在笔者上一篇文章《驱动开发:内核枚举LoadImage映像回调》
中LyShark
教大家实现了枚举系统回调中的LoadImage
通知消息,本章将实现对Registry
注册表通知消息的枚举,与LoadImage
消息不同Registry
消息不需要解密只要找到CallbackListHead
消息回调链表头并解析为_CM_NOTIFY_ENTRY
结构即可实现枚举 。
我们来看一款闭源ARK工具是如何实现的:
![驱动开发:内核枚举Registry注册表回调](https://m.360buyimg.com/jdcms/jfs/t1/94603/5/23514/9330/63523a4bE45814158/a36d31429d6a56bb.png)
文章插图
注册表系统回调的枚举需要通过特征码搜索来实现,首先我们可以定位到
uf CmUnRegisterCallback
内核函数上,在该内核函数下方存在一个CallbackListHead
链表节点,取出这个链表地址 。【驱动开发:内核枚举Registry注册表回调】
![驱动开发:内核枚举Registry注册表回调](https://m.360buyimg.com/jdcms/jfs/t1/109632/8/22664/17798/63523a4bE4084950d/3b18e2db31ec3d7b.png)
文章插图
当得到注册表链表入口
0xfffff8063a065bc0
直接将其解析为_CM_NOTIFY_ENTRY
即可得到数据 , 如果要遍历下一个链表则只需要ListEntryHead.Flink
向下移动指针即可 。// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com// 注册表回调函数结构体定义typedef struct _CM_NOTIFY_ENTRY{LIST_ENTRYListEntryHead;ULONGUnKnown1;ULONGUnKnown2;LARGE_INTEGER Cookie;PVOIDContext;PVOIDFunction;}CM_NOTIFY_ENTRY, *PCM_NOTIFY_ENTRY;
要想得到此处的链表地址,需要先通过MmGetSystemRoutineAddress()
获取到CmUnRegisterCallback
函数基址,然后在该函数起始位置向下搜索,找到这个链表节点,并将其后面的基地址取出来,在上一篇《驱动开发:内核枚举LoadImage映像回调》
文章中已经介绍了定位方式此处跳过介绍 , 具体实现代码如下 。// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 指定内存区域的特征码扫描// PowerBy: LyShark.comPVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize){ PVOID pAddress = NULL; PUCHAR i = NULL; ULONG m = 0; // 扫描内存 for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++) {// 判断特征码for (m = 0; m < ulMemoryDataSize; m++){if (*(PUCHAR)(i + m) != pMemoryData[m]){break;}}// 判断是否找到符合特征码的地址if (m >= ulMemoryDataSize){// 找到特征码位置, 获取紧接着特征码的下一地址pAddress = (PVOID)(i + ulMemoryDataSize);break;} } return pAddress;}// 根据特征码获取 CallbackListHead 链表地址// PowerBy: LyShark.comPVOID SearchCallbackListHead(PUCHAR pSpecialData, ULONG ulSpecialDataSize, LONG lSpecialOffset){ UNICODE_STRING ustrFuncName; PVOID pAddress = NULL; LONG lOffset = 0; PVOID pCmUnRegisterCallback = NULL; PVOID pCallbackListHead = NULL; // 先获取 CmUnRegisterCallback 函数地址 RtlInitUnicodeString(&ustrFuncName, L"CmUnRegisterCallback"); pCmUnRegisterCallback = MmGetSystemRoutineAddress(&ustrFuncName); if (NULL == pCmUnRegisterCallback) {return pCallbackListHead; } // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com>nt!CmUnRegisterCallback+0x6b:fffff806`3a4271ab 4533c0xorr8d,r8dfffff806`3a4271ae 488d542438leardx,[rsp+38h]fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)fffff806`3a4271bf 488bf8movrdi,raxfffff806`3a4271c2 4889442440movqword ptr [rsp+40h],raxfffff806`3a4271c7 4885c0testrax,raxfffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pAddress = SearchMemory(pCmUnRegisterCallback, (PVOID)((PUCHAR)pCmUnRegisterCallback + 0xFF), pSpecialData, ulSpecialDataSize); if (NULL == pAddress) {return pCallbackListHead; } // 先获取偏移再计算地址 lOffset = *(PLONG)((PUCHAR)pAddress + lSpecialOffset); pCallbackListHead = (PVOID)((PUCHAR)pAddress + lSpecialOffset + sizeof(LONG) + lOffset); return pCallbackListHead;}VOID UnDriver(PDRIVER_OBJECT Driver){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ PVOID pCallbackListHeadAddress = NULL; RTL_OSVERSIONINFOW osInfo = { 0 }; UCHAR pSpecialData[50] = { 0 }; ULONG ulSpecialDataSize = 0; LONG lSpecialOffset = 0; DbgPrint("hello lyshark.com \n"); // 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] /* lyshark.com> nt!CmUnRegisterCallback+0x6b: fffff806`3a4271ab 4533c0xorr8d,r8d fffff806`3a4271ae 488d542438leardx,[rsp+38h] fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)] fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414) fffff806`3a4271bf 488bf8movrdi,rax fffff806`3a4271c2 4889442440movqword ptr [rsp+40h],rax fffff806`3a4271c7 4885c0testrax,rax fffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch */ pSpecialData[0] = 0x48; pSpecialData[1] = 0x8D; pSpecialData[2] = 0x0D; ulSpecialDataSize = 3; // 根据特征码获取地址 pCallbackListHeadAddress = SearchCallbackListHead(pSpecialData, ulSpecialDataSize, lSpecialOffset); DbgPrint("[LyShark.com] CallbackListHead => %p \n", pCallbackListHeadAddress); Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}
推荐阅读
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Teambition企业内部应用开发指南
- Doris开发手记4:倍速性能提升,向量化导入的性能调优实践
- 驱动开发:内核枚举LoadImage映像回调
- 前端开发日常——CSS动画无限轮播
- git clone开启云上AI开发
- 驱动开发:内核枚举ShadowSSDT基址
- 【番外篇】Rust环境搭建+基础开发入门+Rust与.NET6、C++的基础运算性能比较
- 驱动开发:Win10内核枚举SSDT表基址
- Tomcat 调优之从 Linux 内核源码层面看 Tcp backlog
- 驱动开发:内核特征码扫描PE代码段