ToB企服应用市场:ToB评测及商务社交产业平台

标题: 驱动开发：内核特征码扫描PE代码段 [打印本页]

---

作者: 圆咕噜咕噜    时间: 2022-10-18 18:27
标题: 驱动开发：内核特征码扫描PE代码段
在笔者上一篇文章《驱动开发：内核特征码搜索函数封装》中为了定位特征的方便我们封装实现了一个可以传入数组实现的SearchSpecialCode定位函数，该定位函数其实还不能算的上简单，本章LyShark将对特征码定位进行简化，让定位变得更简单，并运用定位代码实现扫描内核PE的.text代码段，并从代码段中得到某个特征所在内存位置。
老样子为了后续教程能够继续，先来定义一个lyshark.h头文件，该头文件中包含了我们本篇文章所必须要使用到的结构体定义，这些定义的函数如果不懂请去看LyShark以前的文章，这里就不罗嗦了。

1. #include <ntifs.h>
2. #include <ntimage.h>
4. typedef struct _KLDR_DATA_TABLE_ENTRY
5. {
6.         LIST_ENTRY64 InLoadOrderLinks;
7.         ULONG64 __Undefined1;
8.         ULONG64 __Undefined2;
9.         ULONG64 __Undefined3;
10.         ULONG64 NonPagedDebugInfo;
11.         ULONG64 DllBase;
12.         ULONG64 EntryPoint;
13.         ULONG SizeOfImage;
14.         UNICODE_STRING FullDllName;
15.         UNICODE_STRING BaseDllName;
16.         ULONG   Flags;
17.         USHORT  LoadCount;
18.         USHORT  __Undefined5;
19.         ULONG64 __Undefined6;
20.         ULONG   CheckSum;
21.         ULONG   __padding1;
22.         ULONG   TimeDateStamp;
23.         ULONG   __padding2;
24. }KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY;
26. typedef struct _RTL_PROCESS_MODULE_INFORMATION
27. {
28.         HANDLE Section;
29.         PVOID MappedBase;
30.         PVOID ImageBase;
31.         ULONG ImageSize;
32.         ULONG Flags;
33.         USHORT LoadOrderIndex;
34.         USHORT InitOrderIndex;
35.         USHORT LoadCount;
36.         USHORT OffsetToFileName;
37.         UCHAR  FullPathName[256];
38. } RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
40. typedef struct _RTL_PROCESS_MODULES
41. {
42.         ULONG NumberOfModules;
43.         RTL_PROCESS_MODULE_INFORMATION Modules[1];
44. } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;
46. typedef enum _SYSTEM_INFORMATION_CLASS
47. {
48.         SystemBasicInformation = 0x0,
49.         SystemProcessorInformation = 0x1,
50.         SystemPerformanceInformation = 0x2,
51.         SystemTimeOfDayInformation = 0x3,
52.         SystemPathInformation = 0x4,
53.         SystemProcessInformation = 0x5,
54.         SystemCallCountInformation = 0x6,
55.         SystemDeviceInformation = 0x7,
56.         SystemProcessorPerformanceInformation = 0x8,
57.         SystemFlagsInformation = 0x9,
58.         SystemCallTimeInformation = 0xa,
59.         SystemModuleInformation = 0xb,
60.         SystemLocksInformation = 0xc,
61.         SystemStackTraceInformation = 0xd,
62.         SystemPagedPoolInformation = 0xe,
63.         SystemNonPagedPoolInformation = 0xf,
64.         SystemHandleInformation = 0x10,
65.         SystemObjectInformation = 0x11,
66.         SystemPageFileInformation = 0x12,
67.         SystemVdmInstemulInformation = 0x13,
68.         SystemVdmBopInformation = 0x14,
69.         SystemFileCacheInformation = 0x15,
70.         SystemPoolTagInformation = 0x16,
71.         SystemInterruptInformation = 0x17,
72.         SystemDpcBehaviorInformation = 0x18,
73.         SystemFullMemoryInformation = 0x19,
74.         SystemLoadGdiDriverInformation = 0x1a,
75.         SystemUnloadGdiDriverInformation = 0x1b,
76.         SystemTimeAdjustmentInformation = 0x1c,
77.         SystemSummaryMemoryInformation = 0x1d,
78.         SystemMirrorMemoryInformation = 0x1e,
79.         SystemPerformanceTraceInformation = 0x1f,
80.         SystemObsolete0 = 0x20,
81.         SystemExceptionInformation = 0x21,
82.         SystemCrashDumpStateInformation = 0x22,
83.         SystemKernelDebuggerInformation = 0x23,
84.         SystemContextSwitchInformation = 0x24,
85.         SystemRegistryQuotaInformation = 0x25,
86.         SystemExtendServiceTableInformation = 0x26,
87.         SystemPrioritySeperation = 0x27,
88.         SystemVerifierAddDriverInformation = 0x28,
89.         SystemVerifierRemoveDriverInformation = 0x29,
90.         SystemProcessorIdleInformation = 0x2a,
91.         SystemLegacyDriverInformation = 0x2b,
92.         SystemCurrentTimeZoneInformation = 0x2c,
93.         SystemLookasideInformation = 0x2d,
94.         SystemTimeSlipNotification = 0x2e,
95.         SystemSessionCreate = 0x2f,
96.         SystemSessionDetach = 0x30,
97.         SystemSessionInformation = 0x31,
98.         SystemRangeStartInformation = 0x32,
99.         SystemVerifierInformation = 0x33,
100.         SystemVerifierThunkExtend = 0x34,
101.         SystemSessionProcessInformation = 0x35,
102.         SystemLoadGdiDriverInSystemSpace = 0x36,
103.         SystemNumaProcessorMap = 0x37,
104.         SystemPrefetcherInformation = 0x38,
105.         SystemExtendedProcessInformation = 0x39,
106.         SystemRecommendedSharedDataAlignment = 0x3a,
107.         SystemComPlusPackage = 0x3b,
108.         SystemNumaAvailableMemory = 0x3c,
109.         SystemProcessorPowerInformation = 0x3d,
110.         SystemEmulationBasicInformation = 0x3e,
111.         SystemEmulationProcessorInformation = 0x3f,
112.         SystemExtendedHandleInformation = 0x40,
113.         SystemLostDelayedWriteInformation = 0x41,
114.         SystemBigPoolInformation = 0x42,
115.         SystemSessionPoolTagInformation = 0x43,
116.         SystemSessionMappedViewInformation = 0x44,
117.         SystemHotpatchInformation = 0x45,
118.         SystemObjectSecurityMode = 0x46,
119.         SystemWatchdogTimerHandler = 0x47,
120.         SystemWatchdogTimerInformation = 0x48,
121.         SystemLogicalProcessorInformation = 0x49,
122.         SystemWow64SharedInformationObsolete = 0x4a,
123.         SystemRegisterFirmwareTableInformationHandler = 0x4b,
124.         SystemFirmwareTableInformation = 0x4c,
125.         SystemModuleInformationEx = 0x4d,
126.         SystemVerifierTriageInformation = 0x4e,
127.         SystemSuperfetchInformation = 0x4f,
128.         SystemMemoryListInformation = 0x50,
129.         SystemFileCacheInformationEx = 0x51,
130.         SystemThreadPriorityClientIdInformation = 0x52,
131.         SystemProcessorIdleCycleTimeInformation = 0x53,
132.         SystemVerifierCancellationInformation = 0x54,
133.         SystemProcessorPowerInformationEx = 0x55,
134.         SystemRefTraceInformation = 0x56,
135.         SystemSpecialPoolInformation = 0x57,
136.         SystemProcessIdInformation = 0x58,
137.         SystemErrorPortInformation = 0x59,
138.         SystemBootEnvironmentInformation = 0x5a,
139.         SystemHypervisorInformation = 0x5b,
140.         SystemVerifierInformationEx = 0x5c,
141.         SystemTimeZoneInformation = 0x5d,
142.         SystemImageFileExecutionOptionsInformation = 0x5e,
143.         SystemCoverageInformation = 0x5f,
144.         SystemPrefetchPatchInformation = 0x60,
145.         SystemVerifierFaultsInformation = 0x61,
146.         SystemSystemPartitionInformation = 0x62,
147.         SystemSystemDiskInformation = 0x63,
148.         SystemProcessorPerformanceDistribution = 0x64,
149.         SystemNumaProximityNodeInformation = 0x65,
150.         SystemDynamicTimeZoneInformation = 0x66,
151.         SystemCodeIntegrityInformation = 0x67,
152.         SystemProcessorMicrocodeUpdateInformation = 0x68,
153.         SystemProcessorBrandString = 0x69,
154.         SystemVirtualAddressInformation = 0x6a,
155.         SystemLogicalProcessorAndGroupInformation = 0x6b,
156.         SystemProcessorCycleTimeInformation = 0x6c,
157.         SystemStoreInformation = 0x6d,
158.         SystemRegistryAppendString = 0x6e,
159.         SystemAitSamplingValue = 0x6f,
160.         SystemVhdBootInformation = 0x70,
161.         SystemCpuQuotaInformation = 0x71,
162.         SystemNativeBasicInformation = 0x72,
163.         SystemErrorPortTimeouts = 0x73,
164.         SystemLowPriorityIoInformation = 0x74,
165.         SystemBootEntropyInformation = 0x75,
166.         SystemVerifierCountersInformation = 0x76,
167.         SystemPagedPoolInformationEx = 0x77,
168.         SystemSystemPtesInformationEx = 0x78,
169.         SystemNodeDistanceInformation = 0x79,
170.         SystemAcpiAuditInformation = 0x7a,
171.         SystemBasicPerformanceInformation = 0x7b,
172.         SystemQueryPerformanceCounterInformation = 0x7c,
173.         SystemSessionBigPoolInformation = 0x7d,
174.         SystemBootGraphicsInformation = 0x7e,
175.         SystemScrubPhysicalMemoryInformation = 0x7f,
176.         SystemBadPageInformation = 0x80,
177.         SystemProcessorProfileControlArea = 0x81,
178.         SystemCombinePhysicalMemoryInformation = 0x82,
179.         SystemEntropyInterruptTimingInformation = 0x83,
180.         SystemConsoleInformation = 0x84,
181.         SystemPlatformBinaryInformation = 0x85,
182.         SystemThrottleNotificationInformation = 0x86,
183.         SystemHypervisorProcessorCountInformation = 0x87,
184.         SystemDeviceDataInformation = 0x88,
185.         SystemDeviceDataEnumerationInformation = 0x89,
186.         SystemMemoryTopologyInformation = 0x8a,
187.         SystemMemoryChannelInformation = 0x8b,
188.         SystemBootLogoInformation = 0x8c,
189.         SystemProcessorPerformanceInformationEx = 0x8d,
190.         SystemSpare0 = 0x8e,
191.         SystemSecureBootPolicyInformation = 0x8f,
192.         SystemPageFileInformationEx = 0x90,
193.         SystemSecureBootInformation = 0x91,
194.         SystemEntropyInterruptTimingRawInformation = 0x92,
195.         SystemPortableWorkspaceEfiLauncherInformation = 0x93,
196.         SystemFullProcessInformation = 0x94,
197.         SystemKernelDebuggerInformationEx = 0x95,
198.         SystemBootMetadataInformation = 0x96,
199.         SystemSoftRebootInformation = 0x97,
200.         SystemElamCertificateInformation = 0x98,
201.         SystemOfflineDumpConfigInformation = 0x99,
202.         SystemProcessorFeaturesInformation = 0x9a,
203.         SystemRegistryReconciliationInformation = 0x9b,
204.         MaxSystemInfoClass = 0x9c,
205. } SYSTEM_INFORMATION_CLASS;
207. // 声明函数
208. // By: Lyshark.com
209. NTSYSAPI PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(_In_ PVOID Base);
210. NTSTATUS NTAPI ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
212. typedef VOID(__cdecl *PMiProcessLoaderEntry)(PKLDR_DATA_TABLE_ENTRY section, IN LOGICAL Insert);
213. typedef NTSTATUS(*NTQUERYSYSTEMINFORMATION)(IN ULONG SystemInformationClass, OUT PVOID SystemInformation, IN ULONG_PTR SystemInformationLength, OUT PULONG_PTR ReturnLength OPTIONAL);

复制代码

我们继续，首先实现特征码字符串的解析与扫描实现此处UtilLySharkSearchPattern函数就是LyShark封装过的，这里依次介绍一下参数传递的含义。

• pattern 用于传入一段字符串特征值(以\x开头)
  
• len 代表输入特征码长度(除去\x后的长度)
  
• base 代表扫描内存的基地址
  
• size 代表需要向下扫描的长度
  
• ppFound 代表扫描到首地址以后返回的内存地址
  

这段代码该如何使用，如下我们以定位IoInitializeTimer为例，演示UtilLySharkSearchPattern如何定位特征的，如下代码pattern变量中就是我们需要定位的特征值，pattern_size则是需要定位的特征码长度，在address地址位置向下扫描128字节，找到则返回到find_address变量内。

1. // 署名
2. // PowerBy: LyShark
3. // Email: me@lyshark.com
4. #include "lyshark.h"
6. PVOID GetIoInitializeTimerAddress()
7. {
8.         PVOID VariableAddress = 0;
9.         UNICODE_STRING uioiTime = { 0 };
11.         RtlInitUnicodeString(&uioiTime, L"IoInitializeTimer");
12.         VariableAddress = (PVOID)MmGetSystemRoutineAddress(&uioiTime);
13.         if (VariableAddress != 0)
14.         {
15.                 return VariableAddress;
16.         }
17.         return 0;
18. }
20. // 对指定内存执行特征码扫描
21. NTSTATUS UtilLySharkSearchPattern(IN PUCHAR pattern, IN ULONG_PTR len, IN const VOID* base, IN ULONG_PTR size, OUT PVOID* ppFound)
22. {
23.         // 计算匹配长度
24.         // LyShark.com 特征码扫描
25.         NT_ASSERT(ppFound != 0 && pattern != 0 && base != 0);
26.         if (ppFound == 0 || pattern == 0 || base == 0)
27.         {
28.                 return STATUS_INVALID_PARAMETER;
29.         }
31.         __try
32.         {
33.                 for (ULONG_PTR i = 0; i < size - len; i++)
34.                 {
35.                         BOOLEAN found = TRUE;
36.                         for (ULONG_PTR j = 0; j < len; j++)
37.                         {
38.                                 if (pattern[j] != ((PUCHAR)base)[i + j])
39.                                 {
40.                                         found = FALSE;
41.                                         break;
42.                                 }
43.                         }
45.                         if (found != FALSE)
46.                         {
47.                                 *ppFound = (PUCHAR)base + i;
48.                                 DbgPrint("[LyShark.com] 特征码匹配地址: %p \n", (PUCHAR)base + i);
49.                                 return STATUS_SUCCESS;
50.                         }
51.                 }
52.         }
53.         __except (EXCEPTION_EXECUTE_HANDLER)
54.         {
55.                 return STATUS_UNHANDLED_EXCEPTION;
56.         }
58.         return STATUS_NOT_FOUND;
59. }
61. VOID UnDriver(PDRIVER_OBJECT driver)
62. {
63.         DbgPrint(("Uninstall Driver Is OK \n"));
64. }
66. NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
67. {
68.         DbgPrint(("hello lyshark.com \n"));
70.         // 返回匹配长度5
71.         CHAR pattern[] = "\x48\x89\x6c\x24\x10";
72.         PVOID *find_address = NULL;
74.         int pattern_size = sizeof(pattern) - 1;
75.         DbgPrint("匹配长度: %d \n", pattern_size);
77.         // 得到基地址
78.         PVOID address = GetIoInitializeTimerAddress();
80.         // 扫描特征
81.         NTSTATUS nt = UtilLySharkSearchPattern((PUCHAR)pattern, pattern_size, address, 128, &find_address);
83.         DbgPrint("[LyShark 返回地址 => ] 0x%p \n", (ULONG64)find_address);
85.         Driver->DriverUnload = UnDriver;
86.         return STATUS_SUCCESS;
87. }

复制代码

运行驱动程序完成特征定位，并对比定位效果。

如上述所示定位函数我们已经封装好了，相信你也能感受到这种方式要比使用数组更方便，为了能定位到内核PE结构我们需要使用RtlImageNtHeader来解析，这个内核函数专门用来得到内核程序的PE头部结构的，在下方案例中首先我们使用封装过的LySharkToolsUtilKernelBase函数拿到内核基址，如果你不懂函数实现细节请阅读《驱动开发：内核取ntoskrnl模块基地址》这篇文章，拿到基址以后可以直接使用RtlImageNtHeader对其PE头部进行解析，如下所示。

1. // 署名
2. // PowerBy: LyShark
3. // Email: me@lyshark.com
4. #include "lyshark.h"
6. // 定义全局变量
7. static PVOID g_KernelBase = 0;
8. static ULONG g_KernelSize = 0;
10. // 得到KernelBase基地址
11. // lyshark.com
12. PVOID LySharkToolsUtilKernelBase(OUT PULONG pSize)
13. {
14.         NTSTATUS status = STATUS_SUCCESS;
15.         ULONG bytes = 0;
16.         PRTL_PROCESS_MODULES pMods = 0;
17.         PVOID checkPtr = 0;
18.         UNICODE_STRING routineName;
20.         if (g_KernelBase != 0)
21.         {
22.                 if (pSize)
23.                 {
24.                         *pSize = g_KernelSize;
25.                 }
26.                 return g_KernelBase;
27.         }
29.         RtlInitUnicodeString(&routineName, L"NtOpenFile");
31.         checkPtr = MmGetSystemRoutineAddress(&routineName);
32.         if (checkPtr == 0)
33.                 return 0;
35.         __try
36.         {
37.                 status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes);
38.                 if (bytes == 0)
39.                 {
40.                         return 0;
41.                 }
43.                 pMods = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPoolNx, bytes, L"LyShark");
44.                 RtlZeroMemory(pMods, bytes);
46.                 status = ZwQuerySystemInformation(SystemModuleInformation, pMods, bytes, &bytes);
48.                 if (NT_SUCCESS(status))
49.                 {
50.                         PRTL_PROCESS_MODULE_INFORMATION pMod = pMods->Modules;
52.                         for (ULONG i = 0; i < pMods->NumberOfModules; i++)
53.                         {
54.                                 if (checkPtr >= pMod[i].ImageBase && checkPtr < (PVOID)((PUCHAR)pMod[i].ImageBase + pMod[i].ImageSize))
55.                                 {
56.                                         g_KernelBase = pMod[i].ImageBase;
57.                                         g_KernelSize = pMod[i].ImageSize;
58.                                         if (pSize)
59.                                         {
60.                                                 *pSize = g_KernelSize;
61.                                         }
62.                                         break;
63.                                 }
64.                         }
65.                 }
66.         }
67.         __except (EXCEPTION_EXECUTE_HANDLER)
68.         {
69.                 return 0;
70.         }
72.         if (pMods)
73.         {
74.                 ExFreePoolWithTag(pMods, L"LyShark");
75.         }
77.         DbgPrint("KernelBase = > %p \n", g_KernelBase);
78.         return g_KernelBase;
79. }
81. VOID UnDriver(PDRIVER_OBJECT driver)
82. {
83.         DbgPrint(("Uninstall Driver Is OK \n"));
84. }
86. NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
87. {
88.         DbgPrint(("hello lyshark.com \n"));
90.         // 获取内核第一个模块的基地址
91.         PVOID base = LySharkToolsUtilKernelBase(0);
92.         if (!base)
93.                 return STATUS_NOT_FOUND;
95.         // 得到NT头部PE32+结构
96.         // lyshark.com
97.         PIMAGE_NT_HEADERS64 pHdr = RtlImageNtHeader(base);
98.         if (!pHdr)
99.                 return STATUS_INVALID_IMAGE_FORMAT;
101.         // 首先寻找代码段
102.         PIMAGE_SECTION_HEADER pFirstSection = (PIMAGE_SECTION_HEADER)(pHdr + 1);
103.         for (PIMAGE_SECTION_HEADER pSection = pFirstSection; pSection < pFirstSection + pHdr->FileHeader.NumberOfSections; pSection++)
104.         {
105.                 ANSI_STRING LySharkSection, LySharkName;
106.                 RtlInitAnsiString(&LySharkSection, ".text");
107.                 RtlInitAnsiString(&LySharkName, (PCCHAR)pSection->Name);
109.                 DbgPrint("[LyShark.PE] 名字: %Z | 地址: %p | 长度: %d \n", LySharkName, (PUCHAR)base + pSection->VirtualAddress, pSection->Misc.VirtualSize);
110.         }
112.         Driver->DriverUnload = UnDriver;
113.         return STATUS_SUCCESS;
114. }

复制代码

运行这段驱动程序，你会得到当前内核的所有PE节信息，枚举效果如下所示。

既然能够得到PE头部数据了，那么我们只需要扫描这段空间并得到匹配到的数据即可，其实很容易实现，如下代码所示。

1. // 署名
2. // PowerBy: LyShark
3. // Email: me@lyshark.com
4. #include "lyshark.h"
6. // 定义全局变量
7. static PVOID g_KernelBase = 0;
8. static ULONG g_KernelSize = 0;
10. // 得到KernelBase基地址
11. // lyshark.com
12. PVOID LySharkToolsUtilKernelBase(OUT PULONG pSize)
13. {
14.         NTSTATUS status = STATUS_SUCCESS;
15.         ULONG bytes = 0;
16.         PRTL_PROCESS_MODULES pMods = 0;
17.         PVOID checkPtr = 0;
18.         UNICODE_STRING routineName;
20.         if (g_KernelBase != 0)
21.         {
22.                 if (pSize)
23.                 {
24.                         *pSize = g_KernelSize;
25.                 }
26.                 return g_KernelBase;
27.         }
29.         RtlInitUnicodeString(&routineName, L"NtOpenFile");
31.         checkPtr = MmGetSystemRoutineAddress(&routineName);
32.         if (checkPtr == 0)
33.                 return 0;
35.         __try
36.         {
37.                 status = ZwQuerySystemInformation(SystemModuleInformation, 0, bytes, &bytes);
38.                 if (bytes == 0)
39.                 {
40.                         return 0;
41.                 }
43.                 pMods = (PRTL_PROCESS_MODULES)ExAllocatePoolWithTag(NonPagedPoolNx, bytes, L"LyShark");
44.                 RtlZeroMemory(pMods, bytes);
46.                 status = ZwQuerySystemInformation(SystemModuleInformation, pMods, bytes, &bytes);
48.                 if (NT_SUCCESS(status))
49.                 {
50.                         PRTL_PROCESS_MODULE_INFORMATION pMod = pMods->Modules;
52.                         for (ULONG i = 0; i < pMods->NumberOfModules; i++)
53.                         {
54.                                 if (checkPtr >= pMod[i].ImageBase && checkPtr < (PVOID)((PUCHAR)pMod[i].ImageBase + pMod[i].ImageSize))
55.                                 {
56.                                         g_KernelBase = pMod[i].ImageBase;
57.                                         g_KernelSize = pMod[i].ImageSize;
58.                                         if (pSize)
59.                                         {
60.                                                 *pSize = g_KernelSize;
61.                                         }
62.                                         break;
63.                                 }
64.                         }
65.                 }
66.         }
67.         __except (EXCEPTION_EXECUTE_HANDLER)
68.         {
69.                 return 0;
70.         }
72.         if (pMods)
73.         {
74.                 ExFreePoolWithTag(pMods, L"LyShark");
75.         }
77.         DbgPrint("KernelBase = > %p \n", g_KernelBase);
78.         return g_KernelBase;
79. }
81. // 对指定内存执行特征码扫描
82. NTSTATUS UtilLySharkSearchPattern(IN PUCHAR pattern, IN UCHAR wildcard, IN ULONG_PTR len, IN const VOID* base, IN ULONG_PTR size, OUT PVOID* ppFound)
83. {
84.         NT_ASSERT(ppFound != 0 && pattern != 0 && base != 0);
85.         if (ppFound == 0 || pattern == 0 || base == 0)
86.         {
87.                 return STATUS_INVALID_PARAMETER;
88.         }
90.         __try
91.         {
92.                 for (ULONG_PTR i = 0; i < size - len; i++)
93.                 {
94.                         BOOLEAN found = TRUE;
95.                         for (ULONG_PTR j = 0; j < len; j++)
96.                         {
97.                                 if (pattern[j] != wildcard && pattern[j] != ((PUCHAR)base)[i + j])
98.                                 {
99.                                         found = FALSE;
100.                                         break;
101.                                 }
102.                         }
104.                         if (found != FALSE)
105.                         {
106.                                 *ppFound = (PUCHAR)base + i;
107.                                 DbgPrint("[LyShark] 特征码匹配地址: %p \n", (PUCHAR)base + i);
108.                                 return STATUS_SUCCESS;
109.                         }
110.                 }
111.         }
112.         __except (EXCEPTION_EXECUTE_HANDLER)
113.         {
114.                 return STATUS_UNHANDLED_EXCEPTION;
115.         }
117.         return STATUS_NOT_FOUND;
118. }
120. // 扫描代码段中的指令片段
121. NTSTATUS ByLySharkComUtilScanSection(IN PCCHAR section, IN PUCHAR pattern, IN UCHAR wildcard, IN ULONG_PTR len, OUT PVOID* ppFound)
122. {
123.         NT_ASSERT(ppFound != 0);
124.         if (ppFound == 0)
125.                 return STATUS_INVALID_PARAMETER;
127.         // 获取内核第一个模块的基地址
128.         PVOID base = LySharkToolsUtilKernelBase(0);
129.         if (!base)
130.                 return STATUS_NOT_FOUND;
132.         // 得到NT头部PE32+结构
133.         PIMAGE_NT_HEADERS64 pHdr = RtlImageNtHeader(base);
134.         if (!pHdr)
135.                 return STATUS_INVALID_IMAGE_FORMAT;
137.         // 首先寻找代码段
138.         PIMAGE_SECTION_HEADER pFirstSection = (PIMAGE_SECTION_HEADER)(pHdr + 1);
139.         for (PIMAGE_SECTION_HEADER pSection = pFirstSection; pSection < pFirstSection + pHdr->FileHeader.NumberOfSections; pSection++)
140.         {
141.                 ANSI_STRING LySharkSection, LySharkText;
142.                 RtlInitAnsiString(&LySharkSection, section);
143.                 RtlInitAnsiString(&LySharkText, (PCCHAR)pSection->Name);
145.                 // 判断是不是我们要找的.text节
146.                 if (RtlCompareString(&LySharkSection, &LySharkText, TRUE) == 0)
147.                 {
148.                         // 如果是则开始匹配特征码
149.                         return UtilLySharkSearchPattern(pattern, wildcard, len, (PUCHAR)base + pSection->VirtualAddress, pSection->Misc.VirtualSize, ppFound);
150.                 }
151.         }
153.         return STATUS_NOT_FOUND;
154. }
156. VOID UnDriver(PDRIVER_OBJECT driver)
157. {
158.         DbgPrint(("Uninstall Driver Is OK \n"));
159. }
161. NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
162. {
163.         DbgPrint("hello lyshark.com \n");
165.         PMiProcessLoaderEntry m_MiProcessLoaderEntry = NULL;
166.         RTL_OSVERSIONINFOW Version = { 0 };
168.         Version.dwOSVersionInfoSize = sizeof(Version);
169.         RtlGetVersion(&Version);
171.         //获取内核版本号
172.         DbgPrint("主版本: %d -->次版本: %d --> 编译版本: %d", Version.dwMajorVersion, Version.dwMinorVersion, Version.dwBuildNumber);
174.         if (Version.dwMajorVersion == 10)
175.         {
176.                 // 如果是 win10 18363 则匹配特征
177.                 if (Version.dwBuildNumber == 18363)
178.                 {
179.                         CHAR pattern[] = "\x48\x89\x5c\x24\x08";
180.                         int pattern_size = sizeof(pattern) - 1;
182.                         ByLySharkComUtilScanSection(".text", (PUCHAR)pattern, 0xCC, pattern_size, (PVOID *)&m_MiProcessLoaderEntry);
183.                         DbgPrint("[LyShark] 输出首地址: %p", m_MiProcessLoaderEntry);
184.                 }
185.         }
187.         Driver->DriverUnload = UnDriver;
188.         return STATUS_SUCCESS;
189. }

复制代码

代码中首先判断系统主版本windows 10 18363如果是则执行匹配，只匹配.text也就是代码段中的数据，当遇到0xcc时则取消继续，否则继续执行枚举，程序输出效果如下所示。

在WinDBG中输入命令!dh 0xfffff8007f600000解析出内核PE头数据，可以看到如下所示，对比无误。


免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！

---

欢迎光临 ToB企服应用市场:ToB评测及商务社交产业平台 (https://dis.qidao123.com/)

Powered by Discuz! X3.4