内核开发知识第一讲.内核中的数据类型.重要数据结构.常用内核API函数.
一丶内核中的数据类型
在内核中.程序的编写不能简单的用基本数据类型了. 因为操作系统不同.很有可能造成数据类型的长度不一.而产生重大问题.所以在内核中.
数据类型都一定重定义了.
数据类型 |
重定义数据类型 |
Unsigned long |
ULONG |
Unsigned char |
UCHAR |
Unsigned int |
UINT |
Void |
VOID |
Unsigned long * |
PULONG |
Unsigned char * |
PCHAR |
Unsigned int * |
PUINT |
Void * |
PVOID |
其中字符串的数据结构也改变了.
typedef struct _UNICODE_STRING{ USHORT Length //字符串长度 USHORT MaximumLength //字符串最大长度 PWSTR Buffer; //字符串指针 }UNICODE_STRING, *PUNICODE_STRING
typedef struct _STRING { USHORT Length; USHORT MaximumLength; PCHAR Buffer; } ANSI_STRING, *PANSI_STRING;
其中操作字符串都有相应的Kerner API. 可以查询MSDN 或者 WDK Document 进行操作.
二丶内核中的重要数据结构.
IRP请求会发送给设备对象.然后驱动对象会捕获.通过分发函数进行处理. 一个驱动对象可以有多个设备对象.
在内核中. 有驱动对象.设备对象. 以及IRP请求.
驱动对象数据结构
typedef struct _DRIVER_OBJECT { CSHORT Type; //类型 CSHORT Size; //大小. PDEVICE_OBJECT DeviceObject; //设备对象链表开始,一个驱动对象可以有多个设备对象.其中DeviceObject结构体中有相关信息. ULONG Flags; PVOID DriverStart; //内核模块在内核中间的开始地址跟大小. ULONG DriverSize; PVOID DriverSection; PDRIVER_EXTENSION DriverExtension; UNICODE_STRING DriverName;//驱动的名字 PUNICODE_STRING HardwareDatabase; //快速IO分发函数. PFAST_IO_DISPATCH FastIoDispatch; PDRIVER_INITIALIZE DriverInit; PDRIVER_STARTIO DriverStartIo; //驱动对象的卸载函数. PDRIVER_UNLOAD DriverUnload; //一个函数指针数组. 普通的分发函数.数组中保存了分发函数的地址. PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT; typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;
设备对象数据结构
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT { CSHORT Type; //类型跟大小. USHORT Size; //引用计数 LONG ReferenceCount; //这个设备所属于驱动对象的指针. 保存了驱动对象. struct _DRIVER_OBJECT *DriverObject; //下一个设备对象.一个驱动对象可以有n个设备.用单向链表进行连接. struct _DEVICE_OBJECT *NextDevice; struct _DEVICE_OBJECT *AttachedDevice; struct _IRP *CurrentIrp; PIO_TIMER Timer; ULONG Flags; // See above: DO_... ULONG Characteristics; // See ntioapi: FILE_... __volatile PVPB Vpb; PVOID DeviceExtension; //设备对象类型 DEVICE_TYPE DeviceType; //堆栈大小. CCHAR StackSize; union { LIST_ENTRY ListEntry; WAIT_CONTEXT_BLOCK Wcb; } Queue; ULONG AlignmentRequirement; KDEVICE_QUEUE DeviceQueue; KDPC Dpc; // // The following field is for exclusive use by the filesystem to keep // track of the number of Fsp threads currently using the device // ULONG ActiveThreadCount; PSECURITY_DESCRIPTOR SecurityDescriptor; KEVENT DeviceLock; USHORT SectorSize; USHORT Spare1; struct _DEVOBJ_EXTENSION *DeviceObjectExtension; PVOID Reserved; } DEVICE_OBJECT; typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT;
IRP 请求包.
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _IRP { CSHORT Type; //类型 USHORT Size; //大小 // // Define the common fields used to control the IRP. // // // Define a pointer to the Memory Descriptor List (MDL) for this I/O // request. This field is only used if the I/O is "direct I/O". // PMDL MdlAddress; //内核描述符指针.读写的缓冲区. // // Flags word - used to remember various flags. // ULONG Flags; // // The following union is used for one of three purposes: // // 1. This IRP is an associated IRP. The field is a pointer to a master // IRP. // // 2. This is the master IRP. The field is the count of the number of // IRPs which must complete (associated IRPs) before the master can // complete. // // 3. This operation is being buffered and the field is the address of // the system space buffer. // union { //SystemBuffer里面看看请求是那个IO请求.来取决于用上面的缓冲区还是下面的缓冲区. struct _IRP *MasterIrp; __volatile LONG IrpCount; PVOID SystemBuffer; } AssociatedIrp; // // Thread list entry - allows queueing the IRP to the thread pending I/O // request packet list. // LIST_ENTRY ThreadListEntry; // // I/O status - final status of operation. // IO_STATUS_BLOCK IoStatus; // IO的请求状态.一般请求完成后的返回情况放在这里. // // Requestor mode - mode of the original requestor of this operation. // KPROCESSOR_MODE RequestorMode; // // Pending returned - TRUE if pending was initially returned as the // status for this packet. // BOOLEAN PendingReturned; // // Stack state information. // CHAR StackCount; //栈空间大小. CHAR CurrentLocation; //当前的IRP栈空间. // // Cancel - packet has been canceled. // BOOLEAN Cancel; // // Cancel Irql - Irql at which the cancel spinlock was acquired. // KIRQL CancelIrql; // // ApcEnvironment - Used to save the APC environment at the time that the // packet was initialized. // CCHAR ApcEnvironment; // // Allocation control flags. // UCHAR AllocationFlags; // // User parameters. // PIO_STATUS_BLOCK UserIosb; PKEVENT UserEvent; union { struct { union { PIO_APC_ROUTINE UserApcRoutine; PVOID IssuingProcess; }; PVOID UserApcContext; } AsynchronousParameters; LARGE_INTEGER AllocationSize; } Overlay; // // CancelRoutine - Used to contain the address of a cancel routine supplied // by a device driver when the IRP is in a cancelable state. // __volatile PDRIVER_CANCEL CancelRoutine; //用来取消一个未决请求的函数. // // Note that the UserBuffer parameter is outside of the stack so that I/O // completion can copy data back into the user's address space without // having to know exactly which service was being invoked. The length // of the copy is stored in the second half of the I/O status block. If // the UserBuffer field is NULL, then no copy is performed. // PVOID UserBuffer; //与MdlAddress 跟SystemBuffer一样都是缓冲区. //缓冲区的特性不同. // // Kernel structures // // The following section contains kernel structures which the IRP needs // in order to place various work information in kernel controller system // queues. Because the size and alignment cannot be controlled, they are // placed here at the end so they just hang off and do not affect the // alignment of other fields in the IRP. // union { struct { union { // // DeviceQueueEntry - The device queue entry field is used to // queue the IRP to the device driver device queue. // KDEVICE_QUEUE_ENTRY DeviceQueueEntry; struct { // // The following are available to the driver to use in // whatever manner is desired, while the driver owns the // packet. // PVOID DriverContext[4]; } ; } ; // // Thread - pointer to caller's Thread Control Block. // PETHREAD Thread; //发出这个请求的线程. // // Auxiliary buffer - pointer to any auxiliary buffer that is // required to pass information to a driver that is not contained // in a normal buffer. // PCHAR AuxiliaryBuffer; // // The following unnamed structure must be exactly identical // to the unnamed structure used in the minipacket header used // for completion queue entries. // struct { // // List entry - used to queue the packet to completion queue, among // others. // LIST_ENTRY ListEntry; union { // // Current stack location - contains a pointer to the current // IO_STACK_LOCATION structure in the IRP stack. This field // should never be directly accessed by drivers. They should // use the standard functions. // // 一个IRP 栈空间的元素. struct _IO_STACK_LOCATION *CurrentStackLocation; // // Minipacket type. // ULONG PacketType; }; }; // // Original file object - pointer to the original file object // that was used to open the file. This field is owned by the // I/O system and should not be used by any other drivers. // PFILE_OBJECT OriginalFileObject; } Overlay; // // APC - This APC control block is used for the special kernel APC as // well as for the caller's APC, if one was specified in the original // argument list. If so, then the APC is reused for the normal APC for // whatever mode the caller was in and the "special" routine that is // invoked before the APC gets control simply deallocates the IRP. // KAPC Apc; // // CompletionKey - This is the key that is used to distinguish // individual I/O operations initiated on a single file handle. // PVOID CompletionKey; } Tail; } IRP;
其中IRP注意的事项. 因为IRP发送给设备对象请求.所以有多个设备对象.而IRP结构体是固定的.所以在操作的时候.会有一些变动的参数.为了存储这些变动的参数.
所以IRP结构体中保存了当前IRP堆栈.如果获取这些变动的参数.可以通过IRP堆栈来操作.
其中: CurrentLocation表示的当前是哪一个IRP堆栈.
三丶内核中常用的kerner API
我们知道.在应用层中.我们有SDK开发工具包. 里面的API供我们使用.现在内核中也提供了Kerner(内核) API给我们使用.
一般名字都有前缀.
IO EX Rtl Ke Zw Nt Ps开头.
常用的kerner API介绍.
1.Ex系列API
Ex内存系列API |
|
ExAllocatePool |
申请内存,类似于C语言的malloc |
ExFreePool |
释放内存,C语言中的free |
ExAcquireFastMutex |
获取一个快速互斥体.多线程中使用. |
ExReleaseFastMutex |
释放一个快速互斥体 |
ExRaiseStatus |
抛出一个异常.带有错误Status的值 |
2.Zw文件操作API (可以是设备)
介绍API前介绍一下Nt函数. Zw函数跟Nt函数是简单的跳转关系. 用户态也有对应的API与之对应. 在内核中Nt函数是查询不到的.因为微软不建议使用Nt函数.
不过我们声明一下还是可以使用的.
Zw 文件设备操作API |
对应NT API |
作用 |
ZwCreateFile |
NtCreateFile |
打开文件/设备 |
ZwReadFile |
NtReadFile |
读文件/设备 |
ZwWriteFile |
NtWriteFile |
写文件/设备 |
ZwQueryDirctoryFile |
NtQueryDirctoryFile |
目录查询 |
ZwDeviceIoControFile |
NtDeviceIoControlFile |
发送设备控制请求 |
ZwCreateKey |
NtCreateKey |
打开一个注册表键 |
ZwQueryValueKey |
NtQueryValueKey |
打开一个注册表值 |
3.Rtl字符串操作函数
我们知道内核中有了新的UNICODE_STRING 跟 ANSI_STRING的字符串.那么也有与之对应操作的API
Rtl函数 |
功能 |
RtlInitUnicodeString |
初始化一个Unicode字符串结构 |
RtlCopyUnicodeString |
拷贝字符串 |
RtlAppendUnicodeToString |
将一个字符串追加到另一个字符串后 |
RtlStringCbPrintf |
讲一个字符串打印到字符串中,相当于sprintf |
RtlCopyMemory |
内存数据块拷贝. |
RtlMoveMemory |
内存数据块移动. |
RtlZeroMemory |
内存块清零.注意不是释放内存,而是内存的值都变成0 |
RtlCompareMemory |
内存比较 |
RtlGetVersion |
获得当前Windows 版本 |
四丶IO管理器API
注意,IO函数比较重要. IO函数涉及IO管理器,而IO管理器就是将用户调用的API 翻译成IRP请求.或者讲等价的请求发送到内核中不同的设备.
是一个关键组件. 这个类别一般涉及到的都是IRP. 很关键.
IO函数 |
作用 |
IoCreateFile |
创建文件,比ZwCreateFile更加底层 |
IoCreateDevice |
生成一个设备对象 |
IoCallDriver |
发送请求 |
IoCompleteRequest |
完成请求,通知IO管理器完成了IRP请求 |
IoCopyCurrentIrpStackLocationToNext |
将当前的IRP堆栈拷贝到下一个栈空间 |
IoSkipCurrentIrpStackLoctionToNext |
跳过当前的IRP的栈空间 |
IoGetCurrentIrpStackLocation |
获得IRP的当前栈空间指针. |
五丶Ps 进程线程相关的函数.
Ps进程相关函数 |
作用 |
PsGetCurrentProcess |
获得当前的EPROCESS结构 |
PsGetCurrentProcessId |
获得当前的进程ID |
PsGetCurrentThread |
获得当前的ETHREAD结构 |
PsGetCurrentThreadId |
获得当前的线程ID |
PsIsSystemThread |
判断是否是系统线程. |
PsTerminateSystemThread |
结束系统线程. |
关于Kerner API, 简单的熟悉这些API.然后多看WDK Document 或者MSDN, 尽快熟悉API使用. 这样编写内核程序才会熟悉. 为以为逆向做准备.