-
-
[原创]浅谈一下驱动开发中的硬编码
-
发表于:
2011-11-7 08:50
15146
-
typedef PUCHAR (__stdcall *sky_PsGetProcessImageFileName)(PEPROCESS pEprocess);
PUCHAR GetSpecialProcessImageFileName(PEPROCESS pEprocess)
{
UNICODE_STRING destString;
sky_PsGetProcessImageFileName CallPsGetProcessImageFileName = NULL;
if ( MmIsAddressValidEx((PVOID)pEprocess) == VCS_INVALID ) return NULL;
if ( IsValidObject(pEprocess,*PsProcessType) == FALSE ) return NULL;
RtlInitUnicodeString(&destString,(PWCHAR)L"PsGetProcessImageFileName");
CallPsGetProcessImageFileName = (sky_PsGetProcessImageFileName)MmGetSystemRoutineAddress(&destString);
if (CallPsGetProcessImageFileName == NULL) return NULL;
return CallPsGetProcessImageFileName(pEprocess);
}
PsGetProcessDebugPort 取得指定EPROCESS的调试端口信息
typedef PVOID (__stdcall *sky_PsGetProcessDebugPort)(PEPROCESS pEprocess);
PsGetProcessId 取得指定EPROCESS的进程Id
typedef ULONG (__stdcall *sky_PsGetProcessId)(PEPROCESS pEprocess);
PsGetProcessInheritedFromUniqueProcessId 取得指定EPROCESS的父进程Id
typedef ULONG (__stdcall *sky_PsGetProcessInheritedFromUniqueProcessId)(PEPROCESS pEprocess);
PsGetProcessJob 取得指定EPROCESS的Job信息
typedef PVOID (__stdcall *sky_PsGetProcessJob)(PEPROCESS pEprocess);
PsGetProcessPeb 取得指定EPROCESS的Peb地址
typedef PPEB (__stdcall *sky_PsGetProcessPeb)(PEPROCESS pEprocess);
PsGetProcessWin32Process 取得指定EPROCESS的w32process结构地址 <GUI>
typedef PVOID (__stdcall *sky_PsGetProcessWin32Process)(PEPROCESS pEprocess);
PsGetThreadTeb 取得指定ETHREAD的Teb地址
typedef PVOID (__stdcall *sky_PsGetThreadTeb)(PETHREAD pEthread);
PsGetThreadId 取得指定ETHREAD的线程Id
typedef ULONG (__stdcall *sky_PsGetThreadId)(PETHREAD pEthread);
PsGetThreadProcessId 取得指定ETHREAD的进程Id
typedef ULONG (__stdcall *sky_PsGetThreadProcessId)(PETHREAD pEthread);
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
商业代码还是乖乖的用微软推荐的方法吧，当然有时候又是不能不用的-_-
