浙江龙网

  1. 首页 > 生活百科 > >

驱动开发：内核枚举Registry注册表回调

生活百科

在笔者上一篇文章《驱动开发：内核枚举LoadImage映像回调》中LyShark教大家实现了枚举系统回调中的LoadImage通知消息，本章将实现对Registry注册表通知消息的枚举，与LoadImage消息不同Registry消息不需要解密只要找到CallbackListHead消息回调链表头并解析为_CM_NOTIFY_ENTRY结构即可实现枚举 。
我们来看一款闭源ARK工具是如何实现的：

驱动开发：内核枚举Registry注册表回调

文章插图
注册表系统回调的枚举需要通过特征码搜索来实现，首先我们可以定位到uf CmUnRegisterCallback内核函数上，在该内核函数下方存在一个CallbackListHead链表节点，取出这个链表地址 。
【驱动开发：内核枚举Registry注册表回调】
驱动开发：内核枚举Registry注册表回调

文章插图
当得到注册表链表入口0xfffff8063a065bc0直接将其解析为_CM_NOTIFY_ENTRY即可得到数据 ， 如果要遍历下一个链表则只需要ListEntryHead.Flink向下移动指针即可 。
// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com// 注册表回调函数结构体定义typedef struct _CM_NOTIFY_ENTRY{LIST_ENTRYListEntryHead;ULONGUnKnown1;ULONGUnKnown2;LARGE_INTEGER Cookie;PVOIDContext;PVOIDFunction;}CM_NOTIFY_ENTRY, *PCM_NOTIFY_ENTRY;要想得到此处的链表地址，需要先通过MmGetSystemRoutineAddress()获取到CmUnRegisterCallback函数基址，然后在该函数起始位置向下搜索，找到这个链表节点，并将其后面的基地址取出来，在上一篇《驱动开发：内核枚举LoadImage映像回调》文章中已经介绍了定位方式此处跳过介绍 ， 具体实现代码如下 。
// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 指定内存区域的特征码扫描// PowerBy: LyShark.comPVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize){ PVOID pAddress = NULL; PUCHAR i = NULL; ULONG m = 0; // 扫描内存 for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++) {// 判断特征码for (m = 0; m < ulMemoryDataSize; m++){if (*(PUCHAR)(i + m) != pMemoryData[m]){break;}}// 判断是否找到符合特征码的地址if (m >= ulMemoryDataSize){// 找到特征码位置, 获取紧接着特征码的下一地址pAddress = (PVOID)(i + ulMemoryDataSize);break;} } return pAddress;}// 根据特征码获取 CallbackListHead 链表地址// PowerBy: LyShark.comPVOID SearchCallbackListHead(PUCHAR pSpecialData, ULONG ulSpecialDataSize, LONG lSpecialOffset){ UNICODE_STRING ustrFuncName; PVOID pAddress = NULL; LONG lOffset = 0; PVOID pCmUnRegisterCallback = NULL; PVOID pCallbackListHead = NULL; // 先获取 CmUnRegisterCallback 函数地址 RtlInitUnicodeString(&ustrFuncName, L"CmUnRegisterCallback"); pCmUnRegisterCallback = MmGetSystemRoutineAddress(&ustrFuncName); if (NULL == pCmUnRegisterCallback) {return pCallbackListHead; } // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com>nt!CmUnRegisterCallback+0x6b:fffff806`3a4271ab 4533c0xorr8d,r8dfffff806`3a4271ae 488d542438leardx,[rsp+38h]fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)fffff806`3a4271bf 488bf8movrdi,raxfffff806`3a4271c2 4889442440movqword ptr [rsp+40h],raxfffff806`3a4271c7 4885c0testrax,raxfffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pAddress = SearchMemory(pCmUnRegisterCallback, (PVOID)((PUCHAR)pCmUnRegisterCallback + 0xFF), pSpecialData, ulSpecialDataSize); if (NULL == pAddress) {return pCallbackListHead; } // 先获取偏移再计算地址 lOffset = *(PLONG)((PUCHAR)pAddress + lSpecialOffset); pCallbackListHead = (PVOID)((PUCHAR)pAddress + lSpecialOffset + sizeof(LONG) + lOffset); return pCallbackListHead;}VOID UnDriver(PDRIVER_OBJECT Driver){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ PVOID pCallbackListHeadAddress = NULL; RTL_OSVERSIONINFOW osInfo = { 0 }; UCHAR pSpecialData[50] = { 0 }; ULONG ulSpecialDataSize = 0; LONG lSpecialOffset = 0; DbgPrint("hello lyshark.com \n"); // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com> nt!CmUnRegisterCallback+0x6b: fffff806`3a4271ab 4533c0xorr8d,r8d fffff806`3a4271ae 488d542438leardx,[rsp+38h] fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414) fffff806`3a4271bf 488bf8movrdi,rax fffff806`3a4271c2 4889442440movqword ptr [rsp+40h],rax fffff806`3a4271c7 4885c0testrax,rax fffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pSpecialData[0] = 0x48; pSpecialData[1] = 0x8D; pSpecialData[2] = 0x0D; ulSpecialDataSize = 3; // 根据特征码获取地址 pCallbackListHeadAddress = SearchCallbackListHead(pSpecialData, ulSpecialDataSize, lSpecialOffset); DbgPrint("[LyShark.com] CallbackListHead => %p \n", pCallbackListHeadAddress); Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}

推荐阅读


上一篇：Magnet: Push-based Shuffle Service for Large-scale Data Processing

下一篇：Go | 讲解GOROOT、GOPATH、GOBIN