驱动开发：内核枚举Registry注册表回调( 二 ) _生活百科

运行这段代码，并可得到注册表回调入口地址，输出效果如下所示：

文章插图
得到了注册表回调入口地址，接着直接循环遍历输出这个链表即可得到所有的注册表回调。

// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <windef.h>// 指定内存区域的特征码扫描// PowerBy: LyShark.comPVOID SearchMemory(PVOID pStartAddress, PVOID pEndAddress, PUCHAR pMemoryData, ULONG ulMemoryDataSize){	PVOID pAddress = NULL;	PUCHAR i = NULL;	ULONG m = 0;	// 扫描内存	for (i = (PUCHAR)pStartAddress; i < (PUCHAR)pEndAddress; i++)	{// 判断特征码for (m = 0; m < ulMemoryDataSize; m++){if (*(PUCHAR)(i + m) != pMemoryData[m]){break;}}// 判断是否找到符合特征码的地址if (m >= ulMemoryDataSize){// 找到特征码位置, 获取紧接着特征码的下一地址pAddress = (PVOID)(i + ulMemoryDataSize);break;}	}	return pAddress;}// 根据特征码获取 CallbackListHead 链表地址// PowerBy: LyShark.comPVOID SearchCallbackListHead(PUCHAR pSpecialData, ULONG ulSpecialDataSize, LONG lSpecialOffset){	UNICODE_STRING ustrFuncName;	PVOID pAddress = NULL;	LONG lOffset = 0;	PVOID pCmUnRegisterCallback = NULL;	PVOID pCallbackListHead = NULL;	// 先获取 CmUnRegisterCallback 函数地址	RtlInitUnicodeString(&ustrFuncName, L"CmUnRegisterCallback");	pCmUnRegisterCallback = MmGetSystemRoutineAddress(&ustrFuncName);	if (NULL == pCmUnRegisterCallback)	{return pCallbackListHead;	}	// 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]	/*	lyshark.com>nt!CmUnRegisterCallback+0x6b:fffff806`3a4271ab 4533c0xorr8d,r8dfffff806`3a4271ae 488d542438leardx,[rsp+38h]fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)fffff806`3a4271bf 488bf8movrdi,raxfffff806`3a4271c2 4889442440movqword ptr [rsp+40h],raxfffff806`3a4271c7 4885c0testrax,raxfffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch	*/	pAddress = SearchMemory(pCmUnRegisterCallback, (PVOID)((PUCHAR)pCmUnRegisterCallback + 0xFF), pSpecialData, ulSpecialDataSize);	if (NULL == pAddress)	{return pCallbackListHead;	}	// 先获取偏移再计算地址	lOffset = *(PLONG)((PUCHAR)pAddress + lSpecialOffset);	pCallbackListHead = (PVOID)((PUCHAR)pAddress + lSpecialOffset + sizeof(LONG) + lOffset);	return pCallbackListHead;}// 注册表回调函数结构体定义typedef struct _CM_NOTIFY_ENTRY{	LIST_ENTRYListEntryHead;	ULONGUnKnown1;	ULONGUnKnown2;	LARGE_INTEGER Cookie;	PVOIDContext;	PVOIDFunction;}CM_NOTIFY_ENTRY, *PCM_NOTIFY_ENTRY;VOID UnDriver(PDRIVER_OBJECT Driver){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){	PVOID pCallbackListHeadAddress = NULL;	RTL_OSVERSIONINFOW osInfo = { 0 };	UCHAR pSpecialData[50] = { 0 };	ULONG ulSpecialDataSize = 0;	LONG lSpecialOffset = 0;	DbgPrint("hello lyshark.com \n");	// 查找 fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]	/*	lyshark.com>	nt!CmUnRegisterCallback+0x6b:	fffff806`3a4271ab 4533c0xorr8d,r8d	fffff806`3a4271ae 488d542438leardx,[rsp+38h]	fffff806`3a4271b3 488d0d06eac3fflearcx,[nt!CallbackListHead (fffff806`3a065bc0)]	fffff806`3a4271ba e855e2e2ffcallnt!CmListGetNextElement (fffff806`3a255414)	fffff806`3a4271bf 488bf8movrdi,rax	fffff806`3a4271c2 4889442440movqword ptr [rsp+40h],rax	fffff806`3a4271c7 4885c0testrax,rax	fffff806`3a4271ca 0f84c7000000jent!CmUnRegisterCallback+0x157 (fffff806`3a427297)Branch	*/	pSpecialData[0] = 0x48;	pSpecialData[1] = 0x8D;	pSpecialData[2] = 0x0D;	ulSpecialDataSize = 3;	// 根据特征码获取地址	pCallbackListHeadAddress = SearchCallbackListHead(pSpecialData, ulSpecialDataSize, lSpecialOffset);	DbgPrint("[LyShark.com] CallbackListHead => %p \n", pCallbackListHeadAddress);	// 遍历链表结构	ULONG i = 0;	PCM_NOTIFY_ENTRY pNotifyEntry = NULL;	if (NULL == pCallbackListHeadAddress)	{return FALSE;	}	// 开始遍历双向链表	pNotifyEntry = (PCM_NOTIFY_ENTRY)pCallbackListHeadAddress;	do	{// 判断pNotifyEntry地址是否有效if (FALSE == MmIsAddressValid(pNotifyEntry)){break;}// 判断回调函数地址是否有效if (MmIsAddressValid(pNotifyEntry->Function)){DbgPrint("[LyShark.com] 回调函数地址: 0x%p | 回调函数Cookie: 0x%I64X \n", pNotifyEntry->Function, pNotifyEntry->Cookie.QuadPart);}// 获取下一链表pNotifyEntry = (PCM_NOTIFY_ENTRY)pNotifyEntry->ListEntryHead.Flink;	} while (pCallbackListHeadAddress != (PVOID)pNotifyEntry);	Driver->DriverUnload = UnDriver;	return STATUS_SUCCESS;}

最终运行这个驱动程序，输出如下效果：