生活随笔
收集整理的這篇文章主要介紹了
SSDT表的遍历（源码）
小編覺得挺不錯的,現(xiàn)在分享給大家,幫大家做個參考.
?? ?? ?? ?? ?? #ifndef?_WIN32_WINNT????????//?Allow?use?of?features?specific?to?Windows?XP?or?later.????????????????????? #define?_WIN32_WINNT?0x0501?//?Change?this?to?the?appropriate?value?to?target?other?versions?of?Windows.?? #endif???????????????????????? ?? #ifdef?__cplusplus?? extern?"C"??? {?? ?? #endif?? ?? #include?<ntddk.h>?? #include?<ntddstor.h>?? #include?<mountdev.h>?? #include?<ntddvol.h>?? ?? ?? ?? ?? #pragma?pack(1)?? typedef?struct?_ServiceDescriptorTable?? {?? ?????? ????PVOID?ServiceTableBase;???????? ?????? ????PVOID?ServiceCounterTable;??? ?????? ????unsigned?int?NumberOfServices;???? ?????? ????PVOID?ParamTableBase;??? }*PServiceDescriptorTable;???? #pragma?pack()?? ?? ?? extern??PServiceDescriptorTable??KeServiceDescriptorTable;??? ?? #ifdef?__cplusplus?? }?? #endif?? ?? ?? ?? ?? #include?"stdafx.h"?? ?? ?? ?? ?? void?ReadSsdtForFuntionUnload(IN?PDRIVER_OBJECT?DriverObject);?? NTSTATUS?ReadSsdtForFuntionCreateClose(IN?PDEVICE_OBJECT?DeviceObject,?IN?PIRP?Irp);?? NTSTATUS?ReadSsdtForFuntionDefaultHandler(IN?PDEVICE_OBJECT?DeviceObject,?IN?PIRP?Irp);?? ?? ?? LONG?GetFunctionAddr_ASM(PServiceDescriptorTable?KeServiceDescriptorTable,?LONG?lgSsdtIndex);?? ?? ?? LONG?GetFunticonAddr(PServiceDescriptorTable?KeServiceDescriptorTable,?LONG?lgSsdtIndex);?? ?? ?? #ifdef?__cplusplus?? extern?"C"?NTSTATUS?DriverEntry(IN?PDRIVER_OBJECT?DriverObject,?IN?PUNICODE_STRING??RegistryPath);?? #endif?? ?? NTSTATUS?DriverEntry(IN?PDRIVER_OBJECT?DriverObject,?IN?PUNICODE_STRING??RegistryPath)?? {?? ????UNICODE_STRING?DeviceName,Win32Device;?? ????PDEVICE_OBJECT?DeviceObject?=?NULL;?? ????NTSTATUS?status;?? ????unsigned?i;?? ?? ?????? ????LONG?lgSsdtNumber?=?-1;?? ?? ????RtlInitUnicodeString(&DeviceName,L"\\Device\\ReadSsdtForFuntion0");?? ????RtlInitUnicodeString(&Win32Device,L"\\DosDevices\\ReadSsdtForFuntion0");?? ?? ?????? ????for?(i?=?0;?i?<=?IRP_MJ_MAXIMUM_FUNCTION;?i++)?? ????????DriverObject->MajorFunction[i]?=?ReadSsdtForFuntionDefaultHandler;?? ?? ?????? ????DriverObject->MajorFunction[IRP_MJ_CREATE]?=?ReadSsdtForFuntionCreateClose;?? ?????? ????DriverObject->MajorFunction[IRP_MJ_CLOSE]?=?ReadSsdtForFuntionCreateClose;?? ?????? ?????? ????DriverObject->DriverUnload?=?ReadSsdtForFuntionUnload;?? ?? ?????? ????status?=?IoCreateDevice(DriverObject,?? ????????????????????????????0,?? ????????????????????????????&DeviceName,?? ????????????????????????????FILE_DEVICE_UNKNOWN,?? ????????????????????????????0,?? ????????????????????????????FALSE,?? ????????????????????????????&DeviceObject);?? ????if?(!NT_SUCCESS(status))?? ????????return?status;?? ????if?(!DeviceObject)?? ????????return?STATUS_UNEXPECTED_IO_ERROR;?? ?? ????DeviceObject->Flags?|=?DO_DIRECT_IO;?? ????DeviceObject->AlignmentRequirement?=?FILE_WORD_ALIGNMENT;?? ?? ?????? ????status?=?IoCreateSymbolicLink(&Win32Device,?&DeviceName);?? ????if?(!NT_SUCCESS(status))?? ????????return?status;?? ?? ?????? ????DeviceObject->Flags?&=?~DO_DEVICE_INITIALIZING;?? ?? ?????? ????__asm?int?3?? ?? ?????? ????lgSsdtNumber?=?KeServiceDescriptorTable->NumberOfServices;?? ?? ?????? ????KdPrint(("使用方法1.遍歷SSDT\r\n"));?? ????for?(i?=?0;?i?<?lgSsdtNumber;?i++)?? ????{?? ????????KdPrint(("Index:%04X--FunAddr:%08X\r\n",?i,?GetFunctionAddr_ASM(KeServiceDescriptorTable,?i)));?? ????}?? ?? ?????? ????KdPrint(("使用方法2.遍歷SSDT\r\n"));?? ????for?(i?=?0;?i?<?lgSsdtNumber;?i++)?? ????{?? ????????KdPrint(("Index:%04X--FunAddr:%08X\r\n",?i,?GetFunticonAddr(KeServiceDescriptorTable,?i)));?? ????}?? ?? ????return?STATUS_SUCCESS;?? }?? ?? ?? ?? LONG?GetFunctionAddr_ASM(PServiceDescriptorTable?KeServiceDescriptorTable,?LONG?lgSsdtIndex)?? {?? ????LONG?lgSsdtFunAddr?=?0;?? ?? ?????? ????__asm?? ????{?????? ????????push?ebx?? ????????push?eax?? ????????mov?ebx,?KeServiceDescriptorTable?? ????????mov?ebx,?[ebx]???? ????????mov?eax,?lgSsdtIndex?? ????????shl?eax,?2???????? ????????add?ebx,?eax?????????? ????????mov?ebx,?[ebx]?? ????????mov?lgSsdtFunAddr,?ebx?? ????????pop??eax?????? ????????pop??ebx?? ????}?? ?? ????return?lgSsdtFunAddr;?? }?? ?? ?? LONG?GetFunticonAddr(PServiceDescriptorTable?KeServiceDescriptorTable,?LONG?lgSsdtIndex)?? {?? ????LONG?lgSsdtAddr?=?0;?? ?????? ????lgSsdtAddr?=?(LONG)KeServiceDescriptorTable->ServiceTableBase;?? ?? ????PLONG?plgSsdtFunAddr?=?0;??? ?????? ????plgSsdtFunAddr?=?(PLONG)(lgSsdtAddr+lgSsdtIndex*4);?? ?? ?????? ????return?(*plgSsdtFunAddr);????? }?? ?? ?? void?ReadSsdtForFuntionUnload(IN?PDRIVER_OBJECT?DriverObject)?? {?? ????UNICODE_STRING?Win32Device;?? ????RtlInitUnicodeString(&Win32Device,L"\\DosDevices\\ReadSsdtForFuntion0");?? ????IoDeleteSymbolicLink(&Win32Device);?? ????IoDeleteDevice(DriverObject->DeviceObject);?? }?? ?? NTSTATUS?ReadSsdtForFuntionCreateClose(IN?PDEVICE_OBJECT?DeviceObject,?IN?PIRP?Irp)?? {?? ????Irp->IoStatus.Status?=?STATUS_SUCCESS;?? ????Irp->IoStatus.Information?=?0;?? ????IoCompleteRequest(Irp,?IO_NO_INCREMENT);?? ????return?STATUS_SUCCESS;?? }?? ?? NTSTATUS?ReadSsdtForFuntionDefaultHandler(IN?PDEVICE_OBJECT?DeviceObject,?IN?PIRP?Irp)?? {?? ????Irp->IoStatus.Status?=?STATUS_NOT_SUPPORTED;?? ????Irp->IoStatus.Information?=?0;?? ????IoCompleteRequest(Irp,?IO_NO_INCREMENT);?? ????return?Irp->IoStatus.Status;?? }?? ?? ?? ??
總結(jié)
以上是生活随笔為你收集整理的SSDT表的遍历（源码）的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。
