硬编码搜太烦人了所以研究了一下此方法
代码如下 就不多BB了
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
/
/
/
/
Link to other blocks
/
/
LIST_ENTRY64
List
;
/
/
/
/
This
is
a unique tag to identify the owner of the block.
/
/
If your component only uses one pool tag, use it
for
this, too.
/
/
ULONG OwnerTag;
/
/
/
/
This must be initialized to the size of the data block,
/
/
including this structure.
/
/
ULONG Size;
} DBGKD_DEBUG_DATA_HEADER64,
*
PDBGKD_DEBUG_DATA_HEADER64;
typedef struct _KDDEBUGGER_DATA64 {
DBGKD_DEBUG_DATA_HEADER64 Header;
/
/
/
/
Base address of kernel image
/
/
ULONG64 KernBase;
/
/
/
/
DbgBreakPointWithStatus
is
a function which takes an argument
/
/
and
hits a breakpoint. This field contains the address of the
/
/
breakpoint instruction. When the debugger sees a breakpoint
/
/
at this address, it may retrieve the argument
from
the first
/
/
argument register,
or
on x86 the eax register.
/
/
ULONG64 BreakpointWithStatus;
/
/
address of breakpoint
/
/
/
/
Address of the saved context record during a bugcheck
/
/
/
/
N.B. This
is
an automatic
in
KeBugcheckEx's frame,
and
/
/
is
only valid after a bugcheck.
/
/
ULONG64 SavedContext;
/
/
/
/
help
for
walking stacks with user callbacks:
/
/
/
/
/
/
The address of the thread structure
is
provided
in
the
/
/
WAIT_STATE_CHANGE packet. This
is
the offset
from
the base of
/
/
the thread structure to the pointer to the kernel stack frame
/
/
for
the currently active usermode callback.
/
/
USHORT ThCallbackStack;
/
/
offset
in
thread data
/
/
/
/
these values are offsets into that frame:
/
/
USHORT NextCallback;
/
/
saved pointer to
next
callback frame
USHORT FramePointer;
/
/
saved frame pointer
/
/
/
/
pad to a quad boundary
/
/
USHORT PaeEnabled :
1
;
USHORT KiBugCheckRecoveryActive :
1
;
/
/
Windows
10
Manganese Addition
USHORT PagingLevels :
4
;
/
/
/
/
Address of the kernel callout routine.
/
/
ULONG64 KiCallUserMode;
/
/
kernel routine
/
/
/
/
Address of the usermode entry point
for
callbacks.
/
/
ULONG64 KeUserCallbackDispatcher;
/
/
address
in
ntdll
/
/
/
/
Addresses of various kernel data structures
and
lists
/
/
that are of interest to the kernel debugger.
/
/
ULONG64 PsLoadedModuleList;
ULONG64 PsActiveProcessHead;
ULONG64 PspCidTable;
ULONG64 ExpSystemResourcesList;
ULONG64 ExpPagedPoolDescriptor;
ULONG64 ExpNumberOfPagedPools;
ULONG64 KeTimeIncrement;
ULONG64 KeBugCheckCallbackListHead;
ULONG64 KiBugcheckData;
ULONG64 IopErrorLogListHead;
ULONG64 ObpRootDirectoryObject;
ULONG64 ObpTypeObjectType;
ULONG64 MmSystemCacheStart;
ULONG64 MmSystemCacheEnd;
ULONG64 MmSystemCacheWs;
ULONG64 MmPfnDatabase;
ULONG64 MmSystemPtesStart;
ULONG64 MmSystemPtesEnd;
ULONG64 MmSubsectionBase;
ULONG64 MmNumberOfPagingFiles;
ULONG64 MmLowestPhysicalPage;
ULONG64 MmHighestPhysicalPage;
ULONG64 MmNumberOfPhysicalPages;
ULONG64 MmMaximumNonPagedPoolInBytes;
ULONG64 MmNonPagedSystemStart;
ULONG64 MmNonPagedPoolStart;
ULONG64 MmNonPagedPoolEnd;
ULONG64 MmPagedPoolStart;
ULONG64 MmPagedPoolEnd;
ULONG64 MmPagedPoolInformation;
ULONG64 MmPageSize;
ULONG64 MmSizeOfPagedPoolInBytes;
ULONG64 MmTotalCommitLimit;
ULONG64 MmTotalCommittedPages;
ULONG64 MmSharedCommit;
ULONG64 MmDriverCommit;
ULONG64 MmProcessCommit;
ULONG64 MmPagedPoolCommit;
ULONG64 MmExtendedCommit;
ULONG64 MmZeroedPageListHead;
ULONG64 MmFreePageListHead;
ULONG64 MmStandbyPageListHead;
ULONG64 MmModifiedPageListHead;
ULONG64 MmModifiedNoWritePageListHead;
ULONG64 MmAvailablePages;
ULONG64 MmResidentAvailablePages;
ULONG64 PoolTrackTable;
ULONG64 NonPagedPoolDescriptor;
ULONG64 MmHighestUserAddress;
ULONG64 MmSystemRangeStart;
ULONG64 MmUserProbeAddress;
ULONG64 KdPrintCircularBuffer;
ULONG64 KdPrintCircularBufferEnd;
ULONG64 KdPrintWritePointer;
ULONG64 KdPrintRolloverCount;
ULONG64 MmLoadedUserImageList;
/
/
NT
5.1
Addition
ULONG64 NtBuildLab;
ULONG64 KiNormalSystemCall;
/
/
NT
5.0
hotfix addition
ULONG64 KiProcessorBlock;
ULONG64 MmUnloadedDrivers;
ULONG64 MmLastUnloadedDriver;
ULONG64 MmTriageActionTaken;
ULONG64 MmSpecialPoolTag;
ULONG64 KernelVerifier;
ULONG64 MmVerifierData;
ULONG64 MmAllocatedNonPagedPool;
ULONG64 MmPeakCommitment;
ULONG64 MmTotalCommitLimitMaximum;
ULONG64 CmNtCSDVersion;
/
/
NT
5.1
Addition
ULONG64 MmPhysicalMemoryBlock;
ULONG64 MmSessionBase;
ULONG64 MmSessionSize;
ULONG64 MmSystemParentTablePage;
/
/
Server
2003
addition
ULONG64 MmVirtualTranslationBase;
USHORT OffsetKThreadNextProcessor;
USHORT OffsetKThreadTeb;
USHORT OffsetKThreadKernelStack;
USHORT OffsetKThreadInitialStack;
USHORT OffsetKThreadApcProcess;
USHORT OffsetKThreadState;
USHORT OffsetKThreadBStore;
USHORT OffsetKThreadBStoreLimit;
USHORT SizeEProcess;
USHORT OffsetEprocessPeb;
USHORT OffsetEprocessParentCID;
USHORT OffsetEprocessDirectoryTableBase;
USHORT SizePrcb;
USHORT OffsetPrcbDpcRoutine;
USHORT OffsetPrcbCurrentThread;
USHORT OffsetPrcbMhz;
USHORT OffsetPrcbCpuType;
USHORT OffsetPrcbVendorString;
USHORT OffsetPrcbProcStateContext;
USHORT OffsetPrcbNumber;
USHORT SizeEThread;
UCHAR L1tfHighPhysicalBitIndex;
/
/
Windows
10
19H1
Addition
UCHAR L1tfSwizzleBitIndex;
/
/
Windows
10
19H1
Addition
ULONG Padding0;
ULONG64 KdPrintCircularBufferPtr;
ULONG64 KdPrintBufferSize;
ULONG64 KeLoaderBlock;
USHORT SizePcr;
USHORT OffsetPcrSelfPcr;
USHORT OffsetPcrCurrentPrcb;
USHORT OffsetPcrContainedPrcb;
USHORT OffsetPcrInitialBStore;
USHORT OffsetPcrBStoreLimit;
USHORT OffsetPcrInitialStack;
USHORT OffsetPcrStackLimit;
USHORT OffsetPrcbPcrPage;
USHORT OffsetPrcbProcStateSpecialReg;
USHORT GdtR0Code;
USHORT GdtR0Data;
USHORT GdtR0Pcr;
USHORT GdtR3Code;
USHORT GdtR3Data;
USHORT GdtR3Teb;
USHORT GdtLdt;
USHORT GdtTss;
USHORT Gdt64R3CmCode;
USHORT Gdt64R3CmTeb;
ULONG64 IopNumTriageDumpDataBlocks;
ULONG64 IopTriageDumpDataBlocks;
/
/
Longhorn addition
ULONG64 VfCrashDataBlock;
ULONG64 MmBadPagesDetected;
ULONG64 MmZeroedPageSingleBitErrorsDetected;
/
/
Windows
7
addition
ULONG64 EtwpDebuggerData;
USHORT OffsetPrcbContext;
/
/
Windows
8
addition
USHORT OffsetPrcbMaxBreakpoints;
USHORT OffsetPrcbMaxWatchpoints;
ULONG OffsetKThreadStackLimit;
ULONG OffsetKThreadStackBase;
ULONG OffsetKThreadQueueListEntry;
ULONG OffsetEThreadIrpList;
USHORT OffsetPrcbIdleThread;
USHORT OffsetPrcbNormalDpcState;
USHORT OffsetPrcbDpcStack;
USHORT OffsetPrcbIsrStack;
USHORT SizeKDPC_STACK_FRAME;
/
/
Windows
8.1
Addition
USHORT OffsetKPriQueueThreadListHead;
USHORT OffsetKThreadWaitReason;
/
/
Windows
10
RS1 Addition
USHORT Padding1;
ULONG64 PteBase;
/
/
Windows
10
RS5 Addition
ULONG64 RetpolineStubFunctionTable;
ULONG RetpolineStubFunctionTableSize;
ULONG RetpolineStubOffset;
ULONG RetpolineStubSize;
/
/
Windows
10
Iron Addition
USHORT OffsetEProcessMmHotPatchContext;
} KDDEBUGGER_DATA64,
*
PKDDEBUGGER_DATA64;
typedef struct _DBGKD_GET_VERSION64 {
USHORT MajorVersion;
USHORT MinorVersion;
USHORT ProtocolVersion;
USHORT Flags;
USHORT MachineType;
UCHAR MaxPacketType;
UCHAR MaxStateChange;
UCHAR MaxManipulate;
UCHAR Simulation;
USHORT Unused[
1
];
ULONG64 KernBase;
ULONG64 PsLoadedModuleList;
PKDDEBUGGER_DATA64 DebuggerDataList;
} DBGKD_GET_VERSION64,
*
PDBGKD_GET_VERSION64;
typedef enum _SYSDBG_COMMAND {
SysDbgQueryModuleInformation,
SysDbgQueryTraceInformation,
SysDbgSetTracepoint,
SysDbgSetSpecialCall,
SysDbgClearSpecialCalls,
SysDbgQuerySpecialCalls,
SysDbgBreakPoint,
SysDbgQueryVersion,
SysDbgReadVirtual,
SysDbgWriteVirtual,
SysDbgReadPhysical,
SysDbgWritePhysical,
SysDbgReadControlSpace,
SysDbgWriteControlSpace,
SysDbgReadIoSpace,
SysDbgWriteIoSpace,
SysDbgReadMsr,
SysDbgWriteMsr,
SysDbgReadBusData,
SysDbgWriteBusData,
SysDbgCheckLowMemory,
SysDbgEnableKernelDebugger,
SysDbgDisableKernelDebugger,
SysDbgGetAutoKdEnable,
SysDbgSetAutoKdEnable,
SysDbgGetPrintBufferSize,
SysDbgSetPrintBufferSize,
SysDbgGetKdUmExceptionEnable,
SysDbgSetKdUmExceptionEnable,
SysDbgGetTriageDump,
SysDbgGetKdBlockEnable,
SysDbgSetKdBlockEnable,
} SYSDBG_COMMAND,
*
PSYSDBG_COMMAND;
NTKERNELAPI
NTSTATUS
KdSystemDebugControl(
__in SYSDBG_COMMAND Command,
__inout_bcount_opt(InputBufferLength) PVOID InputBuffer,
__in ULONG InputBufferLength,
__out_bcount(OutputBufferLength) PVOID OutputBuffer,
__out_opt ULONG OutputBufferLength,
__out_opt PULONG ReturnLength,
__in KPROCESSOR_MODE PreviousMode
);
NTSTATUS DriverUnload(PDRIVER_OBJECT pDriver)
{
return
STATUS_SUCCESS;
}
VOID GetKdVersionBlock(PDBGKD_GET_VERSION64 KdVersionBlock)
{
KdBreakPoint();
KdSystemDebugControl
(
SysDbgQueryVersion,
NULL,
0
,
KdVersionBlock,
sizeof(DBGKD_GET_VERSION64),
NULL,
UserMode
);
}
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
/
通过KdSystemDebugControl定位KDDEBUGGER_DATA64
/
/
/
/
/
/
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pReg)
{
PDBGKD_GET_VERSION64 VersionBlock
=
ExAllocatePool(NonPagedPool, sizeof(DBGKD_GET_VERSION64));
GetKdVersionBlock(VersionBlock);
KDDEBUGGER_DATA64
*
KdDebugData64
=
*
(KDDEBUGGER_DATA64
*
*
)VersionBlock
-
>DebuggerDataList;
KdPrint((
"PspCidTable:%p KernBase:%p"
,
*
(ULONG64
*
)KdDebugData64
-
>PspCidTable, VersionBlock
-
>KernBase));
ExFreePool(VersionBlock);
pDriver
-
>DriverUnload
=
DriverUnload;
return
STATUS_SUCCESS;
}
typedef struct _DBGKD_DEBUG_DATA_HEADER64 {
/
/
/
/
Link to other blocks
/
/
LIST_ENTRY64
List
;
/
/
/
/
This
is
a unique tag to identify the owner of the block.
/
/
If your component only uses one pool tag, use it
for
this, too.
/
/
ULONG OwnerTag;
/
/
/
/
This must be initialized to the size of the data block,
/
/
including this structure.
/
/
ULONG Size;
} DBGKD_DEBUG_DATA_HEADER64,
*
PDBGKD_DEBUG_DATA_HEADER64;
typedef struct _KDDEBUGGER_DATA64 {
DBGKD_DEBUG_DATA_HEADER64 Header;
/
/
/
/
Base address of kernel image
/
/
ULONG64 KernBase;
/
/
/
/
DbgBreakPointWithStatus
is
a function which takes an argument
/
/
and
hits a breakpoint. This field contains the address of the
/
/
breakpoint instruction. When the debugger sees a breakpoint
/
/
at this address, it may retrieve the argument
from
the first
/
/
argument register,
or
on x86 the eax register.
/
/
ULONG64 BreakpointWithStatus;
/
/
address of breakpoint
/
/
/
/
Address of the saved context record during a bugcheck
/
/
/
/
N.B. This
is
an automatic
in
KeBugcheckEx's frame,
and
/
/
is
only valid after a bugcheck.
/
/
ULONG64 SavedContext;
/
/
/
/
help
for
walking stacks with user callbacks:
/
/
/
/
/
/
The address of the thread structure
is
provided
in
the
/
/
WAIT_STATE_CHANGE packet. This
is
the offset
from
the base of
/
/
the thread structure to the pointer to the kernel stack frame
/
/
for
the currently active usermode callback.
/
/
USHORT ThCallbackStack;
/
/
offset
in
thread data
/
/
/
/
these values are offsets into that frame:
/
/
USHORT NextCallback;
/
/
saved pointer to
next
callback frame
USHORT FramePointer;
/
/
saved frame pointer
/
/
/
/
pad to a quad boundary
/
/
USHORT PaeEnabled :
1
;
USHORT KiBugCheckRecoveryActive :
1
;
/
/
Windows
10
Manganese Addition
USHORT PagingLevels :
4
;
/
/
/
/
Address of the kernel callout routine.
/
/
ULONG64 KiCallUserMode;
/
/
kernel routine
/
/
/
/
Address of the usermode entry point
for
callbacks.
/
/
ULONG64 KeUserCallbackDispatcher;
/
/
address
in
ntdll
/
/
/
/
Addresses of various kernel data structures
and
lists
/
/
that are of interest to the kernel debugger.
/
/
ULONG64 PsLoadedModuleList;
ULONG64 PsActiveProcessHead;
ULONG64 PspCidTable;
ULONG64 ExpSystemResourcesList;
ULONG64 ExpPagedPoolDescriptor;
ULONG64 ExpNumberOfPagedPools;
ULONG64 KeTimeIncrement;
ULONG64 KeBugCheckCallbackListHead;
ULONG64 KiBugcheckData;
ULONG64 IopErrorLogListHead;
ULONG64 ObpRootDirectoryObject;
ULONG64 ObpTypeObjectType;
ULONG64 MmSystemCacheStart;
ULONG64 MmSystemCacheEnd;
ULONG64 MmSystemCacheWs;
ULONG64 MmPfnDatabase;
ULONG64 MmSystemPtesStart;
ULONG64 MmSystemPtesEnd;
ULONG64 MmSubsectionBase;
ULONG64 MmNumberOfPagingFiles;
ULONG64 MmLowestPhysicalPage;
ULONG64 MmHighestPhysicalPage;
ULONG64 MmNumberOfPhysicalPages;
ULONG64 MmMaximumNonPagedPoolInBytes;
ULONG64 MmNonPagedSystemStart;
ULONG64 MmNonPagedPoolStart;
ULONG64 MmNonPagedPoolEnd;
ULONG64 MmPagedPoolStart;
ULONG64 MmPagedPoolEnd;
ULONG64 MmPagedPoolInformation;
ULONG64 MmPageSize;
ULONG64 MmSizeOfPagedPoolInBytes;
ULONG64 MmTotalCommitLimit;
ULONG64 MmTotalCommittedPages;
ULONG64 MmSharedCommit;
ULONG64 MmDriverCommit;
ULONG64 MmProcessCommit;
ULONG64 MmPagedPoolCommit;
ULONG64 MmExtendedCommit;
ULONG64 MmZeroedPageListHead;
ULONG64 MmFreePageListHead;
ULONG64 MmStandbyPageListHead;
ULONG64 MmModifiedPageListHead;
ULONG64 MmModifiedNoWritePageListHead;
ULONG64 MmAvailablePages;
ULONG64 MmResidentAvailablePages;
ULONG64 PoolTrackTable;
ULONG64 NonPagedPoolDescriptor;
ULONG64 MmHighestUserAddress;
ULONG64 MmSystemRangeStart;
ULONG64 MmUserProbeAddress;
ULONG64 KdPrintCircularBuffer;
ULONG64 KdPrintCircularBufferEnd;
ULONG64 KdPrintWritePointer;
ULONG64 KdPrintRolloverCount;
ULONG64 MmLoadedUserImageList;
/
/
NT
5.1
Addition
ULONG64 NtBuildLab;
ULONG64 KiNormalSystemCall;
/
/
NT
5.0
hotfix addition
ULONG64 KiProcessorBlock;
ULONG64 MmUnloadedDrivers;
ULONG64 MmLastUnloadedDriver;
ULONG64 MmTriageActionTaken;
ULONG64 MmSpecialPoolTag;
ULONG64 KernelVerifier;
ULONG64 MmVerifierData;
ULONG64 MmAllocatedNonPagedPool;
ULONG64 MmPeakCommitment;
ULONG64 MmTotalCommitLimitMaximum;
ULONG64 CmNtCSDVersion;
/
/
NT
5.1
Addition
ULONG64 MmPhysicalMemoryBlock;
ULONG64 MmSessionBase;
ULONG64 MmSessionSize;
ULONG64 MmSystemParentTablePage;
/
/
Server
2003
addition
ULONG64 MmVirtualTranslationBase;
USHORT OffsetKThreadNextProcessor;
USHORT OffsetKThreadTeb;
USHORT OffsetKThreadKernelStack;
USHORT OffsetKThreadInitialStack;
USHORT OffsetKThreadApcProcess;
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
最后于 2021-12-2 18:32
被zx_687333编辑
,原因: