我正在编写一个驱动程序,以创建一个防病毒软件。然而,我在读取进程的导入地址表方面卡住了。
我有一个CreateProcessNotify:
同时还具有以下功能:
使用WinDBG进行调试时: 使用!analyze -v:
异常情况:
代码:
我借助于this实现了GetIAT。
正如您所看到的问题是它没有正确地获取IAT,但我不知道为什么...
提前感谢。
我有一个CreateProcessNotify:
VOID CreateProcNotify(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create)
{
UNREFERENCED_PARAMETER(ParentId);
UNREFERENCED_PARAMETER(Create);
PEPROCESS Process;
KAPC_STATE Apc;
PVOID ModuleBase;
// From PID to PEPROCESS
PsLookupProcessByProcessId(ProcessId, &Process);
// Attach into the target process' memory
KeStackAttachProcess(Process, &Apc);
ModuleBase = GetModuleBase(Process);
PIMAGE_IMPORT_DESCRIPTOR pImportAddressTable = GetIAT(ModuleBase);
DPrint("Imports of [Meias] are: \n");
DPrint("IAT: %x\n", pImportAddressTable);
// Iterate all Modules Imports
while (pImportAddressTable->Name != 0) {
DPrint("{%s}, ", (PCHAR)((ULONG)ModuleBase + (pImportAddressTable->Name)));
pImportAddressTable++;
}
// Unattach ourselves from the target process' memory
KeUnstackDetachProcess(&Apc);
}
同时还具有以下功能:
/*Returns the Base of the Process*/
PVOID GetModuleBase(PEPROCESS Process)
{
PVOID ModuleBase;
__try
{
ModuleBase = PsGetProcessSectionBaseAddress(Process);
}
__except (GetExceptionCode())
{
return 0;
}
return ModuleBase;
}
/*Returns the Import Address Table*/
PIMAGE_IMPORT_DESCRIPTOR GetIAT(PVOID ModuleBase)
{
PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)ModuleBase;
PIMAGE_NT_HEADERS32 pNtHeader32 = NULL;
PIMAGE_NT_HEADERS64 pNtHeader64 = NULL;
PIMAGE_IMPORT_DESCRIPTOR pIAT = NULL;
if (ModuleBase == 0)
return NULL;
DPrint("ModuleBase: 0x%x\n", pDosHeader);
// If the magic value isn't MZ then isn't a valid PE
if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
return NULL;
pNtHeader32 = (PIMAGE_NT_HEADERS32)((PUCHAR)ModuleBase + pDosHeader->e_lfanew);
pNtHeader64 = (PIMAGE_NT_HEADERS64)((PUCHAR)ModuleBase + pDosHeader->e_lfanew);
// If the image doesn't have a DOS
if ((INT)pNtHeader32 != IMAGE_NT_SIGNATURE)
return NULL;
// Check if is 32 bit
if (pNtHeader32->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
pIAT = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG_PTR)ModuleBase + pNtHeader32->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
}
// Check if is 64 bit
else if (pNtHeader64->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
pIAT = (PIMAGE_IMPORT_DESCRIPTOR)((ULONG_PTR)ModuleBase + pNtHeader64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
}
return pIAT;
}
使用WinDBG进行调试时: 使用!analyze -v:
异常情况:
![enter image description here](https://istack.dev59.com/uhT4D.webp)
![enter image description here](https://istack.dev59.com/d3lwN.webp)
正如您所看到的问题是它没有正确地获取IAT,但我不知道为什么...
提前感谢。