我加了一段ebp call stack检测的代码，根据ebp想得到对应的文件名
如果用for 4gb暴力扫描内存，客户端会比较卡所以不推荐.
所以最后想到Hook LdrLoadDll再记录基址 + 模块大小 + 文件名;
比如有些三方非法注入模块等，都不经过LoadLibrary/Ex，而在HOOK这个函数后极不稳定
typedef BOOL (WINAPI *fnGetModuleInformation)(HANDLE hProcess,HMODULE hModule,LPMODULEINFO lpmodinfo,DWORD cb);
//LdrLoadDll function prototype
typedef NTSTATUS (WINAPI *fnLdrLoadDll)(IN PWCHAR PathToFile OPTIONAL,IN ULONG Flags OPTIONAL,IN PUNICODE_STRING ModuleFileName,OUT PHANDLE ModuleHandle);
//RtlInitUnicodeString function prototype
typedef VOID (WINAPI *fnRtlInitUnicodeString)(PUNICODE_STRING DestinationString,PCWSTR SourceString);
HMODULE hKernel32;
HMODULE hPsapi;
HMODULE hNTDLL;
fnLdrLoadDll pLdrLoadDll;
fnRtlInitUnicodeString pRtlInitUnicodeString;
fnGetModuleInformation pGetModuleInformation;
MODULEINFO user32ModInfo = {0};
char szMsg[MAX_PATH] = {0x00};
char szFileName[MAX_PATH] = {0x00};
DWORD g_nCount = 0;
API_HOOK LdrHook;
#define NT_SUCCESS(status) ((NTSTATUS)(status)>=0)
// 记录DLL文件名与模块信息
NTSTATUS newLdrLoadDll(IN PWCHAR PathToFile OPTIONAL,
IN ULONG Flags OPTIONAL,
IN PUNICODE_STRING ModuleFileName,
OUT PHANDLE ModuleHandle)
{
OutputDebugStringW(ModuleFileName->Buffer);
OutputDebugStringW(L"\r\n");
// 防止金山DLL注入
//if(wcscmp(L"d:\\program files (x86)\\kingsoft\\kingsoft antivirus\\kwsui.dll",ModuleFileName->Buffer) == 0)
//{
// ModuleHandle = NULL;
// return (NTSTATUS)0;
//}
NTSTATUS euRet;
fnLdrLoadDll pLdrLoad = (fnLdrLoadDll)LdrHook.OrigFunction;
euRet = pLdrLoad(PathToFile,Flags,ModuleFileName,ModuleHandle);
if(NT_SUCCESS(euRet))
{
OutputDebugStringW(L"Success load");
OutputDebugStringW(L"\r\n");
/*g_nCount++;
memset(szFileName,0x00,MAX_PATH);
if(!pGetModuleInformation(GetCurrentProcess(), (HMODULE)&ModuleHandle,&user32ModInfo, sizeof(user32ModInfo)))
return euRet;
wcharTochar(ModuleFileName->Buffer,szFileName,ModuleFileName->Length);
AddModule(szFileName,(DWORD)&user32ModInfo.EntryPoint,user32ModInfo.SizeOfImage);*/
}
return euRet;
}
void InitLdrLoadDll()
{
if(hKernel32 == NULL)
hKernel32 = GetModuleHandleA("kernel32.dll");
if(hPsapi == NULL)
hPsapi = LoadLibraryA("Psapi.dll");
if(pGetModuleInformation == NULL)
{
pGetModuleInformation = (fnGetModuleInformation)GetProcAddress (hKernel32,"GetModuleInformation");
if(pGetModuleInformation == NULL)
pGetModuleInformation = (fnGetModuleInformation)GetProcAddress (hPsapi,"GetModuleInformation");
}
if(pGetModuleInformation == NULL)
{
MessageBoxA(NULL,"pGetModuleInformation == NULL",NULL,NULL);
return;
}
if (hNTDLL == NULL)
hNTDLL = GetModuleHandleA("ntdll.dll");
if (pLdrLoadDll == NULL)
{
pLdrLoadDll = (fnLdrLoadDll)GetProcAddress (hNTDLL,"LdrLoadDll");
}
if (pRtlInitUnicodeString == NULL)
pRtlInitUnicodeString = (fnRtlInitUnicodeString)GetProcAddress (hNTDLL,"RtlInitUnicodeString");
InitAPIHook(&LdrHook,"ntdll.dll","LdrLoadDll",newLdrLoadDll);
StartAPIHook(&LdrHook);
}
void UnHook()
{
}下面是我整理的测试工程源码:
哪位达人帮忙调一下，不盛感激！
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
