예제 #1
0
        private void Initialise()
        {
            Overlay("_DRIVER_OBJECT");
            byte[]        dnBuffer = Members.DriverName;
            UnicodeString us       = new UnicodeString(_profile, _dataProvider, dnBuffer);

            _driverName = us.Name;
            _driverExtensionVirtualAddress = Members.DriverExtension & 0xffffffffffff;
            if (_driverExtensionVirtualAddress != 0)
            {
                _driverExtension = new DriverExtension(_profile, _dataProvider, virtualAddress: _driverExtensionVirtualAddress);
            }
            _driverSize  = Members.DriverSize;
            _driverStart = Members.DriverStart & 0xffffffffffff;


            //_is64 = (_profile.Architecture == "AMD64");
            //AddressBase addressSpace = _dataProvider.ActiveAddressSpace;
            //if (_virtualAddress != 0)
            //    _physicalAddress = addressSpace.vtop(_virtualAddress);
            //if (_physicalAddress == 0)
            //    throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT");
            ////_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive);

            //_structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT");
            //if (_structureSize == -1)
            //    throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT");
            //if (_virtualAddress == 0)
            //    _buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize);
            //else
            //    _buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize);
            //_structure = _profile.GetEntries("_DRIVER_OBJECT");
            //Structure s = GetStructureMember("DriverName");
            //if (s.EntryType == "_UNICODE_STRING")
            //{
            //    UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset);
            //    _driverName = us.Name;
            //}
            //// get the driver extension
            //if (DriverExtensionVirtualAddress != 0)
            //{
            //    _driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize);
            //}
        }
        private void Initialise()
        {
            _is64 = (_profile.Architecture == "AMD64");
            AddressBase addressSpace = _dataProvider.ActiveAddressSpace;

            if (_virtualAddress != 0)
            {
                _physicalAddress = addressSpace.vtop(_virtualAddress);
            }
            if (_physicalAddress == 0)
            {
                throw new ArgumentException("Error - Address is ZERO for _DRIVER_OBJECT");
            }
            //_physicalAddress = _dataProvider.ActiveAddressSpace.vtop(_virtualAddress, _dataProvider.IsLive);

            _structureSize = (uint)_profile.GetStructureSize("_DRIVER_OBJECT");
            if (_structureSize == -1)
            {
                throw new ArgumentException("Error - Profile didn't contain a definition for _DRIVER_OBJECT");
            }
            if (_virtualAddress == 0)
            {
                _buffer = _dataProvider.ReadPhysicalMemory(_physicalAddress, (uint)_structureSize);
            }
            else
            {
                _buffer = _dataProvider.ReadMemoryBlock(_virtualAddress, (uint)_structureSize);
            }
            _structure = _profile.GetEntries("_DRIVER_OBJECT");
            Structure s = GetStructureMember("DriverName");

            if (s.EntryType == "_UNICODE_STRING")
            {
                UnicodeString us = new UnicodeString(_profile, _dataProvider, physicalAddress: _physicalAddress + s.Offset);
                _driverName = us.Name;
            }
            // get the driver extension
            if (DriverExtensionVirtualAddress != 0)
            {
                _driverExtension = new DriverExtension(_profile, _dataProvider, physicalAddress: _physicalAddress + (ulong)_structureSize);
            }
        }