1. 首頁 > 生活百科 > >

驅動開發：內核枚舉Registry注冊表回調( 二 )

生活百科

運行這段代碼 ， 并可得到注冊表回調入口地址，輸出效果如下所示：

驅動開發：內核枚舉Registry注冊表回調

文章插圖
得到了注冊表回調入口地址，接著直接循環遍歷輸出這個鏈表即可得到所有的注冊表回調 。
// 署名權// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 指定內存區域的特征碼掃描// PowerBy: LyShark.comPVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize){ PVOID pAddress = NULL; PUCHAR i = NULL; ULONG m = 0; // 掃描內存 for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++) {// 判斷特征碼for (m = 0; m < ulMemoryDataSize; m++){if (*(PUCHAR)(i + m) != pMemoryData[m]){break;}}// 判斷是否找到符合特征碼的地址if (m >= ulMemoryDataSize){// 找到特征碼位置, 獲取緊接著特征碼的下一地址pAddress = (PVOID)(i + ulMemoryDataSize);break;} } return pAddress;}// 根據特征碼獲取 CallbackListHead 鏈表地址// PowerBy: LyShark.comPVOID SearchCallbackListHead(PUCHAR pSpecialData, ULONG ulSpecialDataSize, LONG lSpecialOffset){ UNICODE_STRING ustrFuncName; PVOID pAddress = NULL; LONG lOffset = 0; PVOID pCmUnRegisterCallback = NULL; PVOID pCallbackListHead = NULL; // 先獲取 CmUnRegisterCallback 函數地址 RtlInitUnicodeString(&ustrFuncName, L"CmUnRegisterCallback"); pCmUnRegisterCallback = MmGetSystemRoutineAddress(&ustrFuncName); if (NULL == pCmUnRegisterCallback) {return pCallbackListHead; } // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com>nt!CmUnRegisterCallback+0x6b:fffff806`3a4271ab 4533c0xorr8d,r8dfffff806`3a4271ae 488d542438leardx,[rsp+38h]fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)fffff806`3a4271bf 488bf8movrdi,raxfffff806`3a4271c2 4889442440movqword ptr [rsp+40h],raxfffff806`3a4271c7 4885c0testrax,raxfffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pAddress = SearchMemory(pCmUnRegisterCallback, (PVOID)((PUCHAR)pCmUnRegisterCallback + 0xFF), pSpecialData, ulSpecialDataSize); if (NULL == pAddress) {return pCallbackListHead; } // 先獲取偏移再計算地址 lOffset = *(PLONG)((PUCHAR)pAddress + lSpecialOffset); pCallbackListHead = (PVOID)((PUCHAR)pAddress + lSpecialOffset + sizeof(LONG) + lOffset); return pCallbackListHead;}// 注冊表回調函數結構體定義typedef struct _CM_NOTIFY_ENTRY{ LIST_ENTRYListEntryHead; ULONGUnKnown1; ULONGUnKnown2; LARGE_INTEGER Cookie; PVOIDContext; PVOIDFunction;}CM_NOTIFY_ENTRY, *PCM_NOTIFY_ENTRY;VOID UnDriver(PDRIVER_OBJECT Driver){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ PVOID pCallbackListHeadAddress = NULL; RTL_OSVERSIONINFOW osInfo = { 0 }; UCHAR pSpecialData[50] = { 0 }; ULONG ulSpecialDataSize = 0; LONG lSpecialOffset = 0; DbgPrint("hello lyshark.com \n"); // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com> nt!CmUnRegisterCallback+0x6b: fffff806`3a4271ab 4533c0xorr8d,r8d fffff806`3a4271ae 488d542438leardx,[rsp+38h] fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414) fffff806`3a4271bf 488bf8movrdi,rax fffff806`3a4271c2 4889442440movqword ptr [rsp+40h],rax fffff806`3a4271c7 4885c0testrax,rax fffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pSpecialData[0] = 0x48; pSpecialData[1] = 0x8D; pSpecialData[2] = 0x0D; ulSpecialDataSize = 3; // 根據特征碼獲取地址 pCallbackListHeadAddress = SearchCallbackListHead(pSpecialData, ulSpecialDataSize, lSpecialOffset); DbgPrint("[LyShark.com] CallbackListHead => %p \n", pCallbackListHeadAddress); // 遍歷鏈表結構 ULONG i = 0; PCM_NOTIFY_ENTRY pNotifyEntry = NULL; if (NULL == pCallbackListHeadAddress) {return FALSE; } // 開始遍歷雙向鏈表 pNotifyEntry = (PCM_NOTIFY_ENTRY)pCallbackListHeadAddress; do {// 判斷pNotifyEntry地址是否有效if (FALSE == MmIsAddressValid(pNotifyEntry)){break;}// 判斷回調函數地址是否有效if (MmIsAddressValid(pNotifyEntry->Function)){DbgPrint("[LyShark.com] 回調函數地址: 0x%p | 回調函數Cookie: 0x%I64X \n", pNotifyEntry->Function, pNotifyEntry->Cookie.QuadPart);}// 獲取下一鏈表pNotifyEntry = (PCM_NOTIFY_ENTRY)pNotifyEntry->ListEntryHead.Flink; } while (pCallbackListHeadAddress != (PVOID)pNotifyEntry); Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}最終運行這個驅動程序，輸出如下效果：
驅動開發：內核枚舉Registry注冊表回調

文章插圖
目前系統中有兩個回調函數，這一點在第一張圖片中也可以得到，枚舉是正確的 。

推薦閱讀