我有一个问题,想知道是否可以钩入Ring0 / Kernel以显示运行在内核中的已加载驱动程序列表?我需要编写驱动程序吗?
类似于如何轻松列出所有正在运行的进程。
哦,这是在C++ / Windows平台上进行的。
我有一个问题,想知道是否可以钩入Ring0 / Kernel以显示运行在内核中的已加载驱动程序列表?我需要编写驱动程序吗?
类似于如何轻松列出所有正在运行的进程。
哦,这是在C++ / Windows平台上进行的。
如我所评论的那样,使用driverquery
命令。
driverquery
Display a list of all installed device drivers and their properties.
Syntax
driverquery [/s Computer] [/u Domain\User /p Password]
[/fo {TABLE|LIST|CSV}] [/nh] [/v] [/si]
example
Show all installed device drivers in Table output:
driverquery
Show all installed device drivers in a CSV format:
DriverQuery /fo csv
Without a header:
DriverQuery /nh
Drivers that are not signed:
DriverQuery /si | findstr FALSE
Find drivers that are currently Running:
Driverquery.exe /v |findstr Running
Show installed device drivers on a remote machine
driverquery /s ipaddress
Show installed device drivers on server64 and authenticate as a different user:
driverquery /s server64 /u ss64Ddom\user123 /p p@sswor3d /fo list
Export a verbose listing of drivers to a file
driverquery /v /fo csv > T:\driverlist.csv
When running DriverQuery within PowerShell, the CSV output format can be used to turn the output into objects. The PowerShell function below turns DriverQuery into a graphical tool that will list drivers from both local and remote systems (assuming you have the appropriate permissions.)
function Show-DriverDialog {
param(
$ComputerName = $env:computername
)
driverquery.exe /S $ComputerName /FO CSV |
ConvertFrom-Csv |
Out-GridView -Title "Driver on \\$ComputerName"
来源:http://windows.commands.com/driverquery
特别注意事项:
Find drivers that are currently Running:
Driverquery.exe /v | findstr Running
你可以使用命令 sc
sc query type driver
这将为您提供当前正在运行的驱动程序的文本列表。 您可以尝试使用类似于运行/停止的标志。 从那里,只需使用短的批处理/ bash / python 命令即可获取服务名称。
sc query type= driver
。 - miran80你也可以编写一个驱动程序来列出 Windows 内核中所有正在运行的驱动程序,但这需要一些不正当的黑客手段来调用未记录的内核函数。首先,您必须声明 3 个内核函数:
#include <ntddk.h>
NTKERNELAPI
NTSTATUS
ObReferenceObjectByName(
PUNICODE_STRING ObjectPath,
ULONG Attributes,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID ParseContext,
PVOID* ObjectPtr
);
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryObject(
HANDLE DirectoryHandle,
PVOID Buffer,
ULONG Length,
BOOLEAN ReturnSingleEntry,
BOOLEAN RestartScan,
PULONG Context,
PULONG ReturnLength
);
NTSYSAPI
NTSTATUS
NTAPI
ZwOpenDirectoryObject(
PHANDLE DirectoryHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes
);
然后,您可以枚举加载的驱动程序中在\\Driver\\
命名空间中的所有内核对象:
NTSTATUS EnumerateDriversInDriverNamespace()
{
NTSTATUS status;
HANDLE directoryHandle;
UNICODE_STRING directoryName;
OBJECT_ATTRIBUTES objectAttributes;
ULONG context = 0;
ULONG returnLength;
POBJECT_DIRECTORY_INFORMATION objinf;
RtlInitUnicodeString(&directoryName, L"\\Driver");
InitializeObjectAttributes(&objectAttributes, &directoryName, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, NULL, NULL);
status = ZwOpenDirectoryObject(&directoryHandle, DIRECTORY_QUERY, &objectAttributes);
if (!NT_SUCCESS(status)) {
DbgPrintEx(0, 0, "Failed to open \\Driver namespace: 0x%x\n", status);
return status;
}
while (TRUE) {
status = ZwQueryDirectoryObject(directoryHandle, NULL, 0, TRUE, FALSE, &context, &returnLength);
if (status != STATUS_BUFFER_TOO_SMALL)
break;
objinf = ExAllocatePool(PagedPool, returnLength);
if (!objinf) {
ZwClose(directoryHandle);
DbgPrintEx(0, 0, "Failed to allocate in paged pool\n");
return STATUS_INSUFFICIENT_RESOURCES;
}
status = ZwQueryDirectoryObject(directoryHandle, objinf, returnLength, TRUE, FALSE, &context, &returnLength);
if (!NT_SUCCESS(status)) {
if (status == STATUS_NO_MORE_ENTRIES) {
DbgPrintEx(0, 0, "No more entries :(\n");
status = STATUS_SUCCESS;
}
else {
DbgPrintEx(0, 0, "Failed to query directory object: 0x%x\n", status);
}
break;
}
PUNICODE_STRING dName = (PUNICODE_STRING)&objinf->Name;
// dName here is the name of the driver
ExFreePool(objinf);
}
ZwClose(directoryHandle);
return status;
}
drivers
,但是我不确定这是否就是该命令,因为已经很长时间没有打开 Windows 了。 - oblitumdriverquery
:http://www.howtogeek.com/howto/windows-vista/generate-a-list-of-installed-drivers-from-the-command-line/ - oblitumsystem()
来进行任何操作 - 这是一个安全噩梦,绝不能使用。 - Jesper Juhl