获取全局描述符表GDT的内容
/stdfx.h文件
//Ring0环的程序
//测试环境VS2005
#ifndef _WIN32_WINNT // Allow use of features specific to Windows XP or later.
#define _WIN32_WINNT 0x0501 // Change this to the appropriate value to target other versions of Windows.
#endif
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#include <ntddstor.h>
#include <mountdev.h>
#include <ntddvol.h>
#ifdef __cplusplus
}
#endif
</pre><pre name="code" class="cpp"><pre name="code" class="cpp">//stdfx.cpp文件 //This file is used to build a precompiled header #include "stdafx.h"
//GetGDT.cpp文件
#include "stdafx.h"
//SGDT返回的数据格式
#pragma pack(1)
typedef struct
{
USHORT GDTLimit; //GDT表的字节大小
ULONG GDTAddress; //GDT表的基址
}GDTINFO, *PGDTINFO;
#pragma pack()
//驱动的控制码
#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
#define MY_BASE 0x800
#define MY_CTL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN, MY_BASE + i, METHOD_BUFFERED, FILE_ANY_ACCESS)
//设置控制码IOCTL_GET_GDT
#define IOCTL_GET_GDT MY_CTL_CODE(1)
//卸载例程
void GetGDTUnload(IN PDRIVER_OBJECT DriverObject);
//创建关闭例程
NTSTATUS GetGDTCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
//默认处理例程
NTSTATUS GetGDTDefaultHandler(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
//驱动控制例程函数的声明
NTSTATUS DispathControlDriver(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
#ifdef __cplusplus
//驱动入口函数
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
#endif
//入口函数
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
UNICODE_STRING DeviceName,Win32Device;
PDEVICE_OBJECT DeviceObject = NULL;
NTSTATUS status;
ULONG i;
//设置断点
KdBreakPoint();
//设置设备名称
RtlInitUnicodeString(&DeviceName, L"\\Device\\GetGDT0");
//设置设备连接符
RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\GetGDT0");
//填充默认的派遣函数
for (i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
{
DriverObject->MajorFunction[i] = GetGDTDefaultHandler;
}
//设置创建函数
DriverObject->MajorFunction[IRP_MJ_CREATE] = GetGDTCreateClose;
//设置关闭函数
DriverObject->MajorFunction[IRP_MJ_CLOSE] = GetGDTCreateClose;
//设置驱动控制函数
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispathControlDriver;
//设置卸载函数
DriverObject->DriverUnload = GetGDTUnload;
//创建设备对象
status = IoCreateDevice(DriverObject,
0,
&DeviceName,
FILE_DEVICE_UNKNOWN,
0,
FALSE,
&DeviceObject);
if (!NT_SUCCESS(status))
return status;
if (!DeviceObject)
return STATUS_UNEXPECTED_IO_ERROR;
//直接方式I/O
DeviceObject->Flags |= DO_DIRECT_IO;
//设置文件字对齐
DeviceObject->AlignmentRequirement = FILE_WORD_ALIGNMENT;
//创建符号连接
status = IoCreateSymbolicLink(&Win32Device, &DeviceName);
if (!NT_SUCCESS(status))
return status;
//设备初始化完毕可以工作了
DeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
return STATUS_SUCCESS;
}
//卸载例程
void GetGDTUnload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING Win32Device;
RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\GetGDT0");
//删除连接符
IoDeleteSymbolicLink(&Win32Device);
//删除设备
IoDeleteDevice(DriverObject->DeviceObject);
}
//创建关闭例程
NTSTATUS GetGDTCreateClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
Irp->IoStatus.Status = STATUS_SUCCESS;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
//默认处理例程
NTSTATUS GetGDTDefaultHandler(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
Irp->IoStatus.Status = STATUS_NOT_SUPPORTED;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return Irp->IoStatus.Status;
}
//驱动的控制例程函数
NTSTATUS DispathControlDriver(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
PIO_STACK_LOCATION pIrpStack = NULL;
ULONG uIoControlCode = 0;
PVOID pIoBuffer = NULL;
ULONG uInSize = 0;
ULONG uOutSize = 0;
//设置断点
KdBreakPoint();
//获取当前IRP的堆栈
pIrpStack = IoGetCurrentIrpStackLocation(Irp);
//获取设备控制例程的控制代码
uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
//获取IRP的缓冲区
pIoBuffer = Irp->AssociatedIrp.SystemBuffer;
//获取缓冲区的输出长度
uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch(uIoControlCode)
{
//获取GDT表
case IOCTL_GET_GDT:
{
//设置断点
KdBreakPoint();
INT i = 0;
ULONG uLeng = 0;
GDTINFO gdtEntry;
ULONG gdtAddr = 0;
//获取GDTR寄存器的值
__asm sgdt gdtEntry;
//GDTR寄存器值的头两个字节表示的是GDT表的长度，后4个字节表示的是GDT表的地址
//获取GDT表的界限
uLeng = gdtEntry.GDTLimit;
//获取GDT表的基址
gdtAddr = gdtEntry.GDTAddress;
//拷贝GDT表值到输出缓冲区
RtlCopyMemory((CHAR*)pIoBuffer, (CHAR*)gdtAddr, uLeng);
uOutSize = uLeng;
status = STATUS_SUCCESS;
}
break;
}
//设置成功操作的字节数
if(status == STATUS_SUCCESS)
{
Irp->IoStatus.Information = uOutSize;
}
else
{
Irp->IoStatus.Information = 0;
}
//设置I/O状态
Irp->IoStatus.Status = status;
//完成请求
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return status;
}
</pre><pre name="code" class="cpp"><pre name="code" class="cpp">//Ring3环程序的测试环境为VC6.0
//推荐在F5调试环境下测试
//注：在GDT表的解析时，好像出了错？
#include <stdlib.h>
#include <Windows.h>
#include <winioctl.h>
//段的定义-64位
#pragma pack(1)
typedef struct
{
unsigned int m_Limit1:16; //段界限低16位
unsigned int m_BaseAddr1:24; //段基地址低24位
unsigned int m_Attributes:12; //段属性12位
unsigned int m_Limit2:4; //段界限高4位
unsigned int m_BaseAddr2:8; //段基地址高8位
}SEGMENT, *PSEGMENT;
//段基址32位
//段界限20位
#pragma pack()
//获取段基址
#define MAKESEGADDR(BaseAddr1, BaseAddr2)\
((unsigned long) (((unsigned short) (BaseAddr1)) | ((unsigned long) ((unsigned short) (BaseAddr2))) << 24))
//获取段界限
#define MAKESEGLIMIT(Limit1, Limit2)\
((unsigned long) (((unsigned short) (Limit1)) | ((unsigned long) ((unsigned short) (Limit2))) << 16))
//直接使用<winioctl.h>头文件不使用宏
//驱动控制所需要的宏
//#define METHOD_BUFFERED 0
//#define FILE_ANY_ACCESS 0
//#define FILE_DEVICE_UNKNOWN 0x00000022
//驱动的控制码
#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
//0x800之前的数值系统保留
#define MY_BASE 0x800
#define MY_CTL_CODE(i) CTL_CODE(FILE_DEVICE_UNKNOWN, MY_BASE + i, METHOD_BUFFERED, FILE_ANY_ACCESS)
//设置控制码IOCTL_GET_GDT
#define IOCTL_GET_GDT MY_CTL_CODE(1)
//连接符
#define WIN32_LINK_NAME "\\\\.\\GetGDT0"
int main(int argc, char* argv[])
{
DWORD dwRead = 0;
BYTE szBuffer[0x1000];
//清零
RtlZeroMemory(szBuffer, 0, sizeof(szBuffer));
//打开文件句柄
HANDLE hFile = CreateFile(WIN32_LINK_NAME,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
printf("CreateFile False!\r\n");
return 0;
}
//发送获取GDT表值的请求
BOOL blRet = DeviceIoControl(hFile, IOCTL_GET_GDT,
0, NULL,
szBuffer, sizeof(szBuffer),
&dwRead,
NULL);
if (blRet == FALSE)
{
printf("DeviceIoControl False!\r\n");
return 0;
}
DWORD dwSegBaseAddr = 0;
DWORD dwSegLimit = 0;
DWORD dwSegAttribt = 0;
PSEGMENT pSegmentEntry = NULL;
for (DWORD i = 0; i < dwRead; i += 8)
{
//GDT表的一项
pSegmentEntry = (PSEGMENT)(szBuffer+i);
//获取段基址-32位
dwSegBaseAddr = MAKESEGADDR(pSegmentEntry->m_BaseAddr1, pSegmentEntry->m_BaseAddr2);
//获取段界限-20位
dwSegLimit = MAKESEGLIMIT(pSegmentEntry->m_Limit1, pSegmentEntry->m_Limit2);
//获取段属性-12位
dwSegAttribt = pSegmentEntry->m_Attributes;
//显示GDT表项的值
printf("SegmentBase：%08X, SegmentLimit：%06X, SegmentAtrribute：%04X\r\n", dwSegBaseAddr, dwSegLimit, dwSegAttribt);
}
//暂停
system("pause");
return 0;
}