C++驱动层通过内核导出变量PsLoadedModuleList遍历获取驱动信息

LDR_DATA_TABLE_ENTRY结构：

typedef struct _LDR_DATA_TABLE_ENTRY {
	LIST_ENTRY InLoadOrderLinks;
	LIST_ENTRY InMemoryOrderLinks;
	LIST_ENTRY InInitializationOrderLinks;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STRING FullDllName;
	UNICODE_STRING BaseDllName;
	ULONG Flags;
	USHORT LoadCount;
	USHORT TlsIndex;
	union {
		LIST_ENTRY HashLinks;
		struct {
			PVOID SectionPointer;
			ULONG CheckSum;
		};
	};
	union {
		struct {
			ULONG TimeDateStamp;
		};
		struct {
			PVOID LoadedImports;
		};
	};
	struct _ACTIVATION_CONTEXT* EntryPointActivationContext;

	PVOID PatchInformation;

} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

关键遍历函数：

void EnumDriver()
{

	int count = 0;
	PLIST_ENTRY listHead = PsLoadedModuleList.Flink;
	PLIST_ENTRY entry= listHead;
	for (entry = listHead->Flink; entry != listHead && ++count < 500; entry = entry->Flink)
	{
		// 假定类型为LDR_DATA_TABLE_ENTRY
		PLDR_DATA_TABLE_ENTRY moduleEntry = CONTAINING_RECORD(entry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);

		// 获取模块名称，作为测试，只输出名称即可
		UNICODE_STRING moduleName = moduleEntry->BaseDllName;

		// 根据模块名获取PDRIVER_OBJECT
		//PDRIVER_OBJECT driverObject = NULL;

		DbgPrint("[%d] Name=[%ws]\n", count, moduleName.Buffer);
	}
}

×

*转载请注明出处：原文链接：https://cpp.vin/page/83.html