Object Hook原始地址查找

冷不防 2022-07-21 01:55 125阅读 0赞

写的Object Hook原始地址查找通用性似乎还可以

2009-02-15 11:46

<table style="color:rgb(51,51,51); font-family:Arial; font-size:14px; line-height:26px; width:708px; table-layout:fixed"> 
 <tbody> 
 <tr> 
 <td> 
 <div> 
 如题。 
 有关于SecurityProcedure： 
 部分ObjectType在创建的时候没有提供SecurityProcedure，所以无法得到，但是ObCreateObjectType发现SecurityProcedure被提供为NULL的时候会自行设置为SeDefaultObjectMethod，这导致了搜索结果为NULL而实际结果不为NULL。 
 试图加载 ntkrnlpa.exe. 成功加载 ntkrnlpa.exe. 成功创建 Section. 成功映射 Section 于 7FD90000 长度 2150400 , 状态号 1073741827 . 开始查找 Object Procedure. 开始查找 Process. OpenProcedure: 00000000 CloseProcedure: 00000000 DeleteProcedure: 004FACDC DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 00000000 QueryNameProcedure: 00000000 SecurityProcedure: 00000000 开始查找 Thread. OpenProcedure: 00000000 CloseProcedure: 00000000 DeleteProcedure: 004FAE64 DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 00000000 QueryNameProcedure: 00000000 SecurityProcedure: 00000000 开始查找 KeyObject. OpenProcedure: 00000000 CloseProcedure: 0056006E DeleteProcedure: 0055FF54 DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 00557F1C QueryNameProcedure: 0055EDEE SecurityProcedure: 0055FDB8 开始查找 File. OpenProcedure: 00000000 CloseProcedure: 004AC6E8 DeleteProcedure: 004AC9C6 DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 004AC5D6 QueryNameProcedure: 004AB680 SecurityProcedure: 004ACD4A 开始查找 Driver. OpenProcedure: 00000000 CloseProcedure: 00000000 DeleteProcedure: 004AC62E DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 00000000 QueryNameProcedure: 00000000 SecurityProcedure: 00000000 开始查找 Device. OpenProcedure: 00000000 CloseProcedure: 00000000 DeleteProcedure: 004AC6A8 DumpProcedure: 00000000 OkayToCloseProcedure: 00000000 ParseProcedure: 004AB7E8 QueryNameProcedure: 00000000 SecurityProcedure: 004ACD4A 查找 Object Procedure 完成. 退出. 
 
 lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(PsProcessType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0xb0 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f0fff &nbsp;&nbsp; +0x01c SecurityRequired : 0x1 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0 ( NonPagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0x1000 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0x290 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x038 DeleteProcedure : 0x805d2cdc&nbsp;&nbsp;&nbsp;&nbsp; void nt!PspProcessDelete+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x040 SecurityProcedure : 0x805f9150&nbsp;&nbsp;&nbsp;&nbsp; long nt!SeDefaultObjectMethod+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : (null)&nbsp; &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null)&nbsp; lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(PsThreadType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0xb0 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f03ff &nbsp;&nbsp; +0x01c SecurityRequired : 0x1 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0 ( NonPagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0x288 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x038 DeleteProcedure : 0x805d2e64&nbsp;&nbsp;&nbsp;&nbsp; void nt!PspThreadDelete+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x040 SecurityProcedure : 0x805f9150&nbsp;&nbsp;&nbsp;&nbsp; long nt!SeDefaultObjectMethod+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : (null)&nbsp; &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null)&nbsp; lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(CmpKeyObjectType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0x1 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0x30 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f003f &nbsp;&nbsp; +0x01c SecurityRequired : 0x1 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 1 ( PagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0x74 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : 0x8063806e&nbsp;&nbsp;&nbsp;&nbsp; void nt!CmpCloseKeyObject+0 &nbsp;&nbsp; +0x038 DeleteProcedure : 0x80637f54&nbsp;&nbsp;&nbsp;&nbsp; void nt!CmpDeleteKeyObject+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : 0x8062ff1c&nbsp;&nbsp;&nbsp;&nbsp; long nt!CmpParseKey+0 &nbsp;&nbsp; +0x040 SecurityProcedure : 0x80637db8&nbsp;&nbsp;&nbsp;&nbsp; long nt!CmpSecurityMethod+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : 0x80636dee&nbsp;&nbsp;&nbsp;&nbsp; long nt!CmpQueryKeyName+0 &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null)&nbsp; lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(IoFileObjectType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0x1 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0x130 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f01ff &nbsp;&nbsp; +0x01c SecurityRequired : 0 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0x1 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0 ( NonPagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0x400 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0xe8 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : 0x805846e8&nbsp;&nbsp;&nbsp;&nbsp; void nt!IopCloseFile+0 &nbsp;&nbsp; +0x038 DeleteProcedure : 0x805849c6&nbsp;&nbsp;&nbsp;&nbsp; void nt!IopDeleteFile+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : 0x805845d6&nbsp;&nbsp;&nbsp;&nbsp; long nt!IopParseFile+0 &nbsp;&nbsp; +0x040 SecurityProcedure : 0x80584d4a&nbsp;&nbsp;&nbsp;&nbsp; long nt!IopGetSetSecurityObject+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : 0x80583680&nbsp;&nbsp;&nbsp;&nbsp; long nt!IopQueryName+0 &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null)&nbsp; lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(IoDriverObjectType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0x1 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0x1 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0x100 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f01ff &nbsp;&nbsp; +0x01c SecurityRequired : 0 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0 ( NonPagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0xd8 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x038 DeleteProcedure : 0x8058462e&nbsp;&nbsp;&nbsp;&nbsp; void nt!IopDeleteDriver+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x040 SecurityProcedure : 0x805f9150&nbsp;&nbsp;&nbsp;&nbsp; long nt!SeDefaultObjectMethod+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : (null)&nbsp; &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null)&nbsp; lkd&gt; dt _OBJECT_TYPE_INITIALIZER poi(IoDeviceObjectType)+0x60 nt!_OBJECT_TYPE_INITIALIZER &nbsp;&nbsp; +0x000 Length&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0x4c &nbsp;&nbsp; +0x002 UseDefaultObject : 0x1 '' &nbsp;&nbsp; +0x003 CaseInsensitive : 0x1 '' &nbsp;&nbsp; +0x004 InvalidAttributes : 0x100 &nbsp;&nbsp; +0x008 GenericMapping&nbsp;&nbsp; : _GENERIC_MAPPING &nbsp;&nbsp; +0x018 ValidAccessMask : 0x1f01ff &nbsp;&nbsp; +0x01c SecurityRequired : 0 '' &nbsp;&nbsp; +0x01d MaintainHandleCount : 0 '' &nbsp;&nbsp; +0x01e MaintainTypeList : 0 '' &nbsp;&nbsp; +0x020 PoolType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 0 ( NonPagedPool ) &nbsp;&nbsp; +0x024 DefaultPagedPoolCharge : 0 &nbsp;&nbsp; +0x028 DefaultNonPagedPoolCharge : 0xe8 &nbsp;&nbsp; +0x02c DumpProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x030 OpenProcedure&nbsp;&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x034 CloseProcedure&nbsp;&nbsp; : (null)&nbsp; &nbsp;&nbsp; +0x038 DeleteProcedure : 0x805846a8&nbsp;&nbsp;&nbsp;&nbsp; void nt!IopDeleteDevice+0 &nbsp;&nbsp; +0x03c ParseProcedure&nbsp;&nbsp; : 0x805837e8&nbsp;&nbsp;&nbsp;&nbsp; long nt!IopParseDevice+0 &nbsp;&nbsp; +0x040 SecurityProcedure : 0x80584d4a&nbsp;&nbsp;&nbsp;&nbsp; long nt!IopGetSetSecurityObject+0 &nbsp;&nbsp; +0x044 QueryNameProcedure : (null)&nbsp; &nbsp;&nbsp; +0x048 OkayToCloseProcedure : (null) 
 </div> </td> 
 </tr> 
 </tbody> 
</table>