启动时候禁用别人家的驱动 修改Start+type是不起作用的

因为OS在初始化加载驱动的时候流程如下(根据reactos4.0.2源码分析):

1 枚举System\\CurrentControlSet\\Services下所有的子项
DWORD ScmCreateServiceDatabase(VOID)
{
    InitializeListHead(&g_ServiceListHead);
    RegOpenKeyExW(
		HKEY_LOCAL_MACHINE,
                L"System\\CurrentControlSet\\Services",
                0,
                KEY_READ,
                &hServicesKey);
    
    dwSubKey = 0;
    for (;;)
    {
        dwSubKeyLength = MAX_PATH;
        dwError = RegEnumKeyExW(hServicesKey,
                                dwSubKey,
                                szSubKey,
                                &dwSubKeyLength,
                                NULL,
                                NULL,
                                NULL,
                                &ftLastChanged);
        if (dwError == ERROR_SUCCESS && szSubKey[0] != L'{')
        {
            dwError = RegOpenKeyExW(hServicesKey,
                                    szSubKey,
                                    0,
                                    KEY_READ,
                                    &hServiceKey);
            if (dwError == ERROR_SUCCESS)
            {
                dwError = CreateServiceListEntry(szSubKey,hServiceKey);
                RegCloseKey(hServiceKey);
            }
        }
        if (dwError != ERROR_SUCCESS)
            break;
        dwSubKey++;
    }
}

2 将所有子项的 type start tag errorcontrol displayname servicename存储在一个结构里 并将该结构存储在全剧链表里面
注意 并没有ImagePath
static DWORD CreateServiceListEntry(LPCWSTR lpServiceName, HKEY hServiceKey)
{
    PSERVICE lpService = NULL;    
    // 里面会 InsertTailList(&ServiceListHead,&lpService->ServiceListEntry);
    ScmCreateNewServiceRecord(lpServiceName, &lpService);
    lpService->Status.dwServiceType = dwServiceType;
    lpService->dwStartType = dwStartType;
    lpService->dwErrorControl = dwErrorControl;
    lpService->dwTag = dwTagId;
    if (lpGroup != NULL)
    {
        dwError = ScmSetServiceGroup(lpService, lpGroup);
        if (dwError != ERROR_SUCCESS)
            goto done;
    }
    return dwError;
}
    
3 在初始化驱动的时候 才真正读取ImagePath 紧接着就是DriverEntry 这就是禁用别人家驱动的时机
NTSTATUS NTAPI IopAttachFilterDriversCallback(
    PWSTR ValueName,
    ULONG ValueType,
    PVOID ValueData,
    ULONG ValueLength,
    PVOID Context,
    PVOID EntryContext)
{
    for (Filters = ValueData;
         ((ULONG_PTR)Filters - (ULONG_PTR)ValueData) < ValueLength &&
         *Filters != 0;
         Filters += (ServiceName.Length / sizeof(WCHAR)) + 1)
    {
        Status = IopGetDriverObject(&DriverObject,
                                    &ServiceName,
                                    FALSE);
        if (!NT_SUCCESS(Status))
        {
            // 这时候才访问ImagePath 并载入内存
            IopLoadServiceModule(&ServiceName, &ModuleObject);
            // 调用 IopCreateDriver 即DriverEntry
            IopInitializeDriverModule(DeviceNode,
                                      ModuleObject,
                                      &ServiceName,
                                      FALSE,
                                      &DriverObject);
    }
    return STATUS_SUCCESS;
}

所以 只有修改ImagePath才起作用

我是77 热爱生活 QQ：857554769

[课程]Android-CTF解题方法汇总！