动态监控驱动、dll、exe加载

 /*
 windows2003 x86/x64 window7 x86 windows2008 R2 x64测试通过
 */

 #include <ntddk.h>
 #include "nt_help.h"
 DRIVER_INITIALIZE DriverEntry;

 typedef struct _OBJECT_TYPE_INITIALIZER {
     USHORT Length;
     BOOLEAN UseDefaultObject;
     BOOLEAN CaseInsensitive;
 #if WINVER>=0x0600
     ULONG ObjectTypeCode;
 #endif
     ULONG InvalidAttributes;
     GENERIC_MAPPING GenericMapping;
     ULONG ValidAccessMask;
     BOOLEAN SecurityRequired;
     BOOLEAN MaintainHandleCount;
     BOOLEAN MaintainTypeList;
     POOL_TYPE PoolType;
     ULONG DefaultPagedPoolCharge;
     ULONG DefaultNonPagedPoolCharge;
     PVOID DumpProcedure;
     PVOID OpenProcedure;
     PVOID CloseProcedure;
     PVOID DeleteProcedure;
     PVOID ParseProcedure;
     PVOID SecurityProcedure;
     PVOID QueryNameProcedure;
     PVOID OkayToCloseProcedure;
 } OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

 typedef struct _OBJECT_TYPE {
 #if WINVER<0x0600
     ERESOURCE Mutex;
 #endif
     LIST_ENTRY TypeList;
     UNICODE_STRING Name;            // Copy from object header for convenience
     PVOID DefaultObject;
     ULONG Index;
     ULONG TotalNumberOfObjects;
     ULONG TotalNumberOfHandles;
     ULONG HighWaterNumberOfObjects;
     ULONG HighWaterNumberOfHandles;
     OBJECT_TYPE_INITIALIZER TypeInfo;
 } OBJECT_TYPE, *POBJECT_TYPE;

 extern POBJECT_TYPE* MmSectionObjectType;
 PVOID pNtCreateSection = NULL;
 SYSTEM_MODULE_INFORMATION ntModInfo = {};

 #pragma alloc_text(INIT, DriverEntry)

 NTSTATUS DevicePassthrough(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
 {
         NTSTATUS status = STATUS_SUCCESS;
         PIO_STACK_LOCATION  irpSp;

         irpSp = IoGetCurrentIrpStackLocation(Irp);
         Irp->IoStatus.Status = status;
         IoCompleteRequest(Irp, IO_NO_INCREMENT);
         return status;
 }

 VOID DriverUnload (IN PDRIVER_OBJECT DriverObject)
 {
         (*MmSectionObjectType)->TypeInfo.OpenProcedure = NULL;
         KdPrint(("DriverUnload Done!\n"));
 }

 #if WINVER>=0x0600
 NTSTATUS HookSectionOpen(
     IN ULONG OpenReason,
     IN ULONG AccessMode,
     IN PEPROCESS Process OPTIONAL,
     IN PVOID Object,
     IN ACCESS_MASK* GrantedAccess,
     IN ULONG HandleCount
     )
 #else
 NTSTATUS HookSectionOpen(
     IN ULONG OpenReason,
     IN PEPROCESS Process OPTIONAL,
     IN PVOID Object,
     IN ACCESS_MASK GrantedAccess,
     IN ULONG HandleCount
     )
 #endif
 {
         PVOID* esp = (PVOID*)&esp;
         PVOID* esp_end = (PVOID*)((((DWORD64)esp>>) + )<<);        //4k round up
         PVOID* p = esp;
         ULONG SectionPageProtection, AllocationAttributes;
         HANDLE FileHandle;
         NTSTATUS Status;

         /*
          * do stack walk back to NtCreateSection function
          */
         while (p < esp_end &&
                 (*p < pNtCreateSection ||
                  *p > (PVOID)((PBYTE)pNtCreateSection + 0x300)))
                 p++;

         if (p >= esp_end){
                 //KdPrint(("no found NtCreateSection %p -> %p\n", esp, esp_end));
                 return STATUS_SUCCESS;
         }

         //KdPrint(("%p HookSectionOpen-Object:%p esp:%p %p\n", pNtCreateSection, Object, esp, *p));
 #ifdef _WIN64
         /*
          * esp layout look likes[2003 X64 DUMP]:
          fffff800`0104113d nt!KiSystemServiceCopyEnd+0x3 retaddr <-------call nt!NtCreateSection
          fffffadf`f662ec00  00000000`00000000 param1
          fffffadf`f662ec08  00000000`000f001f param2 DesiredAccess
          fffffadf`f662ec10  00000000`00000000
          fffffadf`f662ec18  00000000`00000000
          fffffadf`f662ec20  00000100`00000010 SectionPageProtection
          fffffadf`f662ec28  00000000`01000000 AllocationAttributes
          fffffadf`f662ec30  00000000`0000054c FileHandle
          * - ...
          */
         p++;
         /*
          * search retaddr -> nt!KiSystemServiceCopyEnd
          */
         while (p < esp_end &&
                 (*p < ntModInfo.ImageBase ||
                  *p > (PVOID)((PBYTE)ntModInfo.ImageBase + ntModInfo.ImageSize)))
                 p++;

         if (p >= esp_end){
                 //KdPrint(("no found nt!KiSystemxxxx %p -> %p\n", esp, esp_end));
                 return STATUS_SUCCESS;
         }
 #else
         /* stack DUMP from 2003/x86
          * ebp = p - 1
          fa06f4d8  fa06f540
          fa06f4dc  80908715 nt!NtCreateSection+0x15c
          ...
          fa06f540  fa06f564
          fa06f544  808234cb nt!KiFastCallEntry+0xf8
          fa06f548  fa06f668 param1
          */
         p = (PVOID*)*(p - );
         p++;
 #endif

         SectionPageProtection = (ULONG)*(p + );
         AllocationAttributes = (ULONG)*(p + );
         FileHandle = *(p + );

         //KdPrint(("%x %x %p\n", SectionPageProtection, AllocationAttributes, FileHandle));

         if (FileHandle
                 && SectionPageProtection == PAGE_EXECUTE
                 && (AllocationAttributes == SEC_IMAGE || AllocationAttributes == 0x100000)){
                 /* windows7 AllocationAttributes = 0x100000 to LoadDriver */
                 PFILE_OBJECT File;

                 Status = ObReferenceObjectByHandle (FileHandle,
                                 ,
                                 NULL,
                                 KernelMode,
                                 (PVOID *)&File,
                                 NULL);

                 if (!NT_SUCCESS(Status)) {
                         return STATUS_SUCCESS;
                 }
                 KdPrint(("FileName:%wZ\n", &File->FileName));
                 ObDereferenceObject(File);
         }

         return STATUS_SUCCESS;
 }

 BOOL GetNtImgBase(PSYSTEM_MODULE_INFORMATION modInfo)
 {
         PSYSMODULELIST sysModuleList = NULL;
         ULONG size, i;

         NtQuerySystemInformation(SystemModuleInformation, &size, , &size);
         sysModuleList = ExAllocatePoolWithTag(PagedPool, size, 'hlpm');

         if (sysModuleList){
                 NtQuerySystemInformation(SystemModuleInformation, sysModuleList, size, NULL);
                 /* nt module should be the first one */
                 *modInfo = *sysModuleList->Modules;
                 ExFreePool(sysModuleList);
                 return TRUE;
         }
         return FALSE;
 }

 NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
 {
         DWORD i;
         UNICODE_STRING sFuncName;

         RtlInitUnicodeString(&sFuncName, L"NtCreateSection");
         pNtCreateSection = MmGetSystemRoutineAddress(&sFuncName);

         if (!GetNtImgBase(&ntModInfo)){
                 KdPrint(("EnumSysModule nt base failed!\n"));
                 return STATUS_UNSUCCESSFUL;
         }

         KdPrint(("nt:%p pNtCreateSection:%p\nMmSectionObjectType:%p %p %p\n",
                                 ntModInfo.ImageBase,
                                 pNtCreateSection,
                                 *MmSectionObjectType,
                                 (*MmSectionObjectType)->TypeInfo.OpenProcedure,
                                 (*MmSectionObjectType)->TypeInfo.DeleteProcedure));

         (*MmSectionObjectType)->TypeInfo.OpenProcedure = HookSectionOpen;

         for (i = ; i <= IRP_MJ_MAXIMUM_FUNCTION; i++)
                 DriverObject->MajorFunction[i] = DevicePassthrough;

         DriverObject->DriverUnload = DriverUnload;

         return STATUS_SUCCESS;
 }