溫馨提示×
您好，登錄后才能下訂單哦！
點擊 登錄注冊 即表示同意《億速云用戶服務條款》
您好，登錄后才能下訂單哦！
這篇文章將為大家詳細講解有關驅動DriverEntry的初始化，小編覺得挺實用的，因此分享給大家做個參考，希望大家閱讀完這篇文章后可以有所收獲。
從DriverEntry(PDRIVER_OBJECTDriverObject, UNICODE_STRING *pRegistry)的pRegistry中截取末尾名稱去獲取并計算出設備名和DosDevices的名字。
pDriverName= pRegistry->Buffer; Len = pRegistry->Length >> 1; pFirstName = &pDriverName[Len]; if ( pFirstName == pDriverName ) { LABEL_8: if ( *pFirstName != '\\' ) goto LABEL_10; } else { while ( *pFirstName != '\\' ) { --pFirstName; if ( pFirstName == pDriverName ) goto LABEL_8; } } ++pFirstName;
然后從pRegistry注冊表中去獲取sysmon的策略規則
使用RtlQueryRegistryValues函數，填入5個RTL_QUERY_REGISTRY_TABLE結構體
RTL_QUERY_REGISTRY_TABLE QueryRegTable[5];
RtlInitUnicodeString(&g_ProcessAccessNamesRule,0);
memset(QueryRegTable, 0, 560u);
QueryRegTable[0].Flags = 1;
QueryRegTable[0].Name =L"Parameters"; QueryRegTable[3].EntryContext =&OptionRulesv18; QueryRegTable[4].EntryContext =&hash_alogrithms; QueryRegTable[1].Flags = 304; QueryRegTable[1].Name =g_Name_ProcessAccessNames; QueryRegTable[1].EntryContext =&g_ProcessAccessNamesRule; QueryRegTable[1].DefaultType = 0x7000007; QueryRegTable[1].DefaultData =&unk_10015C34; QueryRegTable[1].DefaultLength = 4; QueryRegTable[2].Flags = 304; QueryRegTable[2].Name = L"ProcessAccessMasks"; QueryRegTable[2].EntryContext =&g_ProcessAccessMasksRule; QueryRegTable[2].DefaultType = 0x3000000; QueryRegTable[3].Flags = 304; QueryRegTable[3].Name =(PWSTR)&g_wOption; QueryRegTable[3].DefaultType = 0x4000000; QueryRegTable[4].Flags = 304; QueryRegTable[4].Name =(PWSTR)&g_wHashingalgorithm; QueryRegTable[4].DefaultType = 0x4000000; RtlQueryRegistryValues(0,g_SysmonRegisterPath.Buffer, QueryRegTable, 0, 0); if ( !g_ProcessAccessNamesRule.Buffer || g_ProcessAccessNamesRule.Length <= 2u || g_ProcessAccessNamesRule.MaximumLength<= 4u ) { RtlFreeUnicodeString(&g_ProcessAccessNamesRule); RtlInitUnicodeString(&g_ProcessAccessNamesRule, 0); }
g_OptionRules =(OptionRulesv18 >> 1) & 1;對應的注冊表鍵分別是L"Parameters"、L”ProcessAccessNames”、L"ProcessAccessMasks" 、L” Option”、L” Hashingalgorithm”
然后再次獲取L"Parameters"項下面的對應的L"Rules"的KeyValues信息，這里是驅動設置的規則。
下面展示出部分規則的數組
上面的過程結束后就開始判斷操作系統是否支持flt
如果支持只實現IRP_MJ_CREATE、IRP_MJ_CLOSE 、IRP_MJ_DEVICE_CONTROL三個例程，后續會注冊miniFlt過濾，如果不支持Flt就使用老的模式Sfilter的模式
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_CLOSE]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_CREATE]= (PDRIVER_DISPATCH)SysmonDispatchIrp; if ( IsOpenPipeConnect &&!IsSupportFlt )
{
DriverObject->MajorFunction[IRP_MJ_CREATE] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[1] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_CLOSE] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_READ]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_WRITE]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_QUERY_EA] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SET_EA] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_FLUSH_BUFFERS] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SET_VOLUME_INFORMATION] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL]= (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_LOCK_CONTROL] = (PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_CLEANUP] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_CREATE_MAILSLOT] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_QUERY_SECURITY] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SET_SECURITY] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_POWER] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL]= (PDRIVER_DISPATCH)SysmonDispatchIrp;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CHANGE] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_QUERY_QUOTA] =(PDRIVER_DISPATCH)SysmonDispatchIrp; DriverObject->MajorFunction[IRP_MJ_SET_QUOTA]= (PDRIVER_DISPATCH)SysmonDispatchIrp;
}然后就是常規過程，IoCreateDevice、IoCreateSymbolicLink。
然后根據操作系統是否支持FltRegisterFilter(Driver, &g_Registration, &g_pFilter);
具體創建了哪些minifilter，接著看結構體
OperationRegistrationdd IRP_MJ_CREATE ; DATA XREF:.data:10015014↓o .rdata:10013454 dd 0 .rdata:10013458 dd offset PreOperation .rdata:1001345C dd offset PostOperation .rdata:10013460 dd 0 .rdata:10013464 dd IRP_MJ_CLEANUP .rdata:10013468 dd 0 .rdata:1001346C dd offset PreOperation .rdata:10013470 dd offset PostOperation .rdata:10013474 dd 0 .rdata:10013478 dd IRP_MJ_SET_INFORMATION .rdata:1001347C dd 0 .rdata:10013480 dd offset PreOperation .rdata:10013484 dd offset PostOperation .rdata:10013488 dd 0 .rdata:1001348C dd IRP_MJ_CLOSE .rdata:10013490 dd 0 .rdata:10013494 dd offset PreOperation .rdata:10013498 dd offset PostOperation .rdata:1001349C dd 0 .rdata:100134A0 dd IRP_MJ_CREATE_NAMED_PIPE .rdata:100134A4 dd 0 .rdata:100134A8 dd offset PreOperation .rdata:100134AC dd offset PostOperation .rdata:100134B0 dd 0 .rdata:100134B4 dd IRP_MJ_OPERATION_END .rdata:100134B8 dd 0 .rdata:100134BC dd 0 .rdata:100134C0 dd 0 .rdata:100134C4 dd 0
從上可以看到minifilter過濾了IRP_MJ_CREATE、IRP_MJ_CLEANUP、IRP_MJ_SET_INFORMATION、IRP_MJ_CLOSE、IRP_MJ_CREATE_NAMED_PIPE
文件系統相關的注冊完畢，然后就是設置一些進程、線程相關的回調函數例程
PsSetLoadImageNotifyRoutine(SysmonLoadImageNotifyRoutine); PsSetCreateThreadNotifyRoutine(PsCreateThreadNotifyRoutine); PsSetCreateProcessNotifyRoutine(PsCreateProcessNotifyRoutine, 0);
為了記錄注冊表sysmon還注冊表注冊表CmRegisterCallback(RegisterCallback, 0, &Cookie);回調，
為了記錄進程open對象的事件注冊了ob事件
g_bIsRegisterCallback= 1; g_OperationRegistration.ObjectType =(POBJECT_TYPE *)PsProcessType; g_OperationRegistration.Operations = 1; g_OperationRegistration.PreOperation =PreProcessOperation; g_OperationRegistration.PostOperation =PostProcessOperation; g_CallbackRegistration.OperationRegistration= &g_OperationRegistration; *(_DWORD*)&g_CallbackRegistration.Version = 0x10100; g_CallbackRegistration.RegistrationContext =0; RtlInitUnicodeString(&g_CallbackRegistration.Altitude,L"1000"); Status =g_ObRegisterCallbacks(&g_CallbackRegistration, &RegistrationHandle);
為了獲取管道的事件，它掛接了設備L\\Device\\NamedPipe，創建了L\\Device\\SysmonPipeFilter的過濾設備
至此sysmon的DriverEntry的初始化動作基本結束了。
Case 0x83400000:
打開驅動開啟標志，并且獲取且保存當前UI進程的句柄
Case 0x83400004：
Ring3請求事件信息，并返回到ring3的緩沖區
Case 0x83400008：
加載策略規則
Case 0x8340000C：
獲取傳入進程的相關信息（包括TokenUser、pTokenStatics、TokenGroup、TokenSeesion）
還會獲取進程pImagePathName、pCommandLine、CurrentDirectory
獲取進程的CreateTime
該事件類型為4或者1
Minifilter的PreOperation(PFLT_CALLBACK_DATA pData, PFLT_RELATED_OBJECTSFltObjects, PVOID *CompletionContext)例程為主要的判斷邏輯例程，先判斷當前FileObject的路徑是否為管道路徑，管道事件直接記錄上報事件
特別判斷下IRP_MJ_SET_INFORMATION、IRP_MJ_CLEANUP,并且分別上報_，注意在判斷IRP_MJ_SET_INFORMATION的時候只記錄了RequestorMode是1即USER_MODE，并且是設置FileBasicInformation的請求。
PreOperation處理完畢，則PostOperation(PFLT_CALLBACK_DATA pData, PFLT_RELATED_OBJECTSpFltFileObj, PVOID CompletionContext, int Flags)對前者處理的上下文CompletionContext進行記錄日志或者釋放的處理，以IRP_MJ_SET_INFORMATION為例，PostOPerate則對PreOperate的CompletionContext的數據進行上報。
Sysmon初始化的時候注冊了一個注冊表過濾，CmRegisterCallback(RegisterCallback, 0, &Cookie);回調函數是NTSTATUS__stdcall RegisterCallback(PVOID CallbackContext, PVOID Argument1, PVOIDArgument2)，參數Argument1是過濾的注冊表操作類型，sysmon過濾了0（RegNtDeleteKey / RegNtPreDeleteKey） 、4( RegNtRenameKey\RegNtPreRenameKey)、11（RegNtPostCreateKey）、15（RegNtPostDeleteKey）、16（RegNtPostSetValueKey）、17（RegNtPostDeleteValueKey）、19（RegNtPostRenameKey）27（RegNtPostCreateKeyEx）的注冊表操作
Sysmon注冊了進程操作過濾，g_ObRegisterCallbacks(&g_CallbackRegistration, &RegistrationHandle);，
他只記錄操作類型為OB_OPERATION_HANDLE_CREATE，并且只記錄A進程操作B進程，A和B不是同一個進程，注意RtlWalkFrameChain這個函數是獲取當前操作線程的線程棧，KeQuerySystemTime(&pOpenInfo.CreateTime);是獲取當前系統時間，并且會把這些信息上報。
1. 進程模塊的枚舉
ZwQueryInformationProcess(ProcessHandle, ProcessBasicInformation,&ProcessInformation, 0x18u, 0)獲取ProcessInformation的信息，從PebBaseAddress= ProcessInformation.PebBaseAddress;取得進程PEB的地址，在PEB結構中得到LDR的地址，LDR是進程加載模塊的結構體，
struct _PEB
{
UCHAR InheritedAddressSpace;
UCHAR ReadImageFileExecOptions;
UCHAR BeingDebugged;
UCHAR BitField;
PVOID Mutant;
PVOID ImageBaseAddress;
PPEB_LDR_DATA Ldr;
PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
PVOID SubSystemData;
PVOID ProcessHeap;
PRTL_CRITICAL_SECTION FastPebLock;
PVOID AtlThunkSListPtr;
PVOID IFEOKey;
ULONG CrossProcessFlags;
unsigned __int32 ProcessInJob : 1;
unsigned __int32 ProcessInitializing : 1;
unsigned __int32 ReservedBits0 : 30;
union
{
PVOID KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
ULONG SystemReserved[1];
。。。。。。
}PPEB_LDR_DATA Ldr;這個就是加載模塊的結構，有三種加載表內存加載表，加載順序表，初始化加載表從中可以枚舉出模塊信息。
struct _PEB_LDR_DATA
{
ULONG Length;
UCHAR Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
};
2. 進程參數的獲取
大致可以看到如下，首先要KeStackAttachProcess進程的空間，然后獲取PEB地址，從PEB中的到ProcessParameters的結構
ProcessParameters結構如下：
struct _RTL_USER_PROCESS_PARAMETERS
{
ULONG MaximumLength;
ULONG Length;
ULONG Flags;
ULONG DebugFlags;
PVOID ConsoleHandle;
ULONG ConsoleFlags;
PVOID StandardInput;
PVOID StandardOutput;
PVOID StandardError;
CURDIR CurrentDirectory;
UNICODE_STRING DllPath;
UNICODE_STRINGImagePathName;
UNICODE_STRING CommandLine;
PVOID Environment;
ULONG StartingX;
ULONG StartingY;
ULONG CountX;
ULONG CountY;
ULONG CountCharsX;
ULONG CountCharsY;
ULONG FillAttribute;
ULONG WindowFlags;
ULONG ShowWindowFlags;
UNICODE_STRING WindowTitle;
UNICODE_STRING DesktopInfo;
UNICODE_STRING ShellInfo;
UNICODE_STRING RuntimeData;
RTL_DRIVE_LETTER_CURDIRCurrentDirectores[32];
ULONG EnvironmentSize;
};可以看到該結構中進程參數相關的各種信息。
3. 進程Token相關信息的獲取
都是通過ZwQueryInformationToken函數去獲取，只是是使用不同的ClassInformation類去獲取，定義如下
typedef enum _TOKEN_INFORMATION_CLASS {
TokenUser ,
TokenGroups ,
TokenPrivileges ,
TokenOwner ,
TokenPrimaryGroup ,
TokenDefaultDacl ,
TokenSource ,
TokenType ,
TokenImpersonationLevel ,
TokenStatistics ,
TokenRestrictedSids ,
TokenSessionId ,
TokenGroupsAndPrivileges ,
TokenSessionReference ,
TokenSandBoxInert ,
TokenAuditPolicy ,
TokenOrigin ,
TokenElevationType ,
TokenLinkedToken ,
TokenElevation ,
TokenHasRestrictions ,
TokenAccessInformation ,
TokenVirtualizationAllowed ,
TokenVirtualizationEnabled ,
TokenIntegrityLevel ,
TokenUIAccess ,
TokenMandatoryPolicy ,
TokenLogonSid ,
TokenIsAppContainer ,
TokenCapabilities ,
TokenAppContainerSid ,
TokenAppContainerNumber ,
TokenUserClaimAttributes ,
TokenDeviceClaimAttributes ,
TokenRestrictedUserClaimAttributes ,
TokenRestrictedDeviceClaimAttributes ,
TokenDeviceGroups ,
TokenRestrictedDeviceGroups ,
TokenSecurityAttributes ,
TokenIsRestricted ,
TokenProcessTrustLevel ,
TokenPrivateNameSpace ,
TokenSingletonAttributes ,
TokenBnoIsolation ,
TokenChildProcessFlags ,
MaxTokenInfoClass
} TOKEN_INFORMATION_CLASS, *PTOKEN_INFORMATION_CLASS;需要獲取那個就可以選擇那一個。
關于“驅動DriverEntry的初始化”這篇文章就分享到這里了，希望以上內容可以對大家有一定的幫助，使各位可以學到更多知識，如果覺得文章不錯，請把它分享出去讓更多的人看到。
免責聲明：本站發布的內容（圖片、視頻和文字）以原創、轉載和分享為主，文章觀點不代表本網站立場，如果涉及侵權請聯系站長郵箱：is@yisu.com進行舉報，并提供相關證據，一經查實，將立刻刪除涉嫌侵權內容。
