资源描述：
《驱动中跨进程读写访问内存》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、驱动中跨进程读写访问内存学习各种高级外挂制作技术，马上去百度搜索"魔鬼作坊"，点击第一个站进入，快速成为做挂达人。第一次内核编程,代码写的比较乱,不免也有些错误.各位牛哥们,见笑乐,!时间仓促,也没对代码进程封装,和界面相关太多.1.切换目标进程的CR3通常,跨进程读写内存,用到ReadProcessMemory,WriteProcessMemory,但需要进程句柄,如果目标进程受到保护,可能获得进程句柄会失败.ReadProcessMemory最后会调用到KeStackAttachProcess附加到目标进程上切换进程环境进行拷贝的,所以想到拿到目标进
2、程的虚拟内存内容,可以将目标进程的页目录基地址放入CR3中即可.首先要获得目标进程的cr3寄存器,即页目录基地址(开启PAE,页目录指针表),每个进程在内核里都有一个EPROCESS结构.代码:nt!_EPROCESS+0x000Pcb:_KPROCESS+0x06cProcessLock:_EX_PUSH_LOCK+0x070CreateTime:_LARGE_INTEGER+0x078ExitTime:_LARGE_INTEGER+0x080RundownProtect:_EX_RUNDOWN_REF…….Pcb中就有我们想要得到的CR3代码:nt!
3、_KPROCESS+0x000Header:_DISPATCHER_HEADER+0x010ProfileListHead:_LIST_ENTRY+0x018DirectoryTableBase:[2]Uint4B+0x020LdtDescriptor:_KGDTENTRY+0x028Int21Descriptor:_KIDTENTRY………那只需要获得目标进程EPROCESS就可以得到CR3了遍历EPROCESS里的ActiveProcessLinks的链表获取指定进程的EPROCESS代码://获得当前进程EPROCESS信息ULONGuEproce
4、ss=0;__asm{moveax,fs:[0x124]//_ethreadmoveax,[eax+0x44]//_kprocessmovuEprocess,eax}KdPrint(("EPROCESS:0x%08x",uEprocess));LIST_ENTRYListHead;InitializeListHead(&ListHead);ULONGuFirstEprocess=uEprocess;ULONGuCount=0;PLIST_ENTRYpActiveProcessLinks;ProcessInfoList*pProcssList=NULL
5、;ULONGuNameOffset=GetPlantformDependentInfo(FILE_NAME_OFFSET);ULONGuPidOffset=GetPlantformDependentInfo(PROCESS_ID_OFFSET);ULONGuLinkOffset=GetPlantformDependentInfo(PROCESS_LINK_OFFSET);ULONGuExitTime=GetPlantformDependentInfo(EXIT_TIME_OFFSET);//遍历链表获得进程信息do{pProcssList=(Proces
6、sInfoList*)ExAllocatePool(PagedPool,sizeof(ProcessInfoList));if(pProcssList==NULL){status=STATUS_INSUFFICIENT_RESOURCES;break;}PLARGE_INTEGERExitTime;ExitTime=(PLARGE_INTEGER)(uEprocess+uExitTime);if(ExitTime->QuadPart==0){if(*(int*)(uEprocess+uPidOffset)<=0){pProcssList->ProcInf
7、o.uProcessId=0;pProcssList->ProcInfo.uEprocess=uEprocess;pProcssList->ProcInfo.uCR3=*(PULONG)(uEprocess+0x18);RtlCopyMemory(pProcssList->ProcInfo.pszImageFileName,"Idle",16);InsertHeadList(&ListHead,&pProcssList->ListEntry);KdPrint(("PID:%d,EPROCESS:0x%08x,FileName:%s,CR3:0x%08x
8、n",pProcssList->ProcInfo.uProcessId,pPro
