1 #include <ntddk.h>
2
3 typedef struct _LDR_DATA_TABLE_ENTRY_FIX
4 {
5 struct _LIST_ENTRY InLoadOrderLinks; //0x0
6 struct _LIST_ENTRY InMemoryOrderLinks; //0x10
7 struct _LIST_ENTRY InInitializationOrderLinks; //0x20
8 VOID* DllBase; //0x30
9 VOID* EntryPoint; //0x38
10 ULONG SizeOfImage; //0x40
11 struct _UNICODE_STRING FullDllName; //0x48
12 struct _UNICODE_STRING BaseDllName; //0x58
13 }LDR_DATA_TABLE_ENTRY_FIX, *PLDR_DATA_TABLE_ENTRY_FIX;
14 //
15 // 参考此网站从PDB导出的windows内核数据结构
16 // ref:https://www.vergiliusproject.com/kernels/x64/Windows%207%20%7C%202008R2/SP1/_LDR_DATA_TABLE_ENTRY
17 //
18 VOID DriverUnload (
19 PDRIVER_OBJECT DriverObject
20 )
21 {
22 KdPrint(("EnumDriverModule DriverUnload\r\n"));
23 }
24 NTSTATUS DriverEntry(
25 PDRIVER_OBJECT DriverObject,
26 PUNICODE_STRING RegistryPath
27 )
28 {
29 PLDR_DATA_TABLE_ENTRY_FIX loader_entry = (PLDR_DATA_TABLE_ENTRY_FIX)(DriverObject->DriverSection);
30 PLIST_ENTRY pLISTHead = &loader_entry->InLoadOrderLinks;
31 PLIST_ENTRY pListEntry = pLISTHead;
32
33 KdPrint(("EnumDriverModule DriverEntry\r\n"));
34 while (pListEntry->Flink != pLISTHead) {
35 loader_entry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY_FIX, InLoadOrderLinks);
36 pListEntry = pListEntry->Flink;
37 KdPrint(("%wZ\t0x%I64X\t%I64u(B)\t0x%I64X\t%wZ\r\n",
38 &loader_entry->BaseDllName,
39 loader_entry->DllBase,
40 loader_entry->SizeOfImage,
41 DriverObject,
42 &loader_entry->FullDllName));
43 }
44 DriverObject->DriverUnload = DriverUnload;
45 return 0;
46 }
1 #
2 # DO NOT EDIT THIS FILE!!! Edit .\sources. if you want to add a new source
3 # file to this component. This file merely indirects to the real make file
4 # that is shared by all the components of Windows NT
5 #
6 !IF DEFINED(_NT_TARGET_VERSION)
7 ! IF $(_NT_TARGET_VERSION)>=0x501
8 ! INCLUDE $(NTMAKEENV)\makefile.def
9 ! ELSE
10 ! message BUILDMSG: Warning : The sample "$(MAKEDIR)" is not valid for the current OS target.
11 ! ENDIF
12 !ELSE
13 ! INCLUDE $(NTMAKEENV)\makefile.def
14 !ENDIF
1 TARGETNAME=EnumDriverModule
2 TARGETPATH=obj
3 TARGETTYPE=DRIVER
4
5
6 MSC_WARNING_LEVEL=/W3
7
8 SOURCES=EnumDriverModule.c
1 Bcdedit.exe -set {current} TESTSIGNING ON
2 bcdedit.exe -set {current} loadoptions DDISABLE_INTEGRITY_CHECKS
3
4 sc create EnumDriverModule binPath= C:\driver\EnumDriverModule.sys type= kernel
5
6 sc query EnumDriverModule
7 sc start EnumDriverModule
8 sc stop EnumDriverModule
9 sc delete EnumDriverModule
10
11 ed nt!Kd_DEFAULT_MASK
