枚举ssdt 地址表

来源：互联网发布：农村淘宝 app 下载编辑：程序博客网时间：2024/06/06 00:04

dd keserviceDescriptorTable
查看地址

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
PVOID ServiceTableBase; //基址
PULONG ServiceCounterTableBase;
ULONG NumberOfService; //个数函数
ULONG ParamTableBase;//sspt 表
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;

这里写图片描述
实现代码如下

#ifndef CXX_ENUMSSDT_H#include "EnumSSDT.h"#endif//#include "struct.h"extern "C"  KeServiceDescriptorTable;VOIDDriverUnload(__in struct _DRIVER_OBJECT *DriverObject){       KdPrint(("驱动卸载成功!"));}extern "C"NTSTATUSDriverEntry(IN PDRIVER_OBJECT pDriverObj, IN PUNICODE_STRING pRegistryString){    KdPrint(("驱动加载成功!"));    ULONG uBaaseAddress=*(PULONG)KeServiceDescriptorTable;    int uCount=*(PULONG)(KeServiceDescriptorTable+8);    KdPrint(("base address:%x,%x",uBaaseAddress,uCount));    int i=0;    for (i=0;i<uCount;i++)    {    KdPrint(("num:%d ,ssdt address:%X",i,*(PULONG)(uBaaseAddress+i*4)));    }    pDriverObj->DriverUnload = DriverUnload;    return 0;}

Debug view查看输出地址和pchunter 地址对应
枚举成功

这里写图片描述

0 0