PWCHAR name)
{
UNICODE_STRING na;
ULONG_PTR address;
RtlInitUnicodeString(&na, name);
address
=
(ULONG_PTR)MmGetSystemRoutineAddress(&na);
return
address;
}
VOID UnDriver(PDRIVER_OBJECT driver)
{
DbgPrint((
"驱动程序卸载成功! \n"
));
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
DbgPrint(
"hello lyshark.com \n"
);
char
*
SSDT[
464
]
=
{
"NtAccessCheck"
,
"NtWorkerFactoryWorkerReady"
,
"NtAcceptConnectPort"
,
"NtMapUserPhysicalPagesScatter"
,
"NtWaitForSingleObject"
,
"NtCallbackReturn"
,
"NtReadFile"
,
"NtDeviceIoControlFile"
,
"NtWriteFile"
,
"NtRemoveIoCompletion"
,
"NtReleaseSemaphore"
,
"NtReplyWaitReceivePort"
,
"NtReplyPort"
,
"NtSetInformationThread"
,
"NtSetEvent"
,
"NtClose"
,
"NtQueryObject"
,
"NtQueryInformationFile"
,
"NtOpenKey"
,
"NtEnumerateValueKey"
,
"NtFindAtom"
,
"NtQueryDefaultLocale"
,
"NtQueryKey"
,
"NtQueryValueKey"
,
"NtAllocateVirtualMemory"
,
"NtQueryInformationProcess"
,
"NtWaitForMultipleObjects32"
,
"NtWriteFileGather"
,
"NtSetInformationProcess"
,
"NtCreateKey"
,
"NtFreeVirtualMemory"
,
"NtImpersonateClientOfPort"
,
"NtReleaseMutant"
,
"NtQueryInformationToken"
,
"NtRequestWaitReplyPort"
,
"NtQueryVirtualMemory"
,
"NtOpenThreadToken"
,
"NtQueryInformationThread"
,
"NtOpenProcess"
,
"NtSetInformationFile"
,
"NtMapViewOfSection"
,
"NtAccessCheckAndAuditAlarm"
,
"NtUnmapViewOfSection"
,
"NtReplyWaitReceivePortEx"
,
"NtTerminateProcess"
,
"NtSetEventBoostPriority"
,
"NtReadFileScatter"
,
"NtOpenThreadTokenEx"
,
"NtOpenProcessTokenEx"
,
"NtQueryPerformanceCounter"
,
"NtEnumerateKey"
,
"NtOpenFile"
,
"NtDelayExecution"
,
"NtQueryDirectoryFile"
,
"NtQuerySystemInformation"
,
"NtOpenSection"
,
"NtQueryTimer"
,
"NtFsControlFile"
,
"NtWriteVirtualMemory"
,
"NtCloseObjectAuditAlarm"
,
"NtDuplicateObject"
,
"NtQueryAttributesFile"
,
"NtClearEvent"
,
"NtReadVirtualMemory"
,
"NtOpenEvent"
,
"NtAdjustPrivilegesToken"
,
"NtDuplicateToken"
,
"NtContinue"
,
"NtQueryDefaultUILanguage"
,
"NtQueueApcThread"
,
"NtYieldExecution"
,
"NtAddAtom"
,
"NtCreateEvent"
,
"NtQueryVolumeInformationFile"
,
"NtCreateSection"
,
"NtFlushBuffersFile"
,
"NtApphelpCacheControl"
,
"NtCreateProcessEx"
,
"NtCreateThread"
,
"NtIsProcessInJob"
,
"NtProtectVirtualMemory"
,
"NtQuerySection"
,
"NtResumeThread"
,
"NtTerminateThread"
,
"NtReadRequestData"
,
"NtCreateFile"
,
"NtQueryEvent"
,
"NtWriteRequestData"
,
"NtOpenDirectoryObject"
,
"NtAccessCheckByTypeAndAuditAlarm"
,
"NtQuerySystemTime"
,
"NtWaitForMultipleObjects"
,
"NtSetInformationObject"
,
"NtCancelIoFile"
,
"NtTraceEvent"
,
"NtPowerInformation"
,
"NtSetValueKey"
,
"NtCancelTimer"
,
"NtSetTimer"
,
"NtAccessCheckByType"
,
"NtAccessCheckByTypeResultList"
,
"NtAccessCheckByTypeResultListAndAuditAlarm"
,
"NtAccessCheckByTypeResultListAndAuditAlarmByHandle"
,
"NtAcquireProcessActivityReference"
,
"NtAddAtomEx"
,
"NtAddBootEntry"
,
"NtAddDriverEntry"
,
"NtAdjustGroupsToken"
,
"NtAdjustTokenClaimsAndDeviceGroups"
,
"NtAlertResumeThread"
,
"NtAlertThread"
,
"NtAlertThreadByThreadId"
,
"NtAllocateLocallyUniqueId"
,
"NtAllocateReserveObject"
,
"NtAllocateUserPhysicalPages"
,
"NtAllocateUuids"
,
"NtAllocateVirtualMemoryEx"
,
"NtAlpcAcceptConnectPort"
,
"NtAlpcCancelMessage"
,
"NtAlpcConnectPort"
,
"NtAlpcConnectPortEx"
,
"NtAlpcCreatePort"
,
"NtAlpcCreatePortSection"
,
"NtAlpcCreateResourceReserve"
,
"NtAlpcCreateSectionView"
,
"NtAlpcCreateSecurityContext"
,
"NtAlpcDeletePortSection"
,
"NtAlpcDeleteResourceReserve"
,
"NtAlpcDeleteSectionView"
,
"NtAlpcDeleteSecurityContext"
,
"NtAlpcDisconnectPort"
,
"NtAlpcImpersonateClientContainerOfPort"
,
"NtAlpcImpersonateClientOfPort"
,
"NtAlpcOpenSenderProcess"
,
"NtAlpcOpenSenderThread"
,
"NtAlpcQueryInformation"
,
"NtAlpcQueryInformationMessage"
,
"NtAlpcRevokeSecurityContext"
,
"NtAlpcSendWaitReceivePort"
,
"NtAlpcSetInformation"
,
"NtAreMappedFilesTheSame"
,
"NtAssignProcessToJobObject"
,
"NtAssociateWaitCompletionPacket"
,
"NtCallEnclave"
,
"NtCancelIoFileEx"
,
"NtCancelSynchronousIoFile"
,
"NtCancelTimer2"
,
"NtCancelWaitCompletionPacket"
,
"NtCommitComplete"
,
"NtCommitEnlistment"
,
"NtCommitRegistryTransaction"
,
"NtCommitTransaction"
,
"NtCompactKeys"
,
"NtCompareObjects"
,
"NtCompareSigningLevels"
,
"NtCompareTokens"
,
"ArbPreprocessEntry"
,
"NtCompressKey"
,
"NtConnectPort"
,
"NtConvertBetweenAuxiliaryCounterAndPerformanceCounter"
,
"ArbAddReserved"
,
"NtCreateDebugObject"
,
"NtCreateDirectoryObject"
,
"NtCreateDirectoryObjectEx"
,
"NtCreateEnclave"
,
"NtCreateEnlistment"
,
"NtCreateEventPair"
,
"NtCreateIRTimer"
,
"NtCreateIoCompletion"
,
"NtCreateJobObject"
,
"ArbAddReserved"
,
"NtCreateKeyTransacted"
,
"NtCreateKeyedEvent"
,
"NtCreateLowBoxToken"
,
"NtCreateMailslotFile"
,
"NtCreateMutant"
,
"NtCreateNamedPipeFile"
,
"NtCreatePagingFile"
,
"NtCreatePartition"
,
"NtCreatePort"
,
"NtCreatePrivateNamespace"
,
"NtCreateProcess"
,
"NtCreateProfile"
,
"NtCreateProfileEx"
,
"NtCreateRegistryTransaction"
,
"NtCreateResourceManager"
,
"NtCreateSectionEx"
,
"NtCreateSemaphore"
,
"NtCreateSymbolicLinkObject"
,
"NtCreateThreadEx"
,
"NtCreateTimer"
,
"NtCreateTimer2"
,
"NtCreateToken"
,
"NtCreateTokenEx"
,
"NtCreateTransaction"
,
"NtCreateTransactionManager"
,
"NtCreateUserProcess"
,
"NtCreateWaitCompletionPacket"
,
"NtCreateWaitablePort"
,
"NtCreateWnfStateName"
,
"NtCreateWorkerFactory"
,
"NtDebugActiveProcess"
,
"NtDebugContinue"
,
"NtDeleteAtom"
,
"NtDeleteBootEntry"
,
"NtDeleteDriverEntry"
,
"NtDeleteFile"
,
"NtDeleteKey"
,
"NtDeleteObjectAuditAlarm"
,
"NtDeletePrivateNamespace"
,
"NtDeleteValueKey"
,
"NtDeleteWnfStateData"
,
"NtDeleteWnfStateName"
,
"NtDisableLastKnownGood"
,
"NtDisplayString"
,
"NtDrawText"
,
"NtEnableLastKnownGood"
,
"NtEnumerateBootEntries"
,
"NtEnumerateDriverEntries"
,
"NtEnumerateSystemEnvironmentValuesEx"
,
"NtEnumerateTransactionObject"
,
"NtExtendSection"
,
"NtFilterBootOption"
,
"NtFilterToken"
,
"NtFilterTokenEx"
,
"NtFlushBuffersFileEx"
,
"NtFlushInstallUILanguage"
,
"ArbPreprocessEntry"
,
"NtFlushKey"
,
"NtFlushProcessWriteBuffers"
,
"NtFlushVirtualMemory"
,
"NtFlushWriteBuffer"
,
"NtFreeUserPhysicalPages"
,
"NtFreezeRegistry"
,
"NtFreezeTransactions"
,
"NtGetCachedSigningLevel"
,
"NtGetCompleteWnfStateSubscription"
,
"NtGetContextThread"
,
"NtGetCurrentProcessorNumber"
,
"NtGetCurrentProcessorNumberEx"
,
"NtGetDevicePowerState"
,
"NtGetMUIRegistryInfo"
,
"NtGetNextProcess"
,
"NtGetNextThread"
,
"NtGetNlsSectionPtr"
,
"NtGetNotificationResourceManager"
,
"NtGetWriteWatch"
,
"NtImpersonateAnonymousToken"
,
"NtImpersonateThread"
,
"NtInitializeEnclave"
,
"NtInitializeNlsFiles"
,
"NtInitializeRegistry"
,
"NtInitiatePowerAction"
,
"NtIsSystemResumeAutomatic"
,
"NtIsUILanguageComitted"
,
"NtListenPort"
,
"NtLoadDriver"
,
"NtLoadEnclaveData"
,
"NtLoadKey"
,
"NtLoadKey2"
,
"NtLoadKeyEx"
,
"NtLockFile"
,
"NtLockProductActivationKeys"
,
"NtLockRegistryKey"
,
"NtLockVirtualMemory"
,
"NtMakePermanentObject"
,
"NtMakeTemporaryObject"
,
"NtManageHotPatch"
,
"NtManagePartition"
,
"NtMapCMFModule"
,
"NtMapUserPhysicalPages"
,
"NtMapViewOfSectionEx"
,
"NtModifyBootEntry"
,
"NtModifyDriverEntry"
,
"NtNotifyChangeDirectoryFile"
,
"NtNotifyChangeDirectoryFileEx"
,
"NtNotifyChangeKey"
,
"NtNotifyChangeMultipleKeys"
,
"NtNotifyChangeSession"
,
"NtOpenEnlistment"
,
"NtOpenEventPair"
,
"NtOpenIoCompletion"
,
"NtOpenJobObject"
,
"NtOpenKeyEx"
,
"NtOpenKeyTransacted"
,
"NtOpenKeyTransactedEx"
,
"NtOpenKeyedEvent"
,
"NtOpenMutant"
,
"NtOpenObjectAuditAlarm"
,
"NtOpenPartition"
,
"NtOpenPrivateNamespace"
,
"NtOpenProcessToken"
,
"NtOpenRegistryTransaction"
,
"NtOpenResourceManager"
,
"NtOpenSemaphore"
,
"NtOpenSession"
,
"NtOpenSymbolicLinkObject"
,
"NtOpenThread"
,
"NtOpenTimer"
,
"NtOpenTransaction"
,
"NtOpenTransactionManager"
,
"NtPlugPlayControl"
,
"NtPrePrepareComplete"
,
"NtPrePrepareEnlistment"
,
"NtPrepareComplete"
,
"NtPrepareEnlistment"
,
"NtPrivilegeCheck"
,
"NtPrivilegeObjectAuditAlarm"
,
"NtPrivilegedServiceAuditAlarm"
,
"NtPropagationComplete"
,
"NtPropagationFailed"
,
"NtPulseEvent"
,
"NtQueryAuxiliaryCounterFrequency"
,
"NtQueryBootEntryOrder"
,
"NtQueryBootOptions"
,
"NtQueryDebugFilterState"
,
"NtQueryDirectoryFileEx"
,
"NtQueryDirectoryObject"
,
"NtQueryDriverEntryOrder"
,
"NtQueryEaFile"
,
"NtQueryFullAttributesFile"
,
"NtQueryInformationAtom"
,
"NtQueryInformationByName"
,
"NtQueryInformationEnlistment"
,
"NtQueryInformationJobObject"
,
"NtQueryInformationPort"
,
"NtQueryInformationResourceManager"
,
"NtQueryInformationTransaction"
,
"NtQueryInformationTransactionManager"
,
"NtQueryInformationWorkerFactory"
,
"NtQueryInstallUILanguage"
,
"NtQueryIntervalProfile"
,
"NtQueryIoCompletion"
,
"NtQueryLicenseValue"
,
"NtQueryMultipleValueKey"
,
"NtQueryMutant"
,
"NtQueryOpenSubKeys"
,
"NtQueryOpenSubKeysEx"
,
"CmpCleanUpHigherLayerKcbCachesPreCallback"
,
"NtQueryQuotaInformationFile"
,
"NtQuerySecurityAttributesToken"
,
"NtQuerySecurityObject"
,
"NtQuerySecurityPolicy"
,
"NtQuerySemaphore"
,
"NtQuerySymbolicLinkObject"
,
"NtQuerySystemEnvironmentValue"
,
"NtQuerySystemEnvironmentValueEx"
,
"NtQuerySystemInformationEx"
,
"NtQueryTimerResolution"
,
"NtQueryWnfStateData"
,
"NtQueryWnfStateNameInformation"
,
"NtQueueApcThreadEx"
,
"NtRaiseException"
,
"NtRaiseHardError"
,
"NtReadOnlyEnlistment"
,
"NtRecoverEnlistment"
,
"NtRecoverResourceManager"
,
"NtRecoverTransactionManager"
,
"NtRegisterProtocolAddressInformation"
,
"NtRegisterThreadTerminatePort"
,
"NtReleaseKeyedEvent"
,
"NtReleaseWorkerFactoryWorker"
,
"NtRemoveIoCompletionEx"
,
"NtRemoveProcessDebug"
,
"NtRenameKey"
,
"NtRenameTransactionManager"
,
"NtReplaceKey"
,
"NtReplacePartitionUnit"
,
"NtReplyWaitReplyPort"
,
"NtRequestPort"
,
"NtResetEvent"
,
"NtResetWriteWatch"
,
"NtRestoreKey"
,
"NtResumeProcess"
,
"NtRevertContainerImpersonation"
,
"NtRollbackComplete"
,
"NtRollbackEnlistment"
,
"NtRollbackRegistryTransaction"
,
"NtRollbackTransaction"
,
"NtRollforwardTransactionManager"
,
"NtSaveKey"
,
"NtSaveKeyEx"
,
"NtSaveMergedKeys"
,
"NtSecureConnectPort"
,
"NtSerializeBoot"
,
"NtSetBootEntryOrder"
,
"NtSetBootOptions"
,
"NtSetCachedSigningLevel"
,
"NtSetCachedSigningLevel2"
,
"NtSetContextThread"
,
"NtSetDebugFilterState"
,
"NtSetDefaultHardErrorPort"
,
"NtSetDefaultLocale"
,
"NtSetDefaultUILanguage"
,
"NtSetDriverEntryOrder"
,
"NtSetEaFile"
,
"NtSetHighEventPair"
,
"NtSetHighWaitLowEventPair"
,
"NtSetIRTimer"
,
"NtSetInformationDebugObject"
,
"NtSetInformationEnlistment"
,
"NtSetInformationJobObject"
,
"NtSetInformationKey"
,
"NtSetInformationResourceManager"
,
"NtSetInformationSymbolicLink"
,
"NtSetInformationToken"
,
"NtSetInformationTransaction"
,
"NtSetInformationTransactionManager"
,
"NtSetInformationVirtualMemory"
,
"NtSetInformationWorkerFactory"
,
"NtSetIntervalProfile"
,
"NtSetIoCompletion"
,
"NtSetIoCompletionEx"
,
"BvgaSetVirtualFrameBuffer"
,
"NtSetLowEventPair"
,
"NtSetLowWaitHighEventPair"
,
"NtSetQuotaInformationFile"
,
"NtSetSecurityObject"
,
"NtSetSystemEnvironmentValue"
,
"NtSetSystemEnvironmentValueEx"
,
"NtSetSystemInformation"
,
"NtSetSystemPowerState"
,
"NtSetSystemTime"
,
"NtSetThreadExecutionState"
,
"NtSetTimer2"
,
"NtSetTimerEx"
,
"NtSetTimerResolution"
,
"NtSetUuidSeed"
,
"NtSetVolumeInformationFile"
,
"NtSetWnfProcessNotificationEvent"
,
"NtShutdownSystem"
,
"NtShutdownWorkerFactory"
,
"NtSignalAndWaitForSingleObject"
,
"NtSinglePhaseReject"
,
"NtStartProfile"
,
"NtStopProfile"
,
"NtSubscribeWnfStateChange"
,
"NtSuspendProcess"
,
"NtSuspendThread"
,
"NtSystemDebugControl"
,
"NtTerminateEnclave"
,
"NtTerminateJobObject"
,
"NtTestAlert"
,
"NtThawRegistry"
,
"NtThawTransactions"
,
"NtTraceControl"
,
"NtTranslateFilePath"
,
"NtUmsThreadYield"
,
"NtUnloadDriver"
,
"NtUnloadKey"
,
"NtUnloadKey2"
,
"NtUnloadKeyEx"
,
"NtUnlockFile"
,
"NtUnlockVirtualMemory"
,
"NtUnmapViewOfSectionEx"
,
"NtUnsubscribeWnfStateChange"
,
"NtUpdateWnfStateData"
,
"NtVdmControl"
,
"NtWaitForAlertByThreadId"
,
"NtWaitForDebugEvent"
,
"NtWaitForKeyedEvent"
,
"NtWaitForWorkViaWorkerFactory"
,
"NtWaitHighEventPair"
,
"NtWaitLowEventPair"
};
for
(size_t lyshark
=
0
; lyshark <
464
; lyshark
+
+
)
{
/
/
获取起源地址
ANSI_STRING ansi
=
{
0
};
UNICODE_STRING uncode
=
{
0
};
ULONGLONG ssdt_address
=
GetKeServiceDescriptorTable();
/
/
DbgPrint(
"SSDT基地址 = %p \n"
, ssdt_address);
/
/
根据序号得到函数地址
ULONGLONG address
=
GetSSDTFunctionAddress(lyshark);
ULONG offset
=
GetOffsetAddress(address);
RtlInitAnsiString(&ansi, SSDT[lyshark]);
RtlAnsiStringToUnicodeString(&uncode, &ansi, TRUE);
PULONGLONG source_address
=
MmGetSystemRoutineAddress(&uncode);
DbgPrint(
"[LyShark] 序号 => [%d] | 当前地址 => %p | 起源地址 => %p | 相对地址 => %p | SSDT => %s \n"
, lyshark, address, source_address, offset, SSDT[lyshark]);
}
DriverObject
-
>DriverUnload
=
UnDriver;
return
STATUS_SUCCESS;
}
|
我们运行这段程序，即可得到整个系统中所有的SSDT表地址信息；
在WinDBG中可看到完整的输出内容，当然有些函数没有被导出，起源地址是拿不到的。
更多【 驱动开发：Win10枚举完整SSDT地址表】相关视频教程：www.yxfzedu.com
相关文章推荐
- CTF 《2015移动安全挑战赛》第一题 AliCrackme_1 逆向 - Android安全
- 超过10万个 ChatGPT 用户数据被盗出售，AIGC时代如何安全地使用ChatGPT？ - 企业安全
- C++利用活跃变量分析清除基本块中的垃圾指令 - 软件逆向
- 攻击面管理是威胁驱动到风险驱动演进的最佳实践 - 企业安全
- SecOps2023|李少鹏独家解读《原子化安全能力白皮书》 - 企业安全
- 黑客滥用谷歌搜索传播恶意软件 - 软件逆向
- 利用符号执行增强的Fuzzer：Driller - 软件逆向
- 开源跨平台网络安全工具套件CaptfEncoder - 软件逆向
- IDA故障参考 - 软件逆向
- 入门级，无壳app登录算法还原并实现发包 - Android安全
- SecOps 2023｜钟振山：数字化转型驱动安全技术变革 - 企业安全
- 华云安漏洞安全周报【第140期】 - 企业安全
- 移动应用安全与风控——汇编基础 - Android安全
- 探索ITDR1.3｜安全产品的场景化上限再被刷新 - 企业安全
- “Change 中安网星线上发布会”召开，ITDR将加速步入落地时代 - 企业安全
- Electron应用调试技巧分享 - 软件逆向
- 攻防演练中红队常用的攻击方法之横向移动（下） - 企业安全
- 攻防演练中红队常用的攻击方法之横向移动（上） - 企业安全
- 攻防演练中红队常用的攻击方法之横向移动（中） - 企业安全
- 双周连载 | 暗网分析报告Part 1：他们无法保护你 - 企业安全
记录自己的技术轨迹
文章规则：
1)：文章标题请尽量与文章内容相符
2)：严禁色情、血腥、暴力
3)：严禁发布任何形式的广告贴
4)：严禁发表关于中国的政治类话题
5)：严格遵守中国互联网法律法规
6)：有侵权,疑问可发邮件至service@yxfzedu.com
近期原创 更多
- 运维-Linux-Docker的基础命令和部署code-server
- 算法-421. 数组中两个数的最大异或值/字典树【leetcode】
- 编程技术-解非线性方程python实现黄金分割法
- 学习-Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks - 翻译学习
- python-第三章:人工智能深度学习教程-基础神经网络(第四节-从头开始的具有前向和反向传播的深度神经网络 – Python)
- css-数据结构与算法 | 第四章：字符串
- 编程技术-自媒体项目详述
- aac-FFMPEG库实现mp4/flv文件(H264+AAC)的封装与分离
- jvm-设计模式详解（十）——装饰器模式
- hive-C++自动注册的工厂与--whole-archive
