能够支持Driver加壳的软件还是很少很少的
貌似除了vmp cv之外就没有了
vmp cv都是基于代码加密理念的 因此移植到驱动下面不是什么困难的事情
驱动加密壳实现了代码加密已经足够，毕竟 公开的驱动dump高端内存dump到文件的东东偶还没看见过

偶想实现的东东是DriverUpx，众所周知
upx是把pe文件完整压缩了保存起来，从而可以实现完美自身脱壳回来
偶也想实现这个功能 申请1块内存 将驱动文件完整释放 自己处理重定位 输入表
最后建立线程执行driverentry

每个加壳软件都有他关键的几个api
GetModuleHandle
GetProcAddress
LoadLibrary
我们将一一实现他们

先别急着实现stub，我们先的准备好packer
packer的目的是压缩sys文件 并且组装到stub指定地方
驱动有个东西必须处理
驱动程序被加壳后必须重新进行校验和的计算，否则加壳后的驱动不能加载
这个功能我们在r3下面完成

/*++

Routine Description:

   Calculates a new checksum for the PE image by calling imagehlp.dll

Arguments:

   szPeFile - PE file name

Return Value:

   void

--*/
void
CalcChecksum(
   char *szPeFile
   )
{
   DWORD              dwHeaderSum = 0;
   DWORD              dwCheckSum = 0;
   HANDLE             hFile;
   DWORD              cb;
   IMAGE_DOS_HEADER   dosHdr;
   IMAGE_NT_HEADERS   ntHdr;

   //
   // Open the file and calculate the CheckSum
   //
   if( MapFileAndCheckSum(szPeFile, &dwHeaderSum, &dwCheckSum) != CHECKSUM_SUCCESS )
   {
      printf("Failed to open specified PE file!\n");
      return;
   }
   hFile = CreateFile( szPeFile,
                  GENERIC_READ | GENERIC_WRITE,
                  FILE_SHARE_READ | FILE_SHARE_WRITE,
                  NULL,
                  OPEN_EXISTING,
                  0,
                  NULL
                 );
   if( hFile == INVALID_HANDLE_VALUE )
   {
      printf("Failed to open specified PE file!\n");
      return;
   }

   //
   // Seek to the beginning of the file
   //
   SetFilePointer( hFile, 0, 0, FILE_BEGIN );

   //
   // Read in the DOS header
   //
   if( (ReadFile(hFile, &dosHdr, sizeof(dosHdr), &cb, 0) == FALSE)
      || (cb != sizeof(dosHdr)) )
   {
      printf("Failed to read DOS header!\n");
      CloseHandle(hFile);
      return;
   }

   //
   // Seek the PE header
   //
   if( (dosHdr.e_magic != IMAGE_DOS_SIGNATURE) ||
      (SetFilePointer(hFile, dosHdr.e_lfanew, 0, FILE_BEGIN) == -1L) )
   {
      printf("Failed to read NT header!\n");
      CloseHandle(hFile);
      return;
   }

   //
   // Read in the NT header
   //
   if( (!ReadFile(hFile, &ntHdr, sizeof(ntHdr), &cb, 0))
      || (cb != sizeof(ntHdr)) )
   {
      printf("Failed to read NT header!\n");
      CloseHandle(hFile);
      return;
   }

   //
   // Search the PE sisnature
   //
   if(ntHdr.Signature != IMAGE_NT_SIGNATURE)
   {
      printf("The file is not a valid PE file!\n");
      CloseHandle(hFile);
      return;
   }

   //
   // Check if the PE file's checksum need adjusted
   //
   if(ntHdr.OptionalHeader.CheckSum == dwCheckSum)
   {
      printf("The PE file CheckSum needn't to be adjusted\n");
      CloseHandle(hFile);
      return;
   }

   //
   // Seek the PE header
   //
   if( SetFilePointer(hFile, dosHdr.e_lfanew, 0, FILE_BEGIN) == -1L )
   {
      printf("Failed to locate PE header!\n");
      CloseHandle(hFile);
      return;
   }

   printf("Old Checksum = 0x%08X\n", ntHdr.OptionalHeader.CheckSum);
   printf("New Checksum = 0x%08X\n", dwCheckSum);

   //
   // Modify the CheckSum
   //
   ntHdr.OptionalHeader.CheckSum = dwCheckSum;
   if( !WriteFile(hFile, &ntHdr, sizeof(ntHdr), &cb, NULL) )
   {
      printf("Failed to Adjust Checksum!\n");
   }
   else
   {
      printf("Adjust Checksum successfully!\n");
   }

   CloseHandle(hFile);
   return;
}

PVOID GetModuleHandle(char *pModuleName)
{
    PVOID pModuleBase = NULL;
    ULONG i;

    PSYSTEM_MODULE_INFORMATION ModulesInfo = (PSYSTEM_MODULE_INFORMATION)GetSysInf(SystemModuleInformation);
    if (ModulesInfo == NULL)
        return NULL;

    if (!strcmp(pModuleName, "ntoskrnl.exe"))
    {
        pModuleBase = (PVOID)ModulesInfo->aSM[0].Base;
    } else {
        for (i = 0; i < ModulesInfo->uCount; i++)
        {
            if (strstr(ModulesInfo->aSM.ImageName, pModuleName))
                pModuleBase = (PVOID)ModulesInfo->aSM.Base;
        }
    }

    ExFreePool(ModulesInfo);

    return pModuleBase;
}
PVOID GetProcAddress(PVOID ModuleBase, char *pFunctionName)
{
    PVOID pFunctionAddress = NULL;
    PIMAGE_EXPORT_DIRECTORY exports;
    ULONG i, addr, ord, size = 0;
    PULONG names, functions;
    PSHORT ordinals;

    if (ModuleBase == NULL)
        return NULL;

    __try
    {
        exports = (PIMAGE_EXPORT_DIRECTORY)RtlImageDirectoryEntryToData(ModuleBase,
            TRUE, IMAGE_DIRECTORY_ENTRY_EXPORT, &size);

        addr = (ULONG)exports - (ULONG)ModuleBase;

        functions = (PULONG)((ULONG)ModuleBase + exports->AddressOfFunctions);
        ordinals  = (PSHORT)((ULONG)ModuleBase + exports->AddressOfNameOrdinals);
        names    = (PULONG)((ULONG)ModuleBase + exports->AddressOfNames);

        for (i = 0; i < exports->NumberOfNames; i++)
        {
            ord = ordinals;

            if (i >= exports->NumberOfNames || ord >= exports->NumberOfFunctions)
                return NULL;

            if (functions[ord] < addr || functions[ord] >= addr + size)
            {
                if (strcmp((char *)((ULONG)ModuleBase + names), pFunctionName)  == 0)
                {
                    pFunctionAddress =(PVOID)((ULONG)ModuleBase + functions[ord]);
                    break;
                }
            }
        }
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        DbgMsg("KernelGetProcAddress() EXEPTION\n");
        pFunctionAddress = NULL;
    }

    return pFunctionAddress;
}
PVOID GetSysInf(SYSTEMINFOCLASS pdData)
{
    NTSTATUS ns;
    ULONG dSize = 4096;
    ULONG dData = 0;
    PVOID shi;

    do {
        shi = ExAllocatePool(NonPagedPool, dSize);

        if (shi == NULL) return 0;

        ns = ZwQuerySystemInformation(pdData, shi, dSize, &dData);

        if (ns == STATUS_INFO_LENGTH_MISMATCH)
        {
            ExFreePool(shi);
            dSize *= 2;
        }
           
    } while (ns != 0);
   
    return shi;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！