//新人贴,只供自己学习 学习过了的就不要浪费时间
LONGLONG mGetModuleBaseByName(PDRIVER_OBJECT pDriver, UNICODE_STRING moduleName)
{
UNREFERENCED_PARAMETER(moduleName);
PLDR_DATA_TABLE_ENTRY pLdr
=
NULL;
PLIST_ENTRY pListEntry
=
NULL;
PLIST_ENTRY pCurrentListEntry
=
NULL;
PLDR_DATA_TABLE_ENTRY pCurrentModule
=
NULL;
pLdr
=
(PLDR_DATA_TABLE_ENTRY)pDriver
-
>DriverSection;
pListEntry
=
pLdr
-
>InLoadOrderLinks.Flink;
pCurrentListEntry
=
pListEntry
-
>Flink;
while
(pCurrentListEntry !
=
pListEntry)
{
/
/
获取PLDR_DATA_TABLE_ENTRY结构
pCurrentModule
=
CONTAINING_RECORD(pCurrentListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
if
(pCurrentModule
-
>BaseDllName.
Buffer
!
=
nullptr)
{
DbgPrintEx(
0
,
77
,
"ModuleName:%wZ"
, pCurrentModule
-
>BaseDllName);
/
/
比较模块名
if
(RtlCompareUnicodeString(&pCurrentModule
-
>BaseDllName, &moduleName, true)
=
=
0
)
{
return
(LONGLONG)pCurrentModule
-
>DllBase;
}
}
pCurrentListEntry
=
pCurrentListEntry
-
>Flink;
}
return
0
;
}
void UnDriverLoad(DRIVER_OBJECT
*
pDriver)
{
UNREFERENCED_PARAMETER(pDriver);
}
extern
"C"
NTSTATUS DriverEntry(DRIVER_OBJECT
*
pDriver, UNICODE_STRING
*
pRegistryPath)
{
UNREFERENCED_PARAMETER(pRegistryPath);
pDriver
-
>DriverUnload
=
UnDriverLoad;
UNICODE_STRING mName
=
RTL_CONSTANT_STRING(L"");
mGetModuleBaseByName(pDriver, mName);
return
STATUS_SUCCESS;
}
LONGLONG mGetModuleBaseByName(PDRIVER_OBJECT pDriver, UNICODE_STRING moduleName)
{
UNREFERENCED_PARAMETER(moduleName);
PLDR_DATA_TABLE_ENTRY pLdr
=
NULL;
PLIST_ENTRY pListEntry
=
NULL;
PLIST_ENTRY pCurrentListEntry
=
NULL;
PLDR_DATA_TABLE_ENTRY pCurrentModule
=
NULL;
pLdr
=
(PLDR_DATA_TABLE_ENTRY)pDriver
-
>DriverSection;
pListEntry
=
pLdr
-
>InLoadOrderLinks.Flink;
pCurrentListEntry
=
pListEntry
-
>Flink;
while
(pCurrentListEntry !
=
pListEntry)
{
/
/
获取PLDR_DATA_TABLE_ENTRY结构
pCurrentModule
=
CONTAINING_RECORD(pCurrentListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
if
(pCurrentModule
-
>BaseDllName.
Buffer
!
=
nullptr)
{
DbgPrintEx(
0
,
77
,
"ModuleName:%wZ"
, pCurrentModule
-
>BaseDllName);
/
/
比较模块名
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)
最后于 2023-11-20 22:45
被foxkinglxq编辑
,原因: