遍历windows驱动
驱动都存在
\\Driver 或者 \\FileSystem 目录对象里 我们只需要遍历这两个目录就可以遍历windows所有驱动
知识点
\\Driver \\FileSystem (dt _OBJECT_DIRECOTRY)都属于 ObpDirectoryObjectType(window内核全局变量) 对象
其他对象全局变量 可以参考 作者:潘爱民 书名:windows内核原理与实现 的 2.4图
一个目录对象 含有37个DirectoryEnTry 对象(dt _OBJECT_DIRECTORY_ENTRY)
_OBJECT_DIRECTORY_ENTRY 里的Object 指向的就是 驱动的 DriverObject( dt _DRIVER_OBJECT)
具体内容看代码
VOID init()
{
UNICODE_STRING vDriverName = { 0 };
RtlInitUnicodeString(&vDriverName, L"\\Driver");
POBJECT_DIRECTORY vPObjectDirectory;
NTSTATUS vStatus;
vStatus = ObReferenceObjectByName(
&vDriverName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
0,
(POBJECT_TYPE)0x869d0040,
KernelMode,
NULL,
(PVOID *)&vPObjectDirectory
);
if (NT_SUCCESS(vStatus))
{
KdPrint(("成功"));
for (ULONG vI = 0; vI < NUMBER_HASH_BUCKETS; vI++)
{
PDRIVER_OBJECT vDriverObject = NULL;
POBJECT_DIRECTORY_ENTRY vObjectDirectoryEntry = NULL;
vObjectDirectoryEntry = vPObjectDirectory->HashBuckets[vI];
while (vObjectDirectoryEntry && MmIsAddressValid((PVOID)vObjectDirectoryEntry))
{
vDriverObject = (PDRIVER_OBJECT)vObjectDirectoryEntry->Object;
if (MmIsAddressValid((PVOID)vDriverObject))
{
if (MmIsAddressValid(&vDriverObject->DriverName))
{
if (wcsstr(vDriverObject->DriverName.Buffer, L"PCHunter32") != NULL)
{
KdPrint(("\r\n\r\n找到了\r\n\r\n"));
RtlInitUnicodeString(&vDriverObject->DriverName, L"\Driver\text32");
}
KdPrint(("名:%wZ\r\n", &vDriverObject->DriverName));
}
}
vObjectDirectoryEntry = vObjectDirectoryEntry->ChainLink;
}
}
ObDereferenceObject(vPObjectDirectory);
}
else
KdPrint(("vStatus = 0x%08X\r\n", vStatus));
RtlInitUnicodeString(&vDriverName, L"\\FileSystem");
vStatus = ObReferenceObjectByName(
&vDriverName,
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
NULL,
0,
(POBJECT_TYPE)0x869d0040,
KernelMode,
NULL,
(PVOID *)&vPObjectDirectory
);
if (NT_SUCCESS(vStatus))
{
KdPrint(("成功"));
for (ULONG vI = 0; vI < NUMBER_HASH_BUCKETS; vI++)
{
PDRIVER_OBJECT vDriverObject = NULL;
POBJECT_DIRECTORY_ENTRY vObjectDirectoryEntry = NULL;
vObjectDirectoryEntry = vPObjectDirectory->HashBuckets[vI];
while (vObjectDirectoryEntry && MmIsAddressValid((PVOID)vObjectDirectoryEntry))
{
vDriverObject = (PDRIVER_OBJECT)vObjectDirectoryEntry->Object;
if (MmIsAddressValid((PVOID)vDriverObject))
{
if (MmIsAddressValid(&vDriverObject->DriverName))
{
KdPrint(("名:%wZ\r\n", &vDriverObject->DriverName));
}
}
vObjectDirectoryEntry = vObjectDirectoryEntry->ChainLink;
}
}
ObDereferenceObject(vPObjectDirectory);
}
else
KdPrint(("vStatus = 0x%08X\r\n", vStatus));
}
jpg 改 rar
