能力值:
( LV4,RANK:50 )
|
-
-
2 楼
只需要解析遍历导入表即可呀
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
打开文件的代码,遍历导入表和r3是一样的。
status=ZwQuerySystemInformation(SystemModuleInformation,NULL,0,&NeededSize);
if (status!=STATUS_INFO_LENGTH_MISMATCH)
{
return status;
}
buffer=(PMODULES)ExAllocatePoolWithTag(NonPagedPool,NeededSize,'OSD');
if (buffer==0)
{
return STATUS_UNSUCCESSFUL;
}
status=ZwQuerySystemInformation(SystemModuleInformation,buffer,NeededSize,&NeededSize);
if (!NT_SUCCESS(status))
{
KdPrint(("(EnumOriginalSSDT) failed to ZwQuerySystemInformation"));
ExFreePool(buffer);
return status;
}
KernelBase=buffer->smi[0].Base;
AnsiName=buffer->smi->ModuleNameOffset+buffer->smi->ImageName;
RtlStringCchCopyA(AnsiPath,MAX_PATH*sizeof(CHAR),"\\SystemRoot\\System32\\");
RtlStringCchCatA(AnsiPath,MAX_PATH*sizeof(CHAR),AnsiName);
RtlInitAnsiString(&KernelNameAnsi,AnsiPath);
RtlAnsiStringToUnicodeString(&KernelName,&KernelNameAnsi,TRUE);
ExFreePool(buffer);
InitializeObjectAttributes(
&ObjectAttributes,
&KernelName,
OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE,
NULL,
NULL);
status=ZwCreateFile(
&hFile,
GENERIC_READ,
&ObjectAttributes,
&IoStatusBlock,
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NON_DIRECTORY_FILE|FILE_RANDOM_ACCESS|FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0
);
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
//参数就是内核模块的起始地址
NTSTATUS EumeIATTable(ULONG_PTR Base)
{
//变量的声明
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)Base;
PIMAGE_NT_HEADERS pNtHeader;
IMAGE_OPTIONAL_HEADER opthdr;
IMAGE_IMPORT_DESCRIPTOR *pIatDes;
NTSTATUS ns = STATUS_NOT_FOUND;
char *pszModName;
IMAGE_THUNK_DATA * pThunk;
int n = 0 ;
PUCHAR pszFunName;
DWORD *lpAddr;
IMAGE_IMPORT_BY_NAME *FunName;
pNtHeader =(PIMAGE_NT_HEADERS)(ULONG_PTR)((ULONG_PTR)pDosHeader+pDosHeader->e_lfanew);
opthdr = pNtHeader->OptionalHeader;
pIatDes = (IMAGE_IMPORT_DESCRIPTOR *)((PUCHAR)Base + opthdr.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
DbgPrint("the module is load at:%X\n",Base);
DbgPrint("the pointer to ImportDesc is: %X\n",pIatDes);
//这里循环进不去
while ( pIatDes->FirstThunk )
{
pszModName = (PSTR) ((PUCHAR) Base + pIatDes->Name);
DbgPrint( "模块名称:%s\n " , pszModName );
pThunk = (IMAGE_THUNK_DATA * )((PUCHAR)Base + pIatDes -> OriginalFirstThunk );
while (pThunk -> u1.Function)
{
FunName = (IMAGE_IMPORT_BY_NAME *)( ( PUCHAR )Base + (DWORD)pThunk->u1.AddressOfData );
pszFunName = ( PUCHAR )FunName->Name;
//取得函数地址。IAT表就是一个DWORD类型的数组,每个成员记录一个函数的地址
lpAddr = (DWORD * )((PUCHAR)Base + pIatDes -> FirstThunk) + n;
// 打印出函数名称和地址
DbgPrint( "从此模块导入的函数:%-25s, " , pszFunName);
DbgPrint( "函数地址:%X \n " , lpAddr);
n++ ; pThunk++ ;
}
pIatDes++;
}
}
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
哦,得到这个下一步是
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
已经弄出来了,谢谢
|