在内核中.程序的编写不能简单的用基本数据类型了. 因为操作系统不同.很有可能造成数据类型的长度不一.而产生重大问题.所以在内核中.
数据类型都一定重定义了.
数据类型 | 重定义数据类型 |
---|---|
Unsigned long | ULONG |
Unsigned char | UCHAR |
Unsigned int | UINT |
Void | VOID |
Unsigned long * | PULONG |
Unsigned char * | PCHAR |
Unsigned int * | PUINT |
Void * | PVOID |
其中字符串的数据结构也改变了.
typedef struct _UNICODE_STRING{
USHORT Length //字符串长度
USHORT MaximumLength //字符串最大长度
PWSTR Buffer; //字符串指针
}UNICODE_STRING, *PUNICODE_STRING
typedef struct _STRING {
USHORT Length;
USHORT MaximumLength;
PCHAR Buffer;
} ANSI_STRING, *PANSI_STRING;
其中操作字符串都有相应的Kerner API. 可以查询MSDN 或者 WDK Document 进行操作.
IRP请求会发送给设备对象.然后驱动对象会捕获.通过分发函数进行处理. 一个驱动对象可以有多个设备对象.
在内核中. 有驱动对象.设备对象. 以及IRP请求.
驱动对象数据结构
typedef struct _DRIVER_OBJECT {
CSHORT Type; //类型
CSHORT Size; //大小.
PDEVICE_OBJECT DeviceObject; //设备对象链表开始,一个驱动对象可以有多个设备对象.其中DeviceObject结构体中有相关信息.
ULONG Flags;
PVOID DriverStart; //内核模块在内核中间的开始地址跟大小.
ULONG DriverSize;
PVOID DriverSection;
PDRIVER_EXTENSION DriverExtension;
UNICODE_STRING DriverName;//驱动的名字
PUNICODE_STRING HardwareDatabase;
//快速IO分发函数.
PFAST_IO_DISPATCH FastIoDispatch;
PDRIVER_INITIALIZE DriverInit;
PDRIVER_STARTIO DriverStartIo;
//驱动对象的卸载函数.
PDRIVER_UNLOAD DriverUnload;
//一个函数指针数组. 普通的分发函数.数组中保存了分发函数的地址.
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
} DRIVER_OBJECT;
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
设备对象数据结构
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT {
CSHORT Type; //类型跟大小.
USHORT Size;
//引用计数
LONG ReferenceCount;
//这个设备所属于驱动对象的指针. 保存了驱动对象.
struct _DRIVER_OBJECT *DriverObject;
//下一个设备对象.一个驱动对象可以有n个设备.用单向链表进行连接.
struct _DEVICE_OBJECT *NextDevice;
struct _DEVICE_OBJECT *AttachedDevice;
struct _IRP *CurrentIrp;
PIO_TIMER Timer;
ULONG Flags; // See above: DO_...
ULONG Characteristics; // See ntioapi: FILE_...
__volatile PVPB Vpb;
PVOID DeviceExtension;
//设备对象类型
DEVICE_TYPE DeviceType;
//堆栈大小.
CCHAR StackSize;
union {
LIST_ENTRY ListEntry;
WAIT_CONTEXT_BLOCK Wcb;
} Queue;
ULONG AlignmentRequirement;
KDEVICE_QUEUE DeviceQueue;
KDPC Dpc;
//
// The following field is for exclusive use by the filesystem to keep
// track of the number of Fsp threads currently using the device
//
ULONG ActiveThreadCount;
PSECURITY_DESCRIPTOR SecurityDescriptor;
KEVENT DeviceLock;
USHORT SectorSize;
USHORT Spare1;
struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
PVOID Reserved;
} DEVICE_OBJECT;
typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
IRP 请求包.
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _IRP {
CSHORT Type; //类型
USHORT Size; //大小
//
// Define the common fields used to control the IRP.
//
//
// Define a pointer to the Memory Descriptor List (MDL) for this I/O
// request. This field is only used if the I/O is "direct I/O".
//
PMDL MdlAddress; //内核描述符指针.读写的缓冲区.
//
// Flags word - used to remember various flags.
//
ULONG Flags;
//
// The following union is used for one of three purposes:
//
// 1. This IRP is an associated IRP. The field is a pointer to a master
// IRP.
//
// 2. This is the master IRP. The field is the count of the number of
// IRPs which must complete (associated IRPs) before the master can
// complete.
//
// 3. This operation is being buffered and the field is the address of
// the system space buffer.
//
union { //SystemBuffer里面看看请求是那个IO请求.来取决于用上面的缓冲区还是下面的缓冲区.
struct _IRP *MasterIrp;
__volatile LONG IrpCount;
PVOID SystemBuffer;
} AssociatedIrp;
//
// Thread list entry - allows queueing the IRP to the thread pending I/O
// request packet list.
//
LIST_ENTRY ThreadListEntry;
//
// I/O status - final status of operation.
//
IO_STATUS_BLOCK IoStatus; // IO的请求状态.一般请求完成后的返回情况放在这里.
//
// Requestor mode - mode of the original requestor of this operation.
//
KPROCESSOR_MODE RequestorMode;
//
// Pending returned - TRUE if pending was initially returned as the
// status for this packet.
//
BOOLEAN PendingReturned;
//
// Stack state information.
//
CHAR StackCount; //栈空间大小.
CHAR CurrentLocation; //当前的IRP栈空间.
//
// Cancel - packet has been canceled.
//
BOOLEAN Cancel;
//
// Cancel Irql - Irql at which the cancel spinlock was acquired.
//
KIRQL CancelIrql;
//
// ApcEnvironment - Used to save the APC environment at the time that the
// packet was initialized.
//
CCHAR ApcEnvironment;
//
// Allocation control flags.
//
UCHAR AllocationFlags;
//
// User parameters.
//
PIO_STATUS_BLOCK UserIosb;
PKEVENT UserEvent;
union {
struct {
union {
PIO_APC_ROUTINE UserApcRoutine;
PVOID IssuingProcess;
};
PVOID UserApcContext;
} AsynchronousParameters;
LARGE_INTEGER AllocationSize;
} Overlay;
//
// CancelRoutine - Used to contain the address of a cancel routine supplied
// by a device driver when the IRP is in a cancelable state.
//
__volatile PDRIVER_CANCEL CancelRoutine; //用来取消一个未决请求的函数.
//
// Note that the UserBuffer parameter is outside of the stack so that I/O
// completion can copy data back into the user's address space without
// having to know exactly which service was being invoked. The length
// of the copy is stored in the second half of the I/O status block. If
// the UserBuffer field is NULL, then no copy is performed.
//
PVOID UserBuffer; //与MdlAddress 跟SystemBuffer一样都是缓冲区.
//缓冲区的特性不同.
//
// Kernel structures
//
// The following section contains kernel structures which the IRP needs
// in order to place various work information in kernel controller system
// queues. Because the size and alignment cannot be controlled, they are
// placed here at the end so they just hang off and do not affect the
// alignment of other fields in the IRP.
//
union {
struct {
union {
//
// DeviceQueueEntry - The device queue entry field is used to
// queue the IRP to the device driver device queue.
//
KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
struct {
//
// The following are available to the driver to use in
// whatever manner is desired, while the driver owns the
// packet.
//
PVOID DriverContext[4];
} ;
} ;
//
// Thread - pointer to caller's Thread Control Block.
//
PETHREAD Thread; //发出这个请求的线程.
//
// Auxiliary buffer - pointer to any auxiliary buffer that is
// required to pass information to a driver that is not contained
// in a normal buffer.
//
PCHAR AuxiliaryBuffer;
//
// The following unnamed structure must be exactly identical
// to the unnamed structure used in the minipacket header used
// for completion queue entries.
//
struct {
//
// List entry - used to queue the packet to completion queue, among
// others.
//
LIST_ENTRY ListEntry;
union {
//
// Current stack location - contains a pointer to the current
// IO_STACK_LOCATION structure in the IRP stack. This field
// should never be directly accessed by drivers. They should
// use the standard functions.
//
// 一个IRP 栈空间的元素.
struct _IO_STACK_LOCATION *CurrentStackLocation;
//
// Minipacket type.
//
ULONG PacketType;
};
};
//
// Original file object - pointer to the original file object
// that was used to open the file. This field is owned by the
// I/O system and should not be used by any other drivers.
//
PFILE_OBJECT OriginalFileObject;
} Overlay;
//
// APC - This APC control block is used for the special kernel APC as
// well as for the caller's APC, if one was specified in the original
// argument list. If so, then the APC is reused for the normal APC for
// whatever mode the caller was in and the "special" routine that is
// invoked before the APC gets control simply deallocates the IRP.
//
KAPC Apc;
//
// CompletionKey - This is the key that is used to distinguish
// individual I/O operations initiated on a single file handle.
//
PVOID CompletionKey;
} Tail;
} IRP;
其中IRP注意的事项. 因为IRP发送给设备对象请求.所以有多个设备对象.而IRP结构体是固定的.所以在操作的时候.会有一些变动的参数.为了存储这些变动的参数.
所以IRP结构体中保存了当前IRP堆栈.如果获取这些变动的参数.可以通过IRP堆栈来操作.
其中: CurrentLocation表示的当前是哪一个IRP堆栈.
我们知道.在应用层中.我们有SDK开发工具包. 里面的API供我们使用.现在内核中也提供了Kerner(内核) API给我们使用.
一般名字都有前缀.
IO EX Rtl Ke Zw Nt Ps开头.
常用的kerner API介绍.
1.Ex系列API
Ex内存系列API | |
---|---|
ExAllocatePool | 申请内存,类似于C语言的malloc |
ExFreePool | 释放内存,C语言中的free |
ExAcquireFastMutex | 获取一个快速互斥体.多线程中使用. |
ExReleaseFastMutex | 释放一个快速互斥体 |
ExRaiseStatus | 抛出一个异常.带有错误Status的值 |
2.Zw文件操作API (可以是设备)
介绍API前介绍一下Nt函数. Zw函数跟Nt函数是简单的跳转关系. 用户态也有对应的API与之对应. 在内核中Nt函数是查询不到的.因为微软不建议使用Nt函数.
不过我们声明一下还是可以使用的.
Zw 文件设备操作API | 对应NT API | 作用 |
---|---|---|
ZwCreateFile | NtCreateFile | 打开文件/设备 |
ZwReadFile | NtReadFile | 读文件/设备 |
ZwWriteFile | NtWriteFile | 写文件/设备 |
ZwQueryDirctoryFile | NtQueryDirctoryFile | 目录查询 |
ZwDeviceIoControFile | NtDeviceIoControlFile | 发送设备控制请求 |
ZwCreateKey | NtCreateKey | 打开一个注册表键 |
ZwQueryValueKey | NtQueryValueKey | 打开一个注册表值 |
3.Rtl字符串操作函数
我们知道内核中有了新的UNICODE_STRING 跟 ANSI_STRING的字符串.那么也有与之对应操作的API
Rtl函数 | 功能 |
---|---|
RtlInitUnicodeString | 初始化一个Unicode字符串结构 |
RtlCopyUnicodeString | 拷贝字符串 |
RtlAppendUnicodeToString | 将一个字符串追加到另一个字符串后 |
RtlStringCbPrintf | 讲一个字符串打印到字符串中,相当于sprintf |
RtlCopyMemory | 内存数据块拷贝. |
RtlMoveMemory | 内存数据块移动. |
RtlZeroMemory | 内存块清零.注意不是释放内存,而是内存的值都变成0 |
RtlCompareMemory | 内存比较 |
RtlGetVersion | 获得当前Windows 版本 |
四丶IO管理器API
注意,IO函数比较重要. IO函数涉及IO管理器,而IO管理器就是将用户调用的API 翻译成IRP请求.或者讲等价的请求发送到内核中不同的设备.
是一个关键组件. 这个类别一般涉及到的都是IRP. 很关键.
IO函数 | 作用 |
---|---|
IoCreateFile | 创建文件,比ZwCreateFile更加底层 |
IoCreateDevice | 生成一个设备对象 |
IoCallDriver | 发送请求 |
IoCompleteRequest | 完成请求,通知IO管理器完成了IRP请求 |
IoCopyCurrentIrpStackLocationToNext | 将当前的IRP堆栈拷贝到下一个栈空间 |
IoSkipCurrentIrpStackLoctionToNext | 跳过当前的IRP的栈空间 |
IoGetCurrentIrpStackLocation | 获得IRP的当前栈空间指针. |
五丶Ps 进程线程相关的函数.
Ps进程相关函数 | 作用 |
---|---|
PsGetCurrentProcess | 获得当前的EPROCESS结构 |
PsGetCurrentProcessId | 获得当前的进程ID |
PsGetCurrentThread | 获得当前的ETHREAD结构 |
PsGetCurrentThreadId | 获得当前的线程ID |
PsIsSystemThread | 判断是否是系统线程. |
PsTerminateSystemThread | 结束系统线程. |
关于Kerner API, 简单的熟悉这些API.然后多看WDK Document 或者MSDN, 尽快熟悉API使用. 这样编写内核程序才会熟悉. 为以为逆向做准备.