首页 > WinDriver > WD-未文档化导出变量、函数和未导出函数取得函数地址方式
2013六月5

WD-未文档化导出变量、函数和未导出函数取得函数地址方式

[隐藏]

1.未文档化导出变量

extern声明即可:

extern POBJECT_TYPE IoDriverObjectType; // 直接使用IoDriverObjectType
extern POBJECT_TYPE *IoDriverObjectType;//使用*IoDriverObjectType;
extern PVOID *IoDriverObjectType;       //使用*IoDriverObjectType;

这三者效果一样!感觉DDK只认名字!

  

2.未文档化导出函数

1.使用MmGetSystemRoutineAddress加函数名去获取函数的地址

2.__declspec(dllimport) _stdcall KeAddSystemServiceTable(PVOID, PVOID, PVOID, PVOID, PVOID);这样定义即可

//1
__declspec(dllimport) _stdcall KeAddSystemServiceTable(PVOID, PVOID, PVOID, PVOID, PVOID);
PVOID addr1= KeAddSystemServiceTable;
 
//2
UNICODE_STRING functionName;
PVOID addr2= NULL;
RtlInitUnicodeString(&functionName, L"KeAddSystemServiceTable");
addr2 = MmGetSystemRoutineAddress(&functionName);

addr1等于addr2

 

3.未导出函数

特征码搜索即可

PVOID GetShadowTableAddress()
{
	UNICODE_STRING functionName;
	ULONG i = 0;
	ULONG DwordAtByte = 0;
	PUCHAR p = NULL;
	RtlInitUnicodeString(&functionName, L"KeAddSystemServiceTable");
	p = MmGetSystemRoutineAddress(&functionName);
	if (NULL == p)
	{
		return NULL;
	}
 
	// 开始循环找,找一页,指针递增1
	for (i=0;i<0x1024;i++,p++)
	{
		try
		{
			DwordAtByte = *(PULONG)p;
		}
		__except (EXCEPTION_EXECUTE_HANDLER)
		{
			return NULL;
		}
 
		if (MmIsAddressValid((PVOID)DwordAtByte))
		{
			if (0 == memcmp((PVOID)DwordAtByte, KeServiceDescriptorTable, 16))//对比前16字节 相同则找到
			{
				if ((PVOID)DwordAtByte == KeServiceDescriptorTable)//排除sstd
				{
					continue;
				}
 
				return DwordAtByte;
			}
		}
 
	}
 
	return NULL;
}


文章作者:hgy413
本文地址:https://hgy413.com/1468.html
版权所有 © 转载时必须以链接形式注明作者和原始出处!

73 Responses to “WD-未文档化导出变量、函数和未导出函数取得函数地址方式”

  1. #1 minecraft 回复 | 引用 Post:2018-10-04 08:44

    Hi, Neat post. There is an issue along with your website in internet
    explorer, might test this? IE nonetheless is the market leader
    and a large component to other folks will pass over
    your magnificent writing due to this problem.

  2. #2 minecraft 回复 | 引用 Post:2018-10-04 22:47

    Somebody essentially help to make severely posts I’d state.
    This is the very first time I frequented your website page and to this point?
    I amazed with the analysis you made to make this particular publish incredible.
    Fantastic task!

  3. #3 minecraft 回复 | 引用 Post:2018-10-05 15:47

    Yes! Finally someone writes about minecraft.

  4. #4 minecraft 回复 | 引用 Post:2018-10-07 20:01

    It’s very simple to find out any topic on net as compared to textbooks,
    as I found this post at this site.

  5. Good day! This is my first comment here so I just wanted to give
    a quick shout out and tell you I really enjoy reading through your blog
    posts. Can you recommend any other blogs/websites/forums that cover
    the same subjects? Thanks!

  6. Greetings from Carolina! I’m bored to death at work so I decided to browse your
    website on my iphone during lunch break. I really like the info you provide
    here and can’t wait to take a look when I get home. I’m amazed at how quick your blog loaded on my phone ..
    I’m not even using WIFI, just 3G .. Anyways, great
    blog!

  7. #7 tinder dating site 回复 | 引用 Post:2018-10-16 13:35

    Greate article. Keep posting such kind of information on your site.

    Im really impressed by it.
    Hello there, You have performed a fantastic job.

    I’ll certainly digg it and in my opinion recommend to my
    friends. I am sure they will be benefited from this web site.

  8. #8 Benefits of Coconut Oil 回复 | 引用 Post:2018-10-22 22:16

    Hmm is anyone else experiencing problems with the pictures
    on this blog loading? I’m trying to figure out if its a problem on my end or
    if it’s the blog. Any feed-back would be greatly
    appreciated.

  9. #9 Coconut Oil 回复 | 引用 Post:2018-10-23 01:59

    Hi there mates, nice paragraph and fastidious arguments
    commented at this place, I am truly enjoying by these.

  10. It’s awesome to go to see this site and reading the views of all colleagues on the topic of this paragraph, while I am also zealous of getting experience.

  11. #11 Sling TV 回复 | 引用 Post:2018-11-14 21:48

    Thanks a lot for sharing this with all folks you actually know what
    you’re talking about! Bookmarked. Please additionally talk over with
    my web site =). We can have a link alternate arrangement between us

  12. Hello There. I found your blog using msn. This is a really well written article.
    I’ll be sure to bookmark it and return to read more of your useful information. Thanks
    for the post. I’ll definitely comeback.

  13. #13 descargar facebook 回复 | 引用 Post:2018-11-22 10:48

    The other day, while I was at work, my cousin stole my iphone and tested to see if it can survive a 25 foot drop, just so she
    can be a youtube sensation. My iPad is now destroyed and she has 83
    views. I know this is entirely off topic but I had to share it with
    someone!

  14. #14 Eartha 回复 | 引用 Post:2020-05-14 14:53

    I’ll right away seize your rss feed as I can’t to find your
    e-mail subscription hyperlink or e-newsletter service.

    Do you have any? Kindly let me realize so that I could subscribe.

    Thanks.

  15. #15 Dinah 回复 | 引用 Post:2020-05-22 10:11

    Good day! This is my 1st comment here so I just wanted to give a quick shout out and say
    I genuinely enjoy reading through your blog posts.
    Can you suggest any other blogs/websites/forums that cover
    the same topics? Thanks a ton!

  16. #16 Collin 回复 | 引用 Post:2020-05-22 12:02

    Very good post. I will be experiencing a few of
    these issues as well..

  17. #17 Nathan 回复 | 引用 Post:2020-05-22 12:12

    Hmm it appears like your blog ate my first comment (it was extremely long) so I guess I’ll just sum it up what I submitted and say,
    I’m thoroughly enjoying your blog. I too am an aspiring blog writer but I’m still new to everything.
    Do you have any recommendations for novice blog writers?
    I’d genuinely appreciate it.

  18. #18 Charley 回复 | 引用 Post:2020-05-22 13:53

    Thanks in favor of sharing such a pleasant opinion, post is nice, thats why i have
    read it fully

  19. #19 Kurt 回复 | 引用 Post:2020-05-22 15:15

    My programmer is trying to convince me to move
    to .net from PHP. I have always disliked the idea because of the costs.
    But he’s tryiong none the less. I’ve been using Movable-type on various websites for about a year and am concerned about switching to another platform.

    I have heard great things about blogengine.net.
    Is there a way I can transfer all my wordpress content into it?
    Any help would be really appreciated!

  20. #20 Millie 回复 | 引用 Post:2020-05-22 15:18

    Awesome! Its truly amazing post, I have got much clear
    idea on the topic of from this article.

  21. #21 Delia 回复 | 引用 Post:2020-05-22 15:34

    Hi, I do believe this is a great web site. I stumbledupon it 😉
    I will return once again since i have bookmarked it.
    Money and freedom is the best way to change, may you
    be rich and continue to help other people.

  22. #22 Tammie 回复 | 引用 Post:2020-05-22 15:39

    Hi there, this weekend is fastidious in favor of me, because this time i am reading this great educational piece of writing here at my residence.

  23. #23 Ralf 回复 | 引用 Post:2020-05-22 16:00

    What’s up, I check your new stuff daily. Your humoristic style is awesome,
    keep up the good work!

  24. #24 Saul 回复 | 引用 Post:2020-05-22 16:01

    Hey, I think your site might be having browser compatibility issues.
    When I look at your blog in Firefox, it looks fine but when opening in Internet Explorer,
    it has some overlapping. I just wanted to give you a quick heads up!
    Other then that, wonderful blog!

  25. #25 discuss 回复 | 引用 Post:2020-05-22 16:56

    I’ll immediately take hold of your rss feed as I can’t to find
    your email subscription link or newsletter service.
    Do you have any? Kindly permit me know so that I may just subscribe.
    Thanks.

  26. #26 Marian 回复 | 引用 Post:2020-05-22 18:46

    I just like the valuable information you provide in your articles.
    I will bookmark your blog and take a look at once more right here regularly.
    I’m reasonably certain I will be told plenty of
    new stuff right right here! Best of luck for the next!

  27. #27 Leland 回复 | 引用 Post:2020-05-22 18:54

    Have you ever considered creating an ebook or guest authoring on other websites?

    I have a blog based on the same topics you discuss and would
    really like to have you share some stories/information. I know my readers
    would appreciate your work. If you are even remotely interested, feel free to shoot
    me an e-mail.

  28. #28 Cierra 回复 | 引用 Post:2020-05-22 19:06

    Thanks for finally writing about > blog topic < Loved it!

  29. #29 Rosalie 回复 | 引用 Post:2020-05-22 20:38

    It is perfect time to make some plans for the future and it’s time to be happy.

    I’ve read this post and if I could I wish to suggest you some interesting things or advice.
    Maybe you could write next articles referring to this article.
    I desire to read even more things about it!

  30. #30 Tandy 回复 | 引用 Post:2020-05-22 20:50

    I visited many web sites however the audio quality for audio songs current at this website is in fact wonderful.

  31. #31 Lena 回复 | 引用 Post:2020-05-22 20:57

    Hurrah, that’s what I was searching for, what a data!

    existing here at this blog, thanks admin of this web site.

  32. #32 Terrance 回复 | 引用 Post:2020-05-22 22:40

    I’m very pleased to discover this great site.
    I wanted to thank you for your time due to this
    fantastic read!! I definitely liked every bit
    of it and I have you saved as a favorite to look at new information in your
    blog.

  33. #33 Miguel 回复 | 引用 Post:2020-05-22 22:42

    Post writing is also a excitement, if you be acquainted with then you can write or else it is
    complicated to write.

  34. #34 Jolie 回复 | 引用 Post:2020-05-22 23:14

    You really make it appear so easy together with your presentation but I find this topic to be really
    something which I believe I’d by no means understand.
    It sort of feels too complicated and very large for me.
    I am having a look ahead on your next publish, I will try to get the
    grasp of it!

  35. #35 Alton 回复 | 引用 Post:2020-05-22 23:19

    Hey there would you mind letting me know which hosting company you’re working with?
    I’ve loaded your blog in 3 different browsers
    and I must say this blog loads a lot quicker then most.
    Can you suggest a good web hosting provider at a fair price?
    Thank you, I appreciate it!

  36. #36 Lucretia 回复 | 引用 Post:2020-05-22 23:54

    certainly like your web-site but you have to check the spelling on quite a few of your posts.
    Several of them are rife with spelling problems and I
    find it very bothersome to inform the reality on the other hand I will surely come again again.

  37. #37 Dessie 回复 | 引用 Post:2020-05-23 00:56

    I’m not sure where you’re getting your info, but great topic.
    I needs to spend some time learning more or understanding more.
    Thanks for fantastic information I was looking for this
    information for my mission.

  38. #38 Kimberly 回复 | 引用 Post:2020-05-23 01:07

    Hey there! Would you mind if I share your blog with my myspace group?

    There’s a lot of people that I think would really enjoy your content.

    Please let me know. Thank you

  39. #39 Stacia 回复 | 引用 Post:2020-05-23 01:14

    What’s up colleagues, its wonderful piece of writing on the topic of
    cultureand completely defined, keep it up all the time.

  40. #40 Silke 回复 | 引用 Post:2020-05-23 01:22

    Right away I am going away to do my breakfast, later than having my
    breakfast coming yet again to read other news.

  41. #41 Ashlee 回复 | 引用 Post:2020-05-23 02:05

    Hi to all, for the reason that I am actually eager of reading this web site’s post to be updated regularly.
    It carries good material.

  42. #42 Kandy 回复 | 引用 Post:2020-05-23 02:33

    This is a very good tip especially to those new to the blogosphere.
    Brief but very precise info… Thanks for sharing this one.
    A must read article!

  43. #43 Jade 回复 | 引用 Post:2020-05-23 03:44

    I am curious to find out what blog platform you’re using?
    I’m having some minor security problems with my latest site and I’d like to find something more secure.
    Do you have any solutions?

  44. #44 Tammie 回复 | 引用 Post:2020-05-23 04:25

    Thanks for finally writing about > blog topic < Liked it!

  45. #45 Kit 回复 | 引用 Post:2020-05-23 04:30

    Good site you have here.. It’s difficult to find good quality writing like yours nowadays.

    I truly appreciate people like you! Take care!!

  46. #46 Cyril 回复 | 引用 Post:2020-05-23 04:48

    Fastidious answer back in return of this difficulty with
    genuine arguments and explaining the whole thing regarding that.

  47. #47 discuss 回复 | 引用 Post:2020-05-23 04:56

    This post is in fact a good one it helps new net viewers, who are wishing for blogging.

  48. #48 Alphonso 回复 | 引用 Post:2020-05-23 05:14

    excellent issues altogether, you simply received a new
    reader. What could you suggest about your put up that you just made a few days in the past?
    Any positive?

  49. #49 Savannah 回复 | 引用 Post:2020-05-23 06:11

    Hello there, just became aware of your blog through Google,
    and found that it is really informative. I’m gonna watch out for brussels.
    I’ll be grateful if you continue this in future. Numerous people
    will be benefited from your writing. Cheers!

  50. #50 Ina 回复 | 引用 Post:2020-05-23 06:42

    What i do not realize is in reality how you are no longer really much more smartly-liked than you might be now.

    You are very intelligent. You understand thus significantly on the subject of this subject, made me personally believe it from
    so many numerous angles. Its like women and men are
    not involved except it is something to accomplish with Girl gaga!
    Your individual stuffs nice. All the time care for it up!

  51. #51 Jamaal 回复 | 引用 Post:2020-05-23 06:55

    An outstanding share! I have just forwarded this onto a co-worker who
    had been conducting a little research on this.
    And he actually bought me lunch because I discovered it for him…
    lol. So let me reword this…. Thanks for the meal!!

    But yeah, thanks for spending time to discuss this topic
    here on your web page.

  52. #52 Kelsey 回复 | 引用 Post:2020-05-23 07:05

    I’ve been browsing online more than three hours these days, yet I by no means found any attention-grabbing article like yours.
    It is pretty worth sufficient for me. Personally, if all web owners and bloggers made
    just right content as you probably did, the web will be much more
    useful than ever before.

  53. #53 situs judi online 回复 | 引用 Post:2020-05-23 07:08

    Helpful info. Fortunate me I discovered your web site accidentally, and I am surprised why this
    twist of fate did not came about in advance! I bookmarked it.

  54. #54 curso de drones sp 回复 | 引用 Post:2020-05-23 07:12

    I visit every day some blogs and sites to read articles or reviews, except
    this webpage offers quality based writing.

  55. #55 우리카지노 回复 | 引用 Post:2020-05-23 07:13

    Hi there friends, its great article about educationand entirely defined, keep it up
    all the time.

  56. It’s really very complex in this full of activity life
    to listen news on Television, therefore I simply use the web for that purpose, and get the
    most recent information.

  57. #57 volume pills coupon 回复 | 引用 Post:2020-05-23 07:14

    Hi there! This post couldn’t be written any better!
    Looking at this post reminds me of my previous roommate! He always kept talking about this.
    I most certainly will forward this article to him. Fairly certain he’ll have a great read.
    Many thanks for sharing!

  58. #58 Meri 回复 | 引用 Post:2020-05-23 07:14

    Excellent site you have got here.. It’s difficult to
    find high-quality writing like yours these days.

    I truly appreciate people like you! Take care!!

  59. #59 Corazon 回复 | 引用 Post:2020-05-23 08:00

    Excellent article! We are linking to this particularly great article on our website.

    Keep up the great writing.

  60. #60 Brandie 回复 | 引用 Post:2020-05-23 08:09

    Fantastic post but I was wanting to know if you could write a litte more on this subject?
    I’d be very thankful if you could elaborate a little bit further.
    Thank you!

  61. #61 Damian 回复 | 引用 Post:2020-05-23 08:27

    Aw, this was an incredibly good post. Taking the time and actual effort to make
    a superb article… but what can I say… I put things off a lot and never manage to get nearly
    anything done.

  62. #62 Miles 回复 | 引用 Post:2020-05-23 08:48

    I blog often and I genuinely appreciate your content. This great
    article has really peaked my interest. I will bookmark your site and keep checking for new information about once per week.
    I subscribed to your RSS feed too.

  63. #63 Frankie 回复 | 引用 Post:2020-05-23 10:46

    For most recent news you have to go to see world-wide-web and on world-wide-web I found this website as a best website for
    most up-to-date updates.

  64. #64 Catharine 回复 | 引用 Post:2020-05-23 11:07

    Thanks for sharing your thoughts about website.

    Regards

  65. #65 Lynn 回复 | 引用 Post:2020-05-23 12:17

    Today, I went to the beach front with my children. I found a sea
    shell and gave it to my 4 year old daughter and said “You can hear the ocean if you put this to your ear.” She
    placed the shell to her ear and screamed. There was a hermit crab inside and it pinched her ear.
    She never wants to go back! LoL I know this is entirely off topic
    but I had to tell someone!

  66. #66 Marguerite 回复 | 引用 Post:2020-05-23 12:24

    Very nice post. I simply stumbled upon your weblog and wished to say that I have really enjoyed surfing around your blog
    posts. In any case I will be subscribing to your rss feed
    and I hope you write once more very soon!

  67. #67 Arlie 回复 | 引用 Post:2020-05-23 12:50

    My coder is trying to convince me to move to .net from PHP.
    I have always disliked the idea because of the expenses.
    But he’s tryiong none the less. I’ve been using Movable-type on a number of websites for
    about a year and am concerned about switching to
    another platform. I have heard good things about blogengine.net.

    Is there a way I can import all my wordpress posts into it?
    Any kind of help would be greatly appreciated!

  68. #68 Fiona 回复 | 引用 Post:2020-05-23 13:50

    I’m truly enjoying the design and layout of your site.
    It’s a very easy on the eyes which makes it much more pleasant for me to come
    here and visit more often. Did you hire out a developer to create your theme?
    Fantastic work!

  69. #69 Sonia 回复 | 引用 Post:2020-05-23 16:54

    I know this web page presents quality dependent articles or reviews and extra stuff,
    is there any other web page which provides these kinds of
    things in quality?

  70. #70 so g 回复 | 引用 Post:2020-06-10 18:58

    I don’t even know the way I stopped up here, but I thought this post used to be great.
    I don’t recognise who you’re however certainly you’re going to a famous blogger for
    those who aren’t already. Cheers!

  71. #71 in g 回复 | 引用 Post:2020-06-12 00:56

    Excellent items from you, man. I have remember your stuff previous to and you are just too fantastic.
    I really like what you’ve received right here, certainly like what you’re stating and the way in which during
    which you assert it. You’re making it enjoyable and you still care
    for to stay it smart. I can’t wait to read far more from you.
    This is actually a tremendous web site.

  72. #72 g 回复 | 引用 Post:2020-06-12 22:44

    Do you have any video of that? I’d like to find out
    some additional information.

  73. #73 g 回复 | 引用 Post:2020-06-12 23:35

    I’m gone to say to my little brother, that he should also visit this blog
    on regular basis to take updated from newest news.

发表评论