首页
社区
课程
招聘
[求助]用 NtUnmapViewOfSection 为何结束不了模块?
发表于: 2009-6-15 15:02 6987

[求助]用 NtUnmapViewOfSection 为何结束不了模块?

2009-6-15 15:02
6987
FunctionAddress = GetDllFunctionAddress("NtUnmapViewOfSection",&DllName);
        pos = *((WORD*)(FunctionAddress+1));
        ntUnmapViewOfSection = (NtUnmapViewOfSection)(KeServiceDescriptorTable->ServiceTableBase[pos]);
        ntUnmapViewOfSection(hProcess,(LPVOID)BaseAddress);

为什么ntUnmapViewOfSection结束不了进程中的模块!
GetDllFunctionAddress函数如下:

DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)
{
        HANDLE hThread, hSection, hFile, hMod;
        SECTION_IMAGE_INFORMATION sii;
        IMAGE_DOS_HEADER* dosheader;
        IMAGE_OPTIONAL_HEADER* opthdr;
        IMAGE_EXPORT_DIRECTORY* pExportTable;
        DWORD* arrayOfFunctionAddresses;
        DWORD* arrayOfFunctionNames;
        WORD* arrayOfFunctionOrdinals;
        DWORD functionOrdinal;
        DWORD Base, x, functionAddress;
        char* functionName;
        STRING ntFunctionName, ntFunctionNameSearch;
        PVOID BaseAddress = NULL;
        SIZE_T size=0;

        OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};

        IO_STATUS_BLOCK iosb;

        //_asm int 3;
        ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);

        oa.ObjectName = 0;

        ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);

        ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);

        ZwClose(hFile);

        hMod = BaseAddress;

        dosheader = (IMAGE_DOS_HEADER *)hMod;

        opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);

        pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);

        // now we can get the exported functions, but note we convert from RVA to address
        arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);

        arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);

        arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);

        Base = pExportTable->Base;

        RtlInitString(&ntFunctionNameSearch, lpFunctionName);

        for(x = 0; x < pExportTable->NumberOfFunctions; x++)
        {
                functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);

                RtlInitString(&ntFunctionName, functionName);

                functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0
                // this is the funny bit. you would expect the function pointer to simply be arrayOfFunctionAddresses[x]...
                // oh no... thats too simple. it is actually arrayOfFunctionAddresses[functionOrdinal]!!
                functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);
                if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)
                {
                        ZwClose(hSection);
                        return functionAddress;
                }
        }

        ZwClose(hSection);
        return 0;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 290
活跃值: (20)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
2
如果排除被HOOK的可能那么你看看这里

nt!NtUnmapViewOfSection:
805b27d4 8bff            mov     edi,edi
805b27d6 55              push    ebp
805b27d7 8bec            mov     ebp,esp
805b27d9 51              push    ecx
805b27da 56              push    esi
805b27db 64a124010000    mov     eax,dword ptr fs:[00000124h]
805b27e1 8a8040010000    mov     al,byte ptr [eax+140h]
805b27e7 3c01            cmp     al,1
805b27e9 8b750c          mov     esi,dword ptr [ebp+0Ch]
805b27ec 8845fc          mov     byte ptr [ebp-4],al
805b27ef 750f            jne     nt!NtUnmapViewOfSection+0x2c (805b2800)
805b27f1 3b351c215680    cmp     esi,dword ptr [nt!MmHighestUserAddress (8056211c)]
2009-6-15 15:08
0
雪    币: 211
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
用这个MmUnmapViewOfSection 结束成功了!!
2009-6-15 15:44
0
雪    币: 290
活跃值: (20)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
4
有两种情况
第一你调用函数的地方是在dispatch里没有设置KernelMode
第二NtUnmapViewOfSection已经被挂钩了
2009-6-15 15:58
0
游客
登录 | 注册 方可回帖
返回
//