驱动开发：内核枚举进程与线程ObCall回调

在笔者上一篇文章《驱动开发：内核枚举Registry注册表回调》中我们通过特征码定位实现了对注册表回调的枚举，本篇文章LyShark将教大家如何枚举系统中的ProcessObCall进程回调以及ThreadObCall线程回调，之所以放在一起来讲解是因为这两中回调在枚举是都需要使用通用结构体_OB_CALLBACK以及_OBJECT_TYPE所以放在一起来讲解最好不过。

我们来看一款闭源ARK工具是如何实现的：

首先我们需要定义好结构体，结构体是微软公开的，如果有其它需要请自行去微软官方去查。

typedef struct _OBJECT_TYPE_INITIALIZER

{

	USHORT Length;                // Uint2B

	UCHAR ObjectTypeFlags;            // UChar

	ULONG ObjectTypeCode;             // Uint4B

	ULONG InvalidAttributes;          // Uint4B

	GENERIC_MAPPING GenericMapping;   // _GENERIC_MAPPING

	ULONG ValidAccessMask;       // Uint4B

	ULONG RetainAccess;         // Uint4B

	POOL_TYPE PoolType;        // _POOL_TYPE

	ULONG DefaultPagedPoolCharge;  // Uint4B

	ULONG DefaultNonPagedPoolCharge; // Uint4B

	PVOID DumpProcedure;       // Ptr64     void

	PVOID OpenProcedure;      // Ptr64     long

	PVOID CloseProcedure;     // Ptr64     void

	PVOID DeleteProcedure;        // Ptr64     void

	PVOID ParseProcedure;     // Ptr64     long

	PVOID SecurityProcedure;      // Ptr64     long

	PVOID QueryNameProcedure;     // Ptr64     long

	PVOID OkayToCloseProcedure;     // Ptr64     unsigned char

	ULONG WaitObjectFlagMask;     // Uint4B

	USHORT WaitObjectFlagOffset;    // Uint2B

	USHORT WaitObjectPointerOffset;   // Uint2B

}OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _OBJECT_TYPE

{

	LIST_ENTRY TypeList;           // _LIST_ENTRY

	UNICODE_STRING Name;         // _UNICODE_STRING

	PVOID DefaultObject;         // Ptr64 Void

	UCHAR Index;             // UChar

	ULONG TotalNumberOfObjects;      // Uint4B

	ULONG TotalNumberOfHandles;      // Uint4B

	ULONG HighWaterNumberOfObjects;    // Uint4B

	ULONG HighWaterNumberOfHandles;    // Uint4B

	OBJECT_TYPE_INITIALIZER TypeInfo;  // _OBJECT_TYPE_INITIALIZER

	EX_PUSH_LOCK TypeLock;         // _EX_PUSH_LOCK

	ULONG Key;                 // Uint4B

	LIST_ENTRY CallbackList;       // _LIST_ENTRY

}OBJECT_TYPE, *POBJECT_TYPE;

#pragma pack(1)

typedef struct _OB_CALLBACK

{

	LIST_ENTRY ListEntry;

	ULONGLONG Unknown;

	HANDLE ObHandle;

	PVOID ObTypeAddr;

	PVOID PreCall;

	PVOID PostCall;

}OB_CALLBACK, *POB_CALLBACK;

#pragma pack()

代码部分的实现很容易，由于进程与线程句柄的枚举很容易，直接通过(POBJECT_TYPE)(*PsProcessType))->CallbackList就可以拿到链表头结构，得到后将其解析为POB_CALLBACK并循环输出即可。

// 署名权

// right to sign one's name on a piece of work

// PowerBy: LyShark

// Email: me@lyshark.com

#include <ntifs.h>

#include <wdm.h>

#include <ntddk.h>

typedef struct _OBJECT_TYPE_INITIALIZER

{

	USHORT Length;                // Uint2B

	UCHAR ObjectTypeFlags;            // UChar

	ULONG ObjectTypeCode;             // Uint4B

	ULONG InvalidAttributes;          // Uint4B

	GENERIC_MAPPING GenericMapping;   // _GENERIC_MAPPING

	ULONG ValidAccessMask;       // Uint4B

	ULONG RetainAccess;         // Uint4B

	POOL_TYPE PoolType;        // _POOL_TYPE

	ULONG DefaultPagedPoolCharge;  // Uint4B

	ULONG DefaultNonPagedPoolCharge; // Uint4B

	PVOID DumpProcedure;       // Ptr64     void

	PVOID OpenProcedure;      // Ptr64     long

	PVOID CloseProcedure;     // Ptr64     void

	PVOID DeleteProcedure;        // Ptr64     void

	PVOID ParseProcedure;     // Ptr64     long

	PVOID SecurityProcedure;      // Ptr64     long

	PVOID QueryNameProcedure;     // Ptr64     long

	PVOID OkayToCloseProcedure;     // Ptr64     unsigned char

	ULONG WaitObjectFlagMask;     // Uint4B

	USHORT WaitObjectFlagOffset;    // Uint2B

	USHORT WaitObjectPointerOffset;   // Uint2B

}OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _OBJECT_TYPE

{

	LIST_ENTRY TypeList;           // _LIST_ENTRY

	UNICODE_STRING Name;         // _UNICODE_STRING

	PVOID DefaultObject;         // Ptr64 Void

	UCHAR Index;             // UChar

	ULONG TotalNumberOfObjects;      // Uint4B

	ULONG TotalNumberOfHandles;      // Uint4B

	ULONG HighWaterNumberOfObjects;    // Uint4B

	ULONG HighWaterNumberOfHandles;    // Uint4B

	OBJECT_TYPE_INITIALIZER TypeInfo;  // _OBJECT_TYPE_INITIALIZER

	EX_PUSH_LOCK TypeLock;         // _EX_PUSH_LOCK

	ULONG Key;                 // Uint4B

	LIST_ENTRY CallbackList;       // _LIST_ENTRY

}OBJECT_TYPE, *POBJECT_TYPE;

#pragma pack(1)

typedef struct _OB_CALLBACK

{

	LIST_ENTRY ListEntry;

	ULONGLONG Unknown;

	HANDLE ObHandle;

	PVOID ObTypeAddr;

	PVOID PreCall;

	PVOID PostCall;

}OB_CALLBACK, *POB_CALLBACK;

#pragma pack()

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

{

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)

{

	NTSTATUS status = STATUS_SUCCESS;

	DbgPrint("hello lyshark.com \n");

	POB_CALLBACK pObCallback = NULL;

	// 直接获取 CallbackList 链表

	LIST_ENTRY CallbackList = ((POBJECT_TYPE)(*PsProcessType))->CallbackList;

	// 开始遍历

	pObCallback = (POB_CALLBACK)CallbackList.Flink;

	do

	{

		if (FALSE == MmIsAddressValid(pObCallback))

		{

			break;

		}

		if (NULL != pObCallback->ObHandle)

		{

			// 显示

			DbgPrint("[LyShark.com] ObHandle = %p | PreCall = %p | PostCall = %p \n", pObCallback->ObHandle, pObCallback->PreCall, pObCallback->PostCall);

		}

		// 获取下一链表信息

		pObCallback = (POB_CALLBACK)pObCallback->ListEntry.Flink;

	} while (CallbackList.Flink != (PLIST_ENTRY)pObCallback);

	return status;

}

运行这段驱动程序，即可得到进程句柄回调:

当然了如上是进程句柄的枚举，如果是想要输出线程句柄，则只需要替换代码中的PsProcessType为((POBJECT_TYPE)(*PsThreadType))->CallbackList即可，修改后的代码如下。

// 署名权

// right to sign one's name on a piece of work

// PowerBy: LyShark

// Email: me@lyshark.com

#include <ntifs.h>

#include <wdm.h>

#include <ntddk.h>

typedef struct _OBJECT_TYPE_INITIALIZER

{

	USHORT Length;                // Uint2B

	UCHAR ObjectTypeFlags;            // UChar

	ULONG ObjectTypeCode;             // Uint4B

	ULONG InvalidAttributes;          // Uint4B

	GENERIC_MAPPING GenericMapping;   // _GENERIC_MAPPING

	ULONG ValidAccessMask;       // Uint4B

	ULONG RetainAccess;         // Uint4B

	POOL_TYPE PoolType;        // _POOL_TYPE

	ULONG DefaultPagedPoolCharge;  // Uint4B

	ULONG DefaultNonPagedPoolCharge; // Uint4B

	PVOID DumpProcedure;       // Ptr64     void

	PVOID OpenProcedure;      // Ptr64     long

	PVOID CloseProcedure;     // Ptr64     void

	PVOID DeleteProcedure;        // Ptr64     void

	PVOID ParseProcedure;     // Ptr64     long

	PVOID SecurityProcedure;      // Ptr64     long

	PVOID QueryNameProcedure;     // Ptr64     long

	PVOID OkayToCloseProcedure;     // Ptr64     unsigned char

	ULONG WaitObjectFlagMask;     // Uint4B

	USHORT WaitObjectFlagOffset;    // Uint2B

	USHORT WaitObjectPointerOffset;   // Uint2B

}OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _OBJECT_TYPE

{

	LIST_ENTRY TypeList;           // _LIST_ENTRY

	UNICODE_STRING Name;         // _UNICODE_STRING

	PVOID DefaultObject;         // Ptr64 Void

	UCHAR Index;             // UChar

	ULONG TotalNumberOfObjects;      // Uint4B

	ULONG TotalNumberOfHandles;      // Uint4B

	ULONG HighWaterNumberOfObjects;    // Uint4B

	ULONG HighWaterNumberOfHandles;    // Uint4B

	OBJECT_TYPE_INITIALIZER TypeInfo;  // _OBJECT_TYPE_INITIALIZER

	EX_PUSH_LOCK TypeLock;         // _EX_PUSH_LOCK

	ULONG Key;                 // Uint4B

	LIST_ENTRY CallbackList;       // _LIST_ENTRY

}OBJECT_TYPE, *POBJECT_TYPE;

#pragma pack(1)

typedef struct _OB_CALLBACK

{

	LIST_ENTRY ListEntry;

	ULONGLONG Unknown;

	HANDLE ObHandle;

	PVOID ObTypeAddr;

	PVOID PreCall;

	PVOID PostCall;

}OB_CALLBACK, *POB_CALLBACK;

#pragma pack()

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

{

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)

{

	NTSTATUS status = STATUS_SUCCESS;

	DbgPrint("hello lyshark.com \n");

	POB_CALLBACK pObCallback = NULL;

	// 直接获取 CallbackList 链表

	LIST_ENTRY CallbackList = ((POBJECT_TYPE)(*PsThreadType))->CallbackList;

	// 开始遍历

	pObCallback = (POB_CALLBACK)CallbackList.Flink;

	do

	{

		if (FALSE == MmIsAddressValid(pObCallback))

		{

			break;

		}

		if (NULL != pObCallback->ObHandle)

		{

			// 显示

			DbgPrint("[LyShark] ObHandle = %p | PreCall = %p | PostCall = %p \n", pObCallback->ObHandle, pObCallback->PreCall, pObCallback->PostCall);

		}

		// 获取下一链表信息

		pObCallback = (POB_CALLBACK)pObCallback->ListEntry.Flink;

	} while (CallbackList.Flink != (PLIST_ENTRY)pObCallback);

	return status;

}

运行这段驱动程序，即可得到线程句柄回调:

驱动开发：内核枚举进程与线程ObCall回调

驱动开发：内核枚举进程与线程ObCall回调的相关教程结束。

相关推荐

java 停止线程

Python Threading 线程/互斥锁/死锁/GIL锁

Winform跨线程访问UI

逍遥自在学C语言 | 枚举的那些事儿

Unity中实现字段/枚举编辑器中显示中文（中文枚举、中文标签）

wait，notify，notifyAll，sleep，join等线程方法的全方位演练

Java中的线程池ExecutorService

java 中的线程池和线程调用小demo

驱动开发：内核枚举进程与线程ObCall回调

驱动开发：内核枚举进程与线程ObCall回调的相关教程结束。

相关推荐

java 停止线程

Python Threading 线程/互斥锁/死锁/GIL锁

Winform跨线程访问UI

逍遥自在学C语言 | 枚举的那些事儿

Unity中实现字段/枚举编辑器中显示中文（中文枚举、中文标签）

wait，notify，notifyAll，sleep，join等线程方法的全方位演练

Java中的线程池ExecutorService

java 中的线程池和线程 调用小demo

java 中的线程池和线程调用小demo