C++驱动层通过LDR_DATA_TABLE_ENTRY遍历所有驱动信息

//结构
typedef struct _LDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	union {
		LIST_ENTRY HashLinks;
		struct {
			PVOID SectionPointer;
			ULONG CheckSum;
		};
	};
	union {
		struct {
			ULONG TimeDateStamp;
		};
		struct {
			PVOID LoadedImports;
		};
	};
}LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

传入PDRIVER_OBJECT 

void printLdrList(PDRIVER_OBJECT DriverObject) {
	PLDR_DATA_TABLE_ENTRY pDriverList;
	PLIST_ENTRY pCurrentList;
	pDriverList = (PLDR_DATA_TABLE_ENTRY)(DriverObject->DriverSection);
	pCurrentList = (PLIST_ENTRY)pDriverList;//FFFF93885FACAE30
	while (((PLIST_ENTRY)pDriverList)->Blink != pCurrentList)
	{
		DbgPrint("[%p]DllBase=0x%p，SizeOfImage=0x%d，DriverName=%ws\n", pDriverList, pDriverList->DllBase, pDriverList->SizeOfImage, (pDriverList->BaseDllName).Buffer);
		pDriverList = ((PLIST_ENTRY)pDriverList)->Blink;
	}
}

×

*转载请注明出处：原文链接：https://cpp.vin/page/82.html