x64 驱动测试用户是否共享内核空间 和内核模块遍历_内核遍历模块

windows10 x64 驱动测试

在任意内核空间存放 ULONG x = 0x123456;

NTSTATUS DriverUnload(PDRIVER_OBJECT DriverObject)
{
	DbgPrint("Driver Exit \r\n");
	return STATUS_SUCCESS;

}
ULONG x = 0x123456;
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Regedit)
{
	DbgPrint("Driver Load \r\n");
	
	DbgPrint("x = %p\n",&x);

	//HideThread("Project3.exe");
	DriverObject->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

#x的内核地址为：fffff8052b103000 ##在附加任何用户程序的process地址 可以查看到 fffff8052b103000 00123456

kd> .process ffffbf0f64cac080
kd> dd ffffF8052B103000
fffff805`2b103000  00123456  00000000 604e4127 00000965
fffff805`2b103010  9fb1bed8 fffff69a 00000000 00000000
fffff805`2b103020  00000000 00000000 00000000 00000000
fffff805`2b103030  00000000 00000000 00000000 00000000
fffff805`2b103040  00000000 00000000 00000000 00000000
fffff805`2b103050  00000000 00000000 00000000 00000000
fffff805`2b103060  00000000 00000000 00000000 00000000
fffff805`2b103070  00000000 00000000 00000000 00000000
1
2
3
4
5
6
7
8
9
10

fffff805`2b103000 00123456 表明了还是共享内核空间

windows10 x64 内核模块遍历

一

kd> dt _DRIVER_OBJECT FFFFBF0F66179950
nt!_DRIVER_OBJECT
   +0x000 Type             : 0n4
   +0x002 Size             : 0n336
   +0x008 DeviceObject     : (null) 
   +0x010 Flags            : 0x12
   +0x018 DriverStart      : 0xfffff805`2b120000 Void
   +0x020 DriverSize       : 0x7000
   +0x028 DriverSection    : 0xffffbf0f`6124e280 Void
   +0x030 DriverExtension  : 0xffffbf0f`66179aa0 _DRIVER_EXTENSION
   +0x038 DriverName       : _UNICODE_STRING "\Driver\MyDriver2"
   +0x048 HardwareDatabase : 0xfffff805`13144990 _UNICODE_STRING "\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM"
   +0x050 FastIoDispatch   : (null) 
   +0x058 DriverInit       : 0xfffff805`2b125000     long  MyDriver2!GsDriverEntry+0
   +0x060 DriverStartIo    : (null) 
   +0x068 DriverUnload     : 0xfffff805`2b121060     void  MyDriver2!DriverUnload+0
   +0x070 MajorFunction    : [28] 0xfffff805`127596a0     long  nt!IopInvalidDeviceRequest+0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

注： +0x028 DriverSection : 0xffffbf0f`6124e280 指向一个_LDR_DATA_TABLE_ENTRY结构体
结构体InLoadOrderLinks 指向下一个内核模块，可以遍历所有内核模块

二

kd> dt _LDR_DATA_TABLE_ENTRY 0xffffbf0f`6124e280
nt!_LDR_DATA_TABLE_ENTRY
   +0x000 InLoadOrderLinks : _LIST_ENTRY [ 0xfffff805`13040270 - 0xffffbf0f`6103b2c0 ]
   +0x010 InMemoryOrderLinks : _LIST_ENTRY [ 0xfffff805`2b124000 - 0x00000000`00000030 ]
   +0x020 InInitializationOrderLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
   +0x030 DllBase          : 0xfffff805`2b120000 Void
   +0x038 EntryPoint       : 0xfffff805`2b125000 Void
   +0x040 SizeOfImage      : 0x7000
   +0x048 FullDllName      : _UNICODE_STRING "\??\C:\Users\mirsun\Desktop\MyDriver2.sys"
   +0x058 BaseDllName      : _UNICODE_STRING "MyDriver2.sys"
   +0x068 FlagGroup        : [4]  ""
   +0x068 Flags            : 0x49104000
   +0x068 PackagedBinary   : 0y0
   +0x068 MarkedForRemoval : 0y0
   +0x068 ImageDll         : 0y0
   +0x068 LoadNotificationsSent : 0y0
   +0x068 TelemetryEntryProcessed : 0y0
   +0x068 ProcessStaticImport : 0y0
   +0x068 InLegacyLists    : 0y0
   +0x068 InIndexes        : 0y0
   +0x068 ShimDll          : 0y0
   +0x068 InExceptionTable : 0y0
   +0x068 ReservedFlags1   : 0y00
   +0x068 LoadInProgress   : 0y0
   +0x068 LoadConfigProcessed : 0y0
   +0x068 EntryProcessed   : 0y1
   +0x068 ProtectDelayLoad : 0y0
   +0x068 ReservedFlags3   : 0y00
   +0x068 DontCallForThreads : 0y0

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30