ntkrnlpa.exe的基址[源码分享]

XueTr当中用的方法。。没有完全还原。。根据它的思路写了下

1. 
   
2. #include <ntifs.h>
   
3. typedef BOOLEAN BOOL;
   
4. typedef unsigned long DWORD;
   
5. typedef DWORD * LPDWORD;
   
6. typedef DWORD * PDWORD;
   
7. typedef unsigned long ULONG;
   
8. typedef unsigned short WORD;
   
9. typedef unsigned char BYTE;
   
10. typedef unsigned int UINT;
    
11. 
    
12. typedef struct _LDR_DATA_TABLE_ENTRY {
    
13. LIST_ENTRY InLoadOrderLinks;
    
14. LIST_ENTRY InMemoryOrderLinks;
    
15. LIST_ENTRY InInitializationOrderLinks;
    
16. PVOID DllBase;
    
17. PVOID EntryPoint;
    
18. ULONG SizeOfImage;
    
19. UNICODE_STRING FullDllName;
    
20. UNICODE_STRING BaseDllName;
    
21. ULONG Flags;
    
22. USHORT LoadCount;
    
23. USHORT TlsIndex;
    
24. union {
    
25.    LIST_ENTRY HashLinks;
    
26.    struct {
    
27.     PVOID SectionPointer;
    
28.     ULONG CheckSum;
    
29.    };
    
30. };
    
31. union {
    
32.    struct {
    
33.     ULONG TimeDateStamp;
    
34.    };
    
35.    struct {
    
36.     PVOID LoadedImports;
    
37.    };
    
38. };
    
39. PVOID EntryPointActivationContext;
    
40. PVOID PatchInformation;
    
41. } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
    
42. 
    
43. BOOL GetSystemKernelModuleInfo(PDRIVER_OBJECT DriverObject,DWORD DriverEntryRetAddress,WCHAR **SystemKernelModulePath,PDWORD SystemKernelModuleBase)
    
44. {
    
45. PLDR_DATA_TABLE_ENTRY DriverSection,LdrEntry;
    
46. int FullDllNameLength;
    
47. int Index;
    
48. WCHAR *FullDllNameBuffer;
    
49. int Len=0;
    
50. DriverSection=DriverObject->DriverSection;
    
51. LdrEntry=(PLDR_DATA_TABLE_ENTRY)DriverSection->InLoadOrderLinks.Flink;
    
52. while (LdrEntry&&DriverSection!=LdrEntry)
    
53. {
    
54.    
    
55.    if ((DWORD)LdrEntry->DllBase>=*(DWORD*)MmSystemRangeStart&&
    
56.     DriverEntryRetAddress>=(DWORD)LdrEntry->DllBase&&
    
57.     DriverEntryRetAddress<((DWORD)LdrEntry->DllBase+LdrEntry->SizeOfImage)&&
    
58.     (DWORD)LdrEntry->DllBase<0x90000000&&
    
59.     LdrEntry->FullDllName.Length>4&&
    
60.     LdrEntry->FullDllName.Buffer!=NULL)
    
61.    {
    
62. 
    
63.     if (MmIsAddressValid(&(LdrEntry->FullDllName.Buffer[LdrEntry->FullDllName.Length/2-1])))
    
64.      {
    
65.           break;
    
66. 
    
67.      }
    
68. 
    
69.     }
    
70.    LdrEntry=(PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink;
    
71. }
    
72. if (LdrEntry==NULL||LdrEntry==DriverSection)
    
73. {
    
74.    *SystemKernelModulePath=NULL;
    
75.    *SystemKernelModuleBase=0;
    
76.    return FALSE;
    
77. }
    
78. FullDllNameBuffer=LdrEntry->FullDllName.Buffer;
    
79. FullDllNameLength=LdrEntry->FullDllName.Length/2;
    
80. *SystemKernelModulePath=ExAllocatePool(NonPagedPool,260*2);
    
81. if (*SystemKernelModulePath==NULL)
    
82. {
    
83.    *SystemKernelModuleBase=0;
    
84.    return FALSE;
    
85. }
    
86. RtlZeroMemory(*SystemKernelModulePath,260*2);
    
87. wcscpy(*SystemKernelModulePath,L"\\SystemRoot\\system32\");
    
88. Len=wcslen(*SystemKernelModulePath);
    
89. for (Index=FullDllNameLength-1;Index>0;Index--)
    
90. {
    
91.    if (FullDllNameBuffer[Index]==0x005C)
    
92.    {
    
93.     RtlCopyMemory(&(*SystemKernelModulePath)[Len],&FullDllNameBuffer[Index+1],(FullDllNameLength-Index-1)*2);
    
94.     *SystemKernelModuleBase=(DWORD)LdrEntry->DllBase;
    
95.     return TRUE;
    
96.    }
    
97. }
    
98. RtlCopyMemory(&(*SystemKernelModulePath)[Len],FullDllNameBuffer,FullDllNameLength);
    
99. *SystemKernelModuleBase=(DWORD)LdrEntry->DllBase;
    
100. return TRUE;
     
101. }
     
102. 
     
103. VOID DriverUnload(
     
104.       IN PDRIVER_OBJECT   DriverObject
     
105.       )
     
106. {
     
107. KdPrint(("Driver Unload Called\n"));
     
108. }
     
109. 
     
110. NTSTATUS DriverEntry(
     
111.       IN OUT PDRIVER_OBJECT   DriverObject,
     
112.       IN PUNICODE_STRING      RegistryPath
     
113.       )
     
114. {
     
115. DWORD ModuelBase;
     
116. WCHAR *ModuleBaseFullName;
     
117. DWORD RetAddress;
     
118. DriverObject->DriverUnload = DriverUnload;
     
119. RetAddress=*(DWORD*)((DWORD)&DriverObject-4);
     
120. if(!GetSystemKernelModuleInfo(DriverObject,RetAddress,&ModuleBaseFullName,&ModuelBase))
     
121. {
     
122.    return STATUS_SUCCESS;
     
123. }
     
124. KdPrint(("%S,%X\n",ModuleBaseFullName,ModuelBase));
     
125. return STATUS_SUCCESS;
     
126. }
     

复制代码