-
-
[原创]如何使用LLVM编译Windows驱动(混淆&Asm)
-
发表于: 2020-10-18 16:29
-
关于使用llvm编译驱动
主要用处 内联汇编 & 混淆
混淆前代码
混淆后IDA F5
这里我们使用的是 goron
这一步其实自己设置环境变量
LLVM 官方下载地址:LLVM
Vs2019 插件下载地址:llvm2019
Vs2017 插件下载地址:LLVM Compiler Toolchain
2017以下不支持
我的:
如下
Toolset.props
Toolset.targets
#include "DriverEntry.h"static VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject){ UNREFERENCED_PARAMETER(DriverObject);
return;
}EXTERN_C NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString){ UNREFERENCED_PARAMETER(pRegistryString);
ULONG64 _Rax = 0;
for (size_t i = 0; i < 10; i++)
{
DPRINT("Test\n");
}
__asm
{
mov _Rax, rax
}
DPRINT("Rax = %x\n", _Rax);
pDriverObj->DriverUnload = DriverUnload;
return STATUS_UNSUCCESSFUL;
}#include "DriverEntry.h"static VOID DriverUnload(_In_ PDRIVER_OBJECT DriverObject){ UNREFERENCED_PARAMETER(DriverObject);
return;
}EXTERN_C NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString){ UNREFERENCED_PARAMETER(pRegistryString);
ULONG64 _Rax = 0;
for (size_t i = 0; i < 10; i++)
{
DPRINT("Test\n");
}
__asm
{
mov _Rax, rax
}
DPRINT("Rax = %x\n", _Rax);
pDriverObj->DriverUnload = DriverUnload;
