-
-
[原创]TP新驱动dbgobject权限清0的最简单pass.无hook.
-
发表于:
2013-7-29 15:21
12615
-
[原创]TP新驱动dbgobject权限清0的最简单pass.无hook.
b =*(*(tpbase+0x44a74));
b+=8;
*a =b;
* (tpbase+0x44a74) =a;
如上即可.
简单说就是被清零的结构成员指针TP是区分系统版本以后硬编码的.+8给它去清原本是0的东西就可以了.
如果已经被清0.
b =*(*(tpbase+0x44a74));
c=b+0x78;
//xp 2k3为0x78 win7win8为+0x44
*c=0x1f000f;
b+=8;
*a =b;
* (tpbase+0x44a74) =a;
补上两个相关结构
xp/2k3:
============
lkd> dt _object_type
nt!_OBJECT_TYPE
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
lkd> dt _OBJECT_TYPE_INITIALIZER
nt!_OBJECT_TYPE_INITIALIZER
+0x018 ValidAccessMask : Uint4B
win7 win8
=============================
kd> dt _object_type
ntdll!_OBJECT_TYPE
+0x028 TypeInfo : _OBJECT_TYPE_INITIALIZER---------------------
kd> dt _OBJECT_TYPE_INITIALIZER
ntdll!_OBJECT_TYPE_INITIALIZER
+0x01c ValidAccessMask : Uint4B------------------------
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
不研究驱动 纯支持
