-
-
[原创]浅谈一下驱动开发中的硬编码
-
发表于:
2011-11-7 08:50
15145
-
typedef PUCHAR (__stdcall *sky_PsGetProcessImageFileName)(PEPROCESS pEprocess);
PUCHAR GetSpecialProcessImageFileName(PEPROCESS pEprocess)
{
UNICODE_STRING destString;
sky_PsGetProcessImageFileName CallPsGetProcessImageFileName = NULL;
if ( MmIsAddressValidEx((PVOID)pEprocess) == VCS_INVALID ) return NULL;
if ( IsValidObject(pEprocess,*PsProcessType) == FALSE ) return NULL;
RtlInitUnicodeString(&destString,(PWCHAR)L"PsGetProcessImageFileName");
CallPsGetProcessImageFileName = (sky_PsGetProcessImageFileName)MmGetSystemRoutineAddress(&destString);
if (CallPsGetProcessImageFileName == NULL) return NULL;
return CallPsGetProcessImageFileName(pEprocess);
}
PsGetProcessDebugPort 取得指定EPROCESS的调试端口信息
typedef PVOID (__stdcall *sky_PsGetProcessDebugPort)(PEPROCESS pEprocess);
PsGetProcessId 取得指定EPROCESS的进程Id
typedef ULONG (__stdcall *sky_PsGetProcessId)(PEPROCESS pEprocess);
PsGetProcessInheritedFromUniqueProcessId 取得指定EPROCESS的父进程Id
typedef ULONG (__stdcall *sky_PsGetProcessInheritedFromUniqueProcessId)(PEPROCESS pEprocess);
PsGetProcessJob 取得指定EPROCESS的Job信息
typedef PVOID (__stdcall *sky_PsGetProcessJob)(PEPROCESS pEprocess);
PsGetProcessPeb 取得指定EPROCESS的Peb地址
typedef PPEB (__stdcall *sky_PsGetProcessPeb)(PEPROCESS pEprocess);
PsGetProcessWin32Process 取得指定EPROCESS的w32process结构地址 <GUI>
typedef PVOID (__stdcall *sky_PsGetProcessWin32Process)(PEPROCESS pEprocess);
PsGetThreadTeb 取得指定ETHREAD的Teb地址
typedef PVOID (__stdcall *sky_PsGetThreadTeb)(PETHREAD pEthread);
PsGetThreadId 取得指定ETHREAD的线程Id
typedef ULONG (__stdcall *sky_PsGetThreadId)(PETHREAD pEthread);
PsGetThreadProcessId 取得指定ETHREAD的进程Id
typedef ULONG (__stdcall *sky_PsGetThreadProcessId)(PETHREAD pEthread);
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
商业代码还是乖乖的用微软推荐的方法吧，当然有时候又是不能不用的-_-
