驱动程序入口点下断点技巧及分析方法.pdfVIP

DriverEntry下断点技巧

一.有符号驱动在点下断点bu[DriverName]!DriverEntry

二.无符号驱动下断点,在IopLoadDriver中间下断,分析如下:

先用有符号驱动在DriverEntry下断点,查看堆栈,通过调用栈来分析加载过程kdkv

子EBP返回地址子函数参数f7f93c7c8057789182453b108220a00000000000hook!

DriverEntry(FPO:[非Fpo])(调用约定:stdcall)f7f93d4c80577900000001t!IopLoadDriver+0x66d(FPO:[非Fpo])f7f93d7480535c

00000000827b58b8nt!IopLoadUnloadDriver+0x45(FPO:[非Fpo])f7f93dac805c72f2

b2879cf40000000000000000nt!ExpWorkerThread+0x100(FPO:[非Fpo])f7f93ddc

80542e8280535ba00000000100000000nt!PspSystemThreadStartup+0x34(FPO:[非

Fpo])000000