typedef struct _EPROCESS { KPROCESS Pcb; EX_PUSH_LOCK ProcessLock;……
typedef struct _KPROCESS { DISPATCHER_HEADER Header; LIST_ENTRY ProfileListHead; ULONG_PTR DirectoryTableBase[2];……
switch(irpStack->Parameters.DeviceIoControl.IoControlCode) { case IOCTL_READMEM: pstReadInfo = Irp->AssociatedIrp.SystemBuffer; ntStatus = STATUS_SUCCESS; if ( pstReadInfo->ulLen > 1000 || irpStack->Parameters.DeviceIoControl.InputBufferLength < pstReadInfo->ulLen || pstReadInfo->ulStart >= (PVOID)0x80000000 || (ULONG)pstReadInfo->ulStart + pstReadInfo->ulLen >= 0x80000000) { DbgPrint( "Read range invalid\r\n"); ntStatus = STATUS_UNSUCCESSFUL; break; } __try { if (PsLookupProcessByProcessId((HANDLE)(pstReadInfo->ulPid),&pstEProcess) == STATUS_SUCCESS) { pbyBuff = (PUCHAR)ExAllocatePoolWithTag( NonPagedPool, pstReadInfo->ulLen, 'PMRD'); ASSERT( pbyBuff); } else { DbgPrint( "PsLookupProcessByProcessId fail\r\n"); ntStatus = STATUS_UNSUCCESSFUL; break; } ntStatus = ReadProcessMemory( pstEProcess, pbyBuff, pstReadInfo->ulStart, pstReadInfo->ulLen); if ( ntStatus == STATUS_SUCCESS) { RtlCopyMemory( pstReadInfo, pbyBuff, pstReadInfo->ulLen); } else { ntStatus = STATUS_UNSUCCESSFUL; break; } ExFreePool( pbyBuff); pbyBuff = NULL; } __except(1) { ntStatus=STATUS_UNSUCCESSFUL; } break;……
NTSTATUS ReadProcessMemory( PEPROCESS pstEProcess, PUCHAR pucBuff, PVOID pStart, ULONG ulLen){ PKPROCESS pstKProcess = NULL; PEPROCESS pstCurrent = NULL; ULONG ulPDT = 0; ULONG ulOldCr3 = 0; pstKProcess = &pstEProcess->Pcb; ulPDT = pstKProcess->DirectoryTableBase[0]; //load cr3 _asm { cli; mov eax, cr3; mov ulOldCr3, eax; mov eax, ulPDT; mov cr3,eax } _asm sti; RtlCopyMemory( pucBuff, pStart, ulLen); //直接复制内存 _asm cli; _asm { mov eax, ulOldCr3; mov cr3,eax; sti; } return STATUS_SUCCESS;}
联系客服