1. 首頁 > 生活百科 > >

驅動開發：內核枚舉Registry注冊表回調

生活百科

在筆者上一篇文章《驅動開發：內核枚舉LoadImage映像回調》中LyShark教大家實現了枚舉系統回調中的LoadImage通知消息，本章將實現對Registry注冊表通知消息的枚舉，與LoadImage消息不同Registry消息不需要解密只要找到CallbackListHead消息回調鏈表頭并解析為_CM_NOTIFY_ENTRY結構即可實現枚舉 。
我們來看一款閉源ARK工具是如何實現的：

驅動開發：內核枚舉Registry注冊表回調

文章插圖
注冊表系統回調的枚舉需要通過特征碼搜索來實現，首先我們可以定位到uf CmUnRegisterCallback內核函數上，在該內核函數下方存在一個CallbackListHead鏈表節點，取出這個鏈表地址 。
【驅動開發：內核枚舉Registry注冊表回調】
驅動開發：內核枚舉Registry注冊表回調

文章插圖
當得到注冊表鏈表入口0xfffff8063a065bc0直接將其解析為_CM_NOTIFY_ENTRY即可得到數據 ， 如果要遍歷下一個鏈表則只需要ListEntryHead.Flink向下移動指針即可 。
// 署名權// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com// 注冊表回調函數結構體定義typedef struct _CM_NOTIFY_ENTRY{LIST_ENTRYListEntryHead;ULONGUnKnown1;ULONGUnKnown2;LARGE_INTEGER Cookie;PVOIDContext;PVOIDFunction;}CM_NOTIFY_ENTRY, *PCM_NOTIFY_ENTRY;要想得到此處的鏈表地址，需要先通過MmGetSystemRoutineAddress()獲取到CmUnRegisterCallback函數基址，然后在該函數起始位置向下搜索，找到這個鏈表節點，并將其后面的基地址取出來，在上一篇《驅動開發：內核枚舉LoadImage映像回調》文章中已經介紹了定位方式此處跳過介紹 ， 具體實現代碼如下 。
// 署名權// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 指定內存區域的特征碼掃描// PowerBy: LyShark.comPVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize){ PVOID pAddress = NULL; PUCHAR i = NULL; ULONG m = 0; // 掃描內存 for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++) {// 判斷特征碼for (m = 0; m < ulMemoryDataSize; m++){if (*(PUCHAR)(i + m) != pMemoryData[m]){break;}}// 判斷是否找到符合特征碼的地址if (m >= ulMemoryDataSize){// 找到特征碼位置, 獲取緊接著特征碼的下一地址pAddress = (PVOID)(i + ulMemoryDataSize);break;} } return pAddress;}// 根據特征碼獲取 CallbackListHead 鏈表地址// PowerBy: LyShark.comPVOID SearchCallbackListHead(PUCHAR pSpecialData, ULONG ulSpecialDataSize, LONG lSpecialOffset){ UNICODE_STRING ustrFuncName; PVOID pAddress = NULL; LONG lOffset = 0; PVOID pCmUnRegisterCallback = NULL; PVOID pCallbackListHead = NULL; // 先獲取 CmUnRegisterCallback 函數地址 RtlInitUnicodeString(&ustrFuncName, L"CmUnRegisterCallback"); pCmUnRegisterCallback = MmGetSystemRoutineAddress(&ustrFuncName); if (NULL == pCmUnRegisterCallback) {return pCallbackListHead; } // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com>nt!CmUnRegisterCallback+0x6b:fffff806`3a4271ab 4533c0xorr8d,r8dfffff806`3a4271ae 488d542438leardx,[rsp+38h]fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)fffff806`3a4271bf 488bf8movrdi,raxfffff806`3a4271c2 4889442440movqword ptr [rsp+40h],raxfffff806`3a4271c7 4885c0testrax,raxfffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pAddress = SearchMemory(pCmUnRegisterCallback, (PVOID)((PUCHAR)pCmUnRegisterCallback + 0xFF), pSpecialData, ulSpecialDataSize); if (NULL == pAddress) {return pCallbackListHead; } // 先獲取偏移再計算地址 lOffset = *(PLONG)((PUCHAR)pAddress + lSpecialOffset); pCallbackListHead = (PVOID)((PUCHAR)pAddress + lSpecialOffset + sizeof(LONG) + lOffset); return pCallbackListHead;}VOID UnDriver(PDRIVER_OBJECT Driver){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ PVOID pCallbackListHeadAddress = NULL; RTL_OSVERSIONINFOW osInfo = { 0 }; UCHAR pSpecialData[50] = { 0 }; ULONG ulSpecialDataSize = 0; LONG lSpecialOffset = 0; DbgPrint("hello lyshark.com \n"); // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com> nt!CmUnRegisterCallback+0x6b: fffff806`3a4271ab 4533c0xorr8d,r8d fffff806`3a4271ae 488d542438leardx,[rsp+38h] fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414) fffff806`3a4271bf 488bf8movrdi,rax fffff806`3a4271c2 4889442440movqword ptr [rsp+40h],rax fffff806`3a4271c7 4885c0testrax,rax fffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pSpecialData[0] = 0x48; pSpecialData[1] = 0x8D; pSpecialData[2] = 0x0D; ulSpecialDataSize = 3; // 根據特征碼獲取地址 pCallbackListHeadAddress = SearchCallbackListHead(pSpecialData, ulSpecialDataSize, lSpecialOffset); DbgPrint("[LyShark.com] CallbackListHead => %p \n", pCallbackListHeadAddress); Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}

推薦閱讀