需要一个内核模式 API 来查找用户模式 Win32 Dll 的基址
我是设备驱动程序编程的新手。我遵循了网络上的可用教程，其中提供了有用的入门信息。然而现在我已经开始了一个新项目，其唯一目标是搜索被恶意软件或键盘记录器挂钩的功能。所以我想我已经整理出了完成此任务所需的内容，尽管我仍然需要能够找到已加载到内存中的系统 dll（即 kernel32.dll、user32.dll 等）的加载地址。我需要加载地址，以便我可以解析它们的 PE 以到达导出和导入部分。此外，将加载地址添加到文件大小将为我提供一个地址范围来交叉引用导出函数的地址，不是吗？交叉引用导入地址会涉及更多一些，但根据我的估计可以完成。我认为构建内核模式驱动程序将是正确的方法，因为与用户模式应用程序相比，访问内核驱动程序地址范围之外的内存对于驱动程序来说不是问题。我还能如何访问位于目标 dll 的 EAT 和 IAT 中的地址？我知道存在一个用户模式 API 可以提供加载地址，主要是 GetModuleHandle，但我想在内核模式下找到等效的。我可以编写一个用户模式应用程序，可以将这些信息转发给驱动程序，但如果可能的话，我更希望这一切都在内核模式下完成。任何建议或意见将非常受欢迎。
预先感谢
维克多
p.s 这篇文章已被编辑以更加清晰。希望它能让我更清楚地了解我正在努力实现的目标。
I am new to device driver programming. I've followed the available tutorials on the web which has provided helpful information to get started. However now I have embarked on a new project where the exclusive goal is to search for functions which have been hooked by malware or keyloggers. So I think I have sorted out what I need to accomplish this though I still need to be able to locate the load address of the system dll's (i.e. kernel32.dll, user32.dll and the like) that are already loaded in memory. I need the load address so that I can parse their PE to get to the export and import sections. Furthermore adding the load address to the file size will give me a address range to cross reference the addresses of the export functions no ? Cross referencing the the IMPORT address will be a little more involved but it can be done according to my estimates. I thought that building a kernel mode driver would be the right way to go since accessing memory outside the kernel driver's address range would not be an issue for the driver as opposed to a user mode app. How else will I be able to access the addresses located in the EAT and IAT of the target dll ? I know there exist a user mode API that can provide the load address mainly being GetModuleHandle but I would like to find the equivalent in kernel mode. I could write a user mode application that could relay this information to the driver but prefer that this all be done in kernel mode if possible. Any suggestions or comments would be most welcome.
Thanks in advance
Victor
p.s This post has been edited for more clarity. Hopefully it will make it more clear as what I am trying to accomplish.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
在内核模式下这可能不是一个好主意。您什么时候才能真正做到这一点并保证流程处于可以通过 IAT 的状态？
如果进程正在加载 DLL 怎么办？如果您正在线程内执行（即从系统调用或设备 IOCTL），如果其他线程也在执行怎么办？当您不是操作系统时执行此操作是一个非常难以正确执行的建议，并且非常很容易破坏客户计算机的稳定性（天哪，即使您操作系统）
This is probably not a very good idea to do in kernel mode. When are you going to actually do this and guarantee the process is in a state where you could walk the IAT?
What if the process is in the middle of loading a DLL? If you're executing in-thread (i.e. from a syscall or device IOCTL), what if other threads are executing too? Doing this when you're not the OS is a very difficult proposition to correctly do, and it's very easy to destabilize your customers' machines (hell, it's reasonably hard to do even if you are the OS)
看看
LdrGetProcedureAddress以及该团伙的其他成员。编辑：
MmGetSystemRoutineAddress可能也会有帮助。Take a look at
LdrGetProcedureAddressand the rest of the gang.Edit:
MmGetSystemRoutineAddressmight also be helpful.只是想感谢大家的贡献。我确实进行了一些进一步的研究，发现有一个名为 PsLoadImageNotifyCallback 的内核模式 API，它能够找到任何进程的基地址。
Just wanted to thank everyone for their contribution. I did manage to some further research and discovered that there is a kernel mode API called PsLoadImageNotifyCallback that is able to find the base addresss of any process.