UCHAR
*
GetEtwpMaxPmcCounter()
{
UCHAR
*
Ret
=
0
;
LONG64 KernelBase
=
0
;
UNICODE_STRING KernelModuleName;
UCHAR FeaturesCode[]
=
{
0x44
,
0x3b
,
0x05
,
'*'
,
'*'
,
'*'
,
'*'
,
0x0f
,
0x87
,
'*'
,
'*'
,
'*'
,
'*'
,
0x83
,
0xb9
,
'*'
,
'*'
,
'*'
,
'*'
,
0x01
,
0x0f
,
0x84
,
'*'
,
'*'
,
'*'
,
'*'
,
0x48
,
0x83
,
0xb9
,
'*'
,
'*'
,
'*'
,
'*'
,
0x00
,
0x75
,
'*'
};
UCHAR SectionNames[]
=
{
'P'
,
'A'
,
'G'
,
'E'
,
0
,
0
,
0
,
0
};
RtlInitUnicodeString(&KernelModuleName, L
"ntoskrnl.exe"
);
KernelBase
=
HookInfo
-
>OsKernelLoadBase;
if
(!KernelBase)
{
DbgPrint(
"get kernel module base fail\n"
);
return
0
;
}
IMAGE_FILE_HEADER
*
FileHeader
=
KernelBase
+
((IMAGE_DOS_HEADER
*
)KernelBase)
-
>e_lfanew
+
4
;
USHORT SectionCount
=
FileHeader
-
>NumberOfSections;
IMAGE_OPTIONAL_HEADER64
*
OptionalHeader
=
FileHeader
+
1
;
IMAGE_SECTION_HEADER
*
SectionHeader
=
OptionalHeader
+
1
;
LONG64 StratAdd
=
0
;
LONG64 EndAdd
=
0
;
for
(
int
i
=
0
; i < SectionCount;
+
+
i)
{
if
(RtlCompareMemory(&(SectionHeader[i].Name), SectionNames,
8
)
=
=
8
)
{
StratAdd
=
SectionHeader[i].VirtualAddress
+
KernelBase;
EndAdd
=
((LONG64)(SectionHeader[i].Misc.VirtualSize &
0xfffff000
))
+
0x1000
+
StratAdd;
if
(SearchFunctionOfCharacteristicCode(FeaturesCode,
36
,
StratAdd,
EndAdd,
&Ret)
=
=
STATUS_SUCCESS)
{
return
(
*
((PULONG)(Ret
+
3
)))
+
((LONG64)Ret
+
7
);
}
break
;
}
}
return
0
;
}
NTSTATUS SetPmcCounts()
{
NTSTATUS state
=
STATUS_UNSUCCESSFUL;
if
(!HookInfo
-
>EtwOffNo)
{
return
state;
}
PETW_PMC_INFO PmcInfo
=
ExAllocatePool(PagedPool,
0X1000
);
if
(!PmcInfo)
{
DbgPrint(
"Allocate PmcInfo fail!\n"
);
return
state;
}
PmcInfo
-
>EventTraceInformationClass
=
EventTraceProfileCounterListInformation;
PmcInfo
-
>TraceHandle
=
2
;
PmcInfo
-
>ProfileSource[
0
]
=
1
;
UCHAR
*
EtwPmcMaxCount
=
GetEtwpMaxPmcCounter();
UCHAR
*
OrgMaxCount
=
0
;
if
(EtwPmcMaxCount)
{
OrgMaxCount
=
*
EtwPmcMaxCount;
if
(OrgMaxCount <
=
1
)
*
EtwPmcMaxCount
=
2
;
}
state
=
ZwSetSystemInformation(SystemPerformanceTraceInformation, PmcInfo, sizeof(ETW_PMC_INFO));
if
(!NT_SUCCESS(state))
{
DbgPrint(
"pmc open fail\n"
);
return
state;
}
if
(EtwPmcMaxCount)
{
if
(OrgMaxCount <
=
1
)
*
EtwPmcMaxCount
=
OrgMaxCount;
}
PETW_SYSTEM_TRACE SysEventTraceInfo
=
ExAllocatePool(PagedPool,
0x1000
);
if
(!SysEventTraceInfo)
{
DbgPrint(
"allocate System Event Trace info fail\r\n"
);
return
STATUS_UNSUCCESSFUL;
}
SysEventTraceInfo
-
>EventTraceInformationClass
=
EventTraceProfileEventListInformation;
SysEventTraceInfo
-
>TraceHandle
=
2
;
SysEventTraceInfo
-
>HookId[
0
]
=
HookInfo
-
>SyscallHookId;
state
=
ZwSetSystemInformation(SystemPerformanceTraceInformation, SysEventTraceInfo, sizeof(ETW_SYSTEM_TRACE));
if
(!NT_SUCCESS(state))
{
DbgPrint(
"failed to configure pmc event,errcode=%x\r\n"
, state);
return
state;
}
if
(SysEventTraceInfo)ExFreePool(SysEventTraceInfo);
if
(PmcInfo)ExFreePool(PmcInfo);
return
state;
}