系统环境是32位WIN7
想从驱动里向某进程插入一个APC来注入DLL,用MDL将驱动的DLL路径和APC函数都映射进用户层空间,但是映射成功之后的地址不可写,貌似也不可执行,只能在OD里显示出来字符串和汇编代码.
我是这样映射的:
ULONG NormalRoutineAddress = MmMapLockedPagesSpecifyCache(pMdlRoutine, UserMode, MmCached, NULL, FALSE, NormalPagePriority);
ULONG DllPathNameAddress = MmMapLockedPagesSpecifyCache(pMdlPath, UserMode, MmCached, NULL, FALSE, NormalPagePriority);
就是这两个地址(DllPathNameAddres, NormalRoutineAddress)在OD里只能读,不能写,也不能执行,可有谁有高招?求大牛帮忙!!!!!!!
/////////////////////////////////////////////////////////////////////////////////////
其它相关代码如下
//切记,IoAllocateMdl第二个参数length必须是page的整数倍,这里是512,否则无限蓝蓝
pMdlRoutine = IoAllocateMdl(ApcLoadDll, 512, FALSE, FALSE, NULL);
pMdlPath = IoAllocateMdl(DLLpathName, 512, FALSE, FALSE, NULL);
if (!pMdlRoutine || !pMdlPath)
{
return;
}
//pMdlRoutine->MdlFlags |= MDL_WRITE_OPERATION;// 改变MDL的flags属性 ,注释了,一加这个就无限蓝屏
//pMdlPath->MdlFlags |= MDL_WRITE_OPERATION;
//锁定
__try{
MmProbeAndLockPages(pMdlRoutine, KernelMode, IoWriteAccess);
MmProbeAndLockPages(pMdlPath, KernelMode, IoWriteAccess);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
KdPrint(("MmProbeAndLockPages failed"));
return;
};
DbgBreakPoint();
//把分配好的内存映射进目标进程里面
ULONG NormalRoutineAddress = MmMapLockedPagesSpecifyCache(pMdlRoutine, UserMode, MmCached, NULL, FALSE, NormalPagePriority);
ULONG DllPathNameAddress = MmMapLockedPagesSpecifyCache(pMdlPath, UserMode, MmCached, NULL, FALSE, NormalPagePriority);
if (!NormalRoutineAddress)
{
KeDetachProcess(APCinjectProcess);//操作完成后解除附加
// 释放MDL
IoFreeMdl(pMdlRoutine);
IoFreeMdl(pMdlPath);
ExFreePool(pkApc);
KdPrint(("MmMapLockedPagesSpecifyCache failed"));
return;
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
