-
-
[原创]自动获取驱动程序IO控制码初级版
-
发表于: 2012-7-27 17:22
-
"""
Galaxy Security Lab Driver Analysis for IDA Pro
Author :dragonltx
Time :2012-7-27
"""
看了Justin的《Python灰帽子》的第十章，里面提到可以用Immunity Debugger来加载驱动，并通过driverlib来获取驱动程序的io控制码，遂用Immunity Debugger加载一个驱动试试，发现加载失败，于是给Justin发了封邮件，没鸟我。
后来想了想，既然是用Immunity Debugger静态分析驱动来获取驱动程序的io控制码，还不如用IDA来分析，于是有了这篇文章。本文给出的获取驱动程序的io控制码的脚本采用IDA Python，可以给IDA Python新手当作参考，高手略过。
一、获取驱动设备名
def getDeviceName():
"""
Get Device Name from a driver.
@rtype: void
@returns: void
"""
ea = 0
while True:
ea = FindText(ea, SEARCH_NEXT | SEARCH_REGEX, 0, 0, "\\\\Device\\\\")
string = GetString(ea, -1, ASCSTR_UNICODE)
if string is None:
continue
else:
#Message("Find in %x\n" % ea)
Message("device is %s\n" % string)
break
def getDispatchAddress():
"""
Get Device Dispatch Address from a driver.
@rtype: int
@returns: Dispatch Address
"""
ea = 0
ea = FindText(ea, SEARCH_DOWN |SEARCH_NEXT | SEARCH_REGEX, 0, 0, "mov *dword *ptr *\\[[a-zA-Z]* *\\+ *70h\\],[a-zA-Z0-9_ ]*")
#ea = FindText(ea, SEARCH_NEXT | SEARCH_REGEX, 0, 0, "test *[a-zA-Z]*, +[a-zA-Z]*")
#Message("Find in %x\n" % ea)
if ea == BADADDR:
Message("Cann't find the Dispatch address")
address = BADADDR
else:
address = GetOperandValue(ea,1)
Message("Dispatch address is %x\n" % address)
return address [培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Python
|
|
|
|
|
|
学习，”似乎“很有用的方法
|
|
|
可以考虑利用IDA的F5来做,会方便很多
|
|
|
|
|
|
|
