驱动开发：内核中实现Dump进程转储( 二 ) _生活百科

文章插图
上篇文章中的代码就不再啰嗦了，这里只给出内存转存的核心代码，如下代码：

RtlInitUnicodeString 用于初始化转存后的名字字符串
ZwCreateFile 内核中创建文件到应用层
ZwWriteFile 将文件写出到文件
ZwClose 最后是关闭文件并释放堆空间

很简单只是利用了SafeCopyMemory_R3_to_R0将进程内存读取到缓冲区内，并将缓冲区写出到C盘目录下。

// 进程内存拷贝函数// By: LyShark.comNTSTATUS ProcessDumps(PEPROCESS pEprocess, ULONG_PTR nBase, ULONG nSize){	BOOLEAN bAttach = FALSE;	KAPC_STATE ks = { 0 };	PVOID pBuffer = NULL;	NTSTATUS status = STATUS_UNSUCCESSFUL;	if (nSize == 0 || pEprocess == NULL)	{return status;	}	pBuffer = ExAllocatePoolWithTag(PagedPool, nSize, 'lysh');	if (!pBuffer)	{return status;	}	memset(pBuffer, 0, nSize);	if (pEprocess != IoGetCurrentProcess())	{KeStackAttachProcess(pEprocess, &ks);bAttach = TRUE;	}	status = SafeCopyMemory_R3_to_R0(nBase, (ULONG_PTR)pBuffer, nSize);	if (bAttach)	{KeUnstackDetachProcess(&ks);bAttach = FALSE;	}	OBJECT_ATTRIBUTES object;	IO_STATUS_BLOCK io;	HANDLE hFile;	UNICODE_STRING log;	// 导出文件名称	RtlInitUnicodeString(&log, L"\\??\\C:\\lyshark_dumps.exe");	InitializeObjectAttributes(&object, &log, OBJ_CASE_INSENSITIVE, NULL, NULL);	status = ZwCreateFile(&hFile,GENERIC_WRITE,&object,&io,NULL,FILE_ATTRIBUTE_NORMAL,FILE_SHARE_WRITE,FILE_OPEN_IF,FILE_SYNCHRONOUS_IO_NONALERT,NULL,0);	if (!NT_SUCCESS(status))	{DbgPrint("打开文件错误 \n");return STATUS_SUCCESS;	}	ZwWriteFile(hFile, NULL, NULL, NULL, &io, pBuffer, nSize, NULL, NULL);	DbgPrint("写出字节数: %d \n", io.Information);	DbgPrint("[*] LyShark.exe 已转存");	ZwClose(hFile);	if (pBuffer)	{ExFreePoolWithTag(pBuffer, 'lysh');pBuffer = NULL;	}	return status;}VOID UnDriver(PDRIVER_OBJECT driver){	DbgPrint(("Uninstall Driver Is OK \n"));}// lyshark.comNTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){	DbgPrint("hello lyshark.com \n");	NTSTATUS ntStatus;	PEPROCESS pCurProcess = NULL;	__try	{ntStatus = PsLookupProcessByProcessId((HANDLE)272, &pCurProcess);if (NT_SUCCESS(ntStatus)){// 设置基地址以及长度ntStatus = ProcessDumps(pCurProcess, 0x140000000, 1024);ObDereferenceObject(pCurProcess);}	}	__except (1)	{ntStatus = GetExceptionCode();	}	Driver->DriverUnload = UnDriver;	return STATUS_SUCCESS;}

转存后效果如下所示：