枚举IoTimer

 /***************************************************************************************
 * AUTHOR : yifi
 * DATE   : 2015-11-5
 * MODULE : EnumIoTimer.C
 *
 * Command:
 *    Source of IOCTRL Sample Driver
 *
 * Description:
 *        Demonstrates communications between USER and KERNEL.
 *
 ****************************************************************************************
 * Copyright (C) 2010 yifi.
 ****************************************************************************************/

 //#######################################################################################
 //# I N C L U D E S
 //#######################################################################################

 #ifndef CXX_ENUMIOTIMER_H
 #    include "EnumIoTimer.h"
 #endif

 NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
 {

     DriverObject->DriverUnload = UnloadDriver;

     EnumIoTimer();
     return STATUS_SUCCESS;
 }

 BOOLEAN EnumIoTimer()
 {
     PLIST_ENTRY IoTimerQueueHead = ;
     PUCHAR IoInitializeTimer = ;
     KIRQL OldIrql;
     PUCHAR StartSearchAddress = NULL;
     PUCHAR EndSearchAddress = NULL;
     PUCHAR i = NULL;
     INT32 iOffset = ;
     UCHAR v1 = , v2 = , v3 = ;

     IoInitializeTimer = (PUCHAR)GetExportVariableAddressFormNtosExportTableByVariableName(L"IoInitializeTimer");
     if (IoInitializeTimer == NULL)
     {
         return FALSE;
     }
     StartSearchAddress = IoInitializeTimer;
     EndSearchAddress = StartSearchAddress + 0x500;

 #ifdef _WIN64
     for (i = StartSearchAddress;i<EndSearchAddress;i++)
     {
         if (MmIsAddressValid(i) && MmIsAddressValid(i + ) && MmIsAddressValid(i + ))
         {
             v1 = *i;
             v2 = *(i + );
             v3 = *(i + );
             if (v1 == 0x48 && v2 == 0x8d && v3 == 0x0d)
             {
                 memcpy(&iOffset, i + , );
                 IoTimerQueueHead = (PLIST_ENTRY)(iOffset + (ULONG64)i + );
                 break;
             }

         }
     }

 #else

     for (i = StartSearchAddress; i < EndSearchAddress; i++)
     {
         v1 = *i;
         if (v1 == 0xb9)
         {
             IoTimerQueueHead = (PLIST_ENTRY)*(PULONG32)(i + );
             break;
         }
     }
 #endif

     if (IoTimerQueueHead == NULL)
     {
         return FALSE;
     }

     DbgPrint("获得了\r\n");
     OldIrql = KeRaiseIrqlToDpcLevel();

     if (IoTimerQueueHead && MmIsAddressValid((PVOID)IoTimerQueueHead))
     {
         PLIST_ENTRY NextEntry = IoTimerQueueHead->Flink;
         while (MmIsAddressValid(NextEntry) && NextEntry != (PLIST_ENTRY)IoTimerQueueHead)
         {
             PIO_TIMER Timer = CONTAINING_RECORD(NextEntry, IO_TIMER, TimerList);

             if (Timer && MmIsAddressValid(Timer))
             {
                 DbgPrint("Timer 对象: %p\r\n", Timer);
             }
             NextEntry = NextEntry->Flink;

         }
     }
     KeLowerIrql(OldIrql);
     return TRUE;
 }

 VOID UnloadDriver(PDRIVER_OBJECT DriverObject)
 {
     return;
 }

 PVOID
 GetExportVariableAddressFormNtosExportTableByVariableName(WCHAR *wzVariableName)
 {
     UNICODE_STRING uniVariableName;
     PVOID VariableAddress = NULL;

     if (wzVariableName && wcslen(wzVariableName) > )
     {
         RtlInitUnicodeString(&uniVariableName, wzVariableName);

         //从Ntos模块的导出表中获得一个导出变量的地址
         VariableAddress = MmGetSystemRoutineAddress(&uniVariableName);
     }

     return VariableAddress;
 }

代码

 /***************************************************************************************
 * AUTHOR : yifi
 * DATE   : 2015-11-5
 * MODULE : EnumIoTimer.H
 *
 * IOCTRL Sample Driver
 *
 * Description:
 *        Demonstrates communications between USER and KERNEL.
 *
 ****************************************************************************************
 * Copyright (C) 2010 yifi.
 ****************************************************************************************/

 #ifndef CXX_ENUMIOTIMER_H
 #define CXX_ENUMIOTIMER_H

 #include <ntifs.h>

 typedef struct _IO_TIMER_WIN7_X64
 {
     INT16        Type;
     INT16        TimerFlag;
     LONG32        Unknown;
     LIST_ENTRY    TimerList;
     PVOID        TimerRoutine;
     PVOID        Context;
     PVOID        DeviceObject;
 }IO_TIMER_WIN7_X64, *PIO_TIMER_WIN7_X64;

 typedef struct _IO_TIMER_WINXP_X86
 {
     INT16        Type;
     INT16        TimerFlag;
     LIST_ENTRY    TimerList;
     PVOID        TimerRoutine;
     PVOID        Context;
     PVOID        DeviceObject;
 } IO_TIMER_WINXP_X86, *PIO_TIMER_WINXP_X86;

 #ifdef _WIN64
 #define PIO_TIMER PIO_TIMER_WIN7_X64
 #define IO_TIMER  IO_TIMER_WIN7_X64
 #else
 #define PIO_TIMER PIO_TIMER_WINXP_X86
 #define IO_TIMER  IO_TIMER_WINXP_X86
 #endif

 VOID UnloadDriver(PDRIVER_OBJECT DriverObject);
 BOOLEAN EnumIoTimer();
 PVOID GetExportVariableAddressFormNtosExportTableByVariableName(WCHAR *wzVariableName);

 #endif

代码