调试某驱动

写个驱动,观察某驱动的运行,学学驱动而已。先注册映像加载通知例程。

PsSetLoadImageNotifyRoutine(LoadImageNotify);

VOID LoadImageNotify (
	PUNICODE_STRING FullImageName, 
	HANDLE ProcessId, 
	PIMAGE_INFO ImageInfo
	)
{
	ANSI_STRING	asImageName;
	PCHAR		Delimiter;
	NTSTATUS	Status;
	ULONG		Base;
	ULONG		Entry;
	ULONG		Patch;
	ULONG		i;
	
	
	RtlUnicodeStringToAnsiString(&asImageName, FullImageName, TRUE);
	
	if (!ImageInfo->SystemModeImage)
	{
		goto __End; //不是驱动
	}
	
	Delimiter = strrchr(asImageName.Buffer, '\\');
	if (Delimiter == NULL)
		goto __End;
	
	Delimiter++;
	
	if( _strnicmp(Delimiter,"xxx.sys",strlen("xxx.sys")) != 0)
		goto __End;

	Base = (ULONG)ImageInfo->ImageBase;
				
	DbgPrint("%s Loaded, MappingAddress=%08X, Size=%08X\n",
		 asImageName.Buffer,
		 ImageInfo->ImageBase,
		 ImageInfo->ImageSize );
	

	//这里地址直接硬编码了,可以分析PE文件及使用反汇编引擎(原代码的地址删了,表找我麻烦)

	// 原驱动DriverEntry出口:
	// 	leave
	// 	retn    8
	// 	
	// 	

	Entry = Base + 0x1111;
	Patch = Base + 0x2222;
	g_ReturnAddress = Base + 0x3333;

	if (!(*(PULONG)Entry == 0x83EC8B55 &&  *(PUCHAR)(Entry+5) == 0x14)) //检查Entry
	{
		DbgPrint("Mismatched Entry!\n");
		goto __End;
	}

	if (*(PULONG)Patch != 0x0008C2C9)
	{
		DbgPrint("Mismatched Patch Point!\n");
		goto __End;
	}

	__asm
	{
		CLI
		MOV   EAX, CR0
		AND   EAX, NOT 10000H	//disable WP bit
		MOV   CR0, EAX
	}

	*(PUCHAR)Entry = 0xE9;
	*(PULONG)(Entry+1) = (ULONG)&SaveDriverObject - (Entry+5);

	*(PUCHAR)Patch = 0xE9;
	*(PULONG)(Patch+1) = (ULONG)&ReplaceDispatch - (Patch+5);
	

	__asm
	{
		MOV   EAX, CR0
		OR    EAX, 10000H	//enable WP bit
		MOV   CR0, EAX
		STI
	}
	
__End:
	RtlFreeAnsiString(&asImageName);
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)