//测试环境：win7 32位
1 // DriverEntry.cpp
2
3 #include "ntddk.h"
4 #include <ntddvol.h>
5 #include <ntdef.h>
6 #include "header.h"
7
8 extern "C" POBJECT_TYPE ObGetObjectType(IN PVOID Object);
9 extern "C" NTSTATUS DefaultDispatch (
10 __in struct _DEVICE_OBJECT *DeviceObject,
11 __inout struct _IRP *Irp
12 )
13 {
14 Irp->IoStatus.Status = STATUS_SUCCESS;
15 Irp->IoStatus.Information = 0;
16 IoCompleteRequest(Irp, IO_NO_INCREMENT);
17
18 return STATUS_SUCCESS;
19 }
20 VOID DriverUnload (
21 __in struct _DRIVER_OBJECT *DriverObject
22 )
23 {
24
25 }
26
27 extern "C" void* GetPspCidTable()
28 {
29 UNICODE_STRING sysRoutineName;
30 RtlInitUnicodeString(&sysRoutineName, L"PsLookupProcessByProcessId");
31 PUCHAR pFun = (PUCHAR)MmGetSystemRoutineAddress(&sysRoutineName);
32 if (pFun)
33 {
34 do
35 {
36 if(!MmIsAddressValid(pFun) || !MmIsAddressValid((PUCHAR)pFun + 6))
37 {
38 return NULL;
39 }
40 if (*(PSHORT)pFun == 0X3D8B && *((PUCHAR)pFun + 6) == 0Xe8)
41 {
42 unsigned int pspCidTable = *((unsigned int *)((PUCHAR)pFun + 2));
43 DbgPrint("%x", pspCidTable);
44 return (void*)pspCidTable;
45 //break;
46 }
47 pFun++;
48 } while (1);
49 }
50 return NULL;
51 }
52
53 void EnumLevel1Tabel(PUCHAR pLevel1Table)
54 {
55 DbgPrint("Table1:%x\n", pLevel1Table);
56 PHANDLE_TABLE_ENTRY phte = (PHANDLE_TABLE_ENTRY)pLevel1Table;
57 for (ULONG i = 0; i < 512; i++) //512为一级表项数,单位:HANDLE_TABLE_ENTRY
58 {
59 PEPROCESS pProcess = (PEPROCESS)phte->Object;
60 POBJECT_TYPE objType;
61 objType = *PsProcessType;
62 pProcess = (PEPROCESS)((ULONG)pProcess & 0xfffffff8); //后三位不知干什么。
63 if (pProcess != NULL && objType == ObGetObjectType(pProcess))
64 {
65 DbgPrint("Process Name:%s\n", (PUCHAR)pProcess + 0x16c);
66 }
67 phte++;
68 }
69 }
70
71 void EnumLevel2Tabel(PULONG pLevel2Table)
72 {
73 DbgPrint("EnumLevel2Tabel:%x\n", pLevel2Table);
74 for (ULONG i = 0; i < 1024; i++) //1024为二级表项数,单位:PHANDLE_TABLE_ENTRY
75 {
76 if (*pLevel2Table != 0)
77 {
78 EnumLevel1Tabel((PUCHAR)*pLevel2Table);
79 }
80 else
81 {
82 break;
83 }
84 pLevel2Table++;
85 }
86 }
87 void EnumLevel3Tabel(PULONG pLevel3Table)
88 {
89 DbgPrint("EnumLevel3Tabel:%x\n", pLevel3Table);
90 for (ULONG i = 0; i < 32; i++) //32为三级表项数,单位:PHANDLE_TABLE_ENTRY*
91 {
92 if (*pLevel3Table != 0)
93 {
94 EnumLevel2Tabel((PULONG)*pLevel3Table);
95 }
96 else
97 {
98 break;
99 }
100 pLevel3Table++;
101 }
102 }
103 NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
104 {
105 for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
106 {
107 DriverObject->MajorFunction[i] = DefaultDispatch;
108 }
109 DriverObject->DriverUnload = DriverUnload;
110 PHANDLE_TABLE * pPspCidTable = (PHANDLE_TABLE* )GetPspCidTable();
111 if (pPspCidTable == NULL)
112 {
113 return STATUS_UNSUCCESSFUL;
114 }
115 __asm {int 3}
116 DbgPrint("pPspCidTable:%x\n", pPspCidTable);
117
118 PHANDLE_TABLE pspCidTable = *pPspCidTable;
119 ULONG level = pspCidTable->TableCode & 3; //取后2位，得出句柄表的级数。
120 PUCHAR tableBase = (PUCHAR)pspCidTable->TableCode - level;
121 DbgPrint("level:%d\n", level);
122 DbgPrint("tableBase:%d\n", tableBase);
123 switch(level)
124 {
125 case 0:
126 {
127 EnumLevel1Tabel((PUCHAR)tableBase);
128 }
129 break;
130 case 1:
131 {
132 EnumLevel2Tabel((PULONG)tableBase);
133 }
134 break;
135 case 2:
136 {
137 EnumLevel3Tabel((PULONG)tableBase);
138 }
139
140 }
141 return STATUS_SUCCESS;
142 }
1 //header.h
2 #ifndef HEADER_H
3 #define HEADER_H
4 typedef struct _HANDLE_TABLE
5 {
6 ULONG_PTR TableCode;
7 PEPROCESS QuotaProcess;
8 PVOID UniqueProcessId;
9 PVOID HandleLock;
10 LIST_ENTRY HandleTableList;
11 PVOID HandleContentionEvent;
12 PVOID DebugInfo;
13 LONG ExtraInfoPages;
14 union
15 {
16 ULONG Flags;
17 UCHAR StrictFIFO:1;
18 };
19 LONG FirstFreeHandle;
20 PVOID LastFreeHandleEntry;
21 LONG HandleCount;
22 ULONG NextHandleNeedingPool;
23 ULONG HandleCountHighWatermark;
24 }HANDLE_TABLE, *PHANDLE_TABLE;
25
26
27 typedef struct _HANDLE_TABLE_ENTRY
28 {
29 union
30 {
31 PVOID Object;
32 ULONG_PTR ObAttributes;
33 PVOID InfoTable;
34 ULONG_PTR Value;
35 };
36 union
37 {
38 ULONG GrantedAccess;
39 struct
40 {
41 USHORT GrantedAccessIndex;
42 USHORT CreatorBackTraceIndex;
43 };
44 LONG NextFreeTableEntry;
45 };
46 } HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
47 #endif
