1、麥洛克菲內核開發(fā)第七課注冊表callback 和重定向麥洛克菲mallocfree程君程君Callback提綱nCallback 相關函數(shù)nCallback 原理nCallback 實現(xiàn)功能注冊表重定向提綱n注冊表的構成n注冊表調用Callback 相關函數(shù)NTSTATUSCmRegisterCallback(IN PEX_CALLBACK_FUNCTION Function,IN PVOID Context,OUT PLARGE_INTEGER Cookie / 時間 ); NTSTATUSCmRegisterCallbackEx(IN PEX_CALLBACK_FUNCTION Funct

2、ion,IN PCUNICODE_STRING Altitude,IN PVOID Driver,IN PVOID Context,OUT PLARGE_INTEGER Cookie, PVOID Reserved); Vista 以后運用,支持高度NTSTATUSCmUnRegisterCallback(IN LARGE_INTEGER Cookie); Callback 相關函數(shù)nCmSetCallbackObjectContext(IN OUT PVOID Object,IN PLARGE_INTEGER Cookie,IN PVOID NewContext,OUT OPTIONAL P

3、VOID *OldContext );n主要用來在一個對象上設置相關的數(shù)據(jù)構造n nNTSTATUSCmCallbackGetKeyObjectID(IN PLARGE_INTEGER Cookie,IN PVOID Object,OUT OPTIONAL PULONG_PTR ObjectID,OUT OPTIONAL PCUNICODE_STRING *ObjectName); n主要用來在vista以后得到key 的名字nPVOIDCmGetBoundTransaction(in PLARGE_INTEGER Cookie,in PVOID Object); nVOID CmGetCal

4、lbackVersion(OUT OPTIONAL PULONG Major,OUT OPTIONAL PULONG Minor); Callback 相關函數(shù)nEX_CALLBACK_FUNCTION RegistryCallback;nNTSTATUS RegistryCallback(_in PVOID CallbackContext,_in_opt PVOID Argument1, / / REG_NOTIFY_CLASS _in_opt PVOID Argument2 / KEY_INFORMATION )nswitch( (REG_NOTIFY_CLASS) Argument1)n

5、ncase RegNtPreDeleteKey :nreturn HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION) Argument2);ncase RegNtPreSetValueKey:nreturn HOOK_PreNtSetValueKey(PREG_SET_VALUE_KEY_INFORMATION) Argument2);ncase RegNtPreDeleteValueKey:nreturn HOOK_PreNtDeleteValueKey(PREG_DELETE_VALUE_KEY_INFORMATION) Argument2);

6、ncase RegNtPreRenameKey:nreturn HOOK_PreNtRenameKey(PREG_RENAME_KEY_INFORMATION) Argument2);ncase RegNtPreCreateKeyEx:nreturn HOOK_PreNtCreateKeyEx(PREG_CREATE_KEY_INFORMATION) Argument2);ncase RegNtPreCreateKeyEx: / pre 操作nreturn HOOK_PreNtCreateKeyEx(PREG_CREATE_KEY_INFORMATION) Argument2);ncase R

7、egNtPostCreateKeyEx : / post 操作nreturn HOOK_PostNtCreateKeyEx(PRGG_POST_OPERATION_INFORMATION ) Argument2);nCallback 相關函數(shù)nPre 操作nREG_XXX_KEY_INFORMATIONn根據(jù)調用的各個不同REG_NOTIFY_CLASS 來決議 nPOST 操作ntypedef struct _REG_POST_OPERATION_INFORMATION PVOID Object; / pre 操作后產(chǎn)生的對象NTSTATUS Status; / pre 完成后將要前往給系統(tǒng)

8、的形狀n PVOID PreInformation; / pre 的類信息NTSTATUS ReturnStatus; / 假設要作修正,將要前往的形狀PVOID CallContext; / PVOID ObjectContext; / 可以pre 設置帶到post里面來PVOID Reserved; REG_POST_OPERATION_INFORMATION,*PREG_POST_OPERATION_INFORMATION; 整體框架NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING Regist

9、ryPath) NTSTATUS ntStatus;ntStatus = CmRegisterCallback(MyRegistryCallback, NULL, &pCookie);return ntStatus;NTSTATUS RegistryCallback(_in PVOID CallbackContext,_in_opt PVOID Argument1, / / REG_NOTIFY_CLASS _in_opt PVOID Argument2 / KEY_INFORMATION ) switch( (REG_NOTIFY_CLASS) Argument1) case Reg

10、NtPreDeleteKey :return HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION) Argument2); case RegNtPreRenameKey:return HOOK_PreNtRenameKey(PREG_RENAME_KEY_INFORMATION) Argument2); case RegNtPreCreateKeyEx: / pre 操作 return HOOK_PreNtCreateKeyEx(PREG_CREATE_KEY_INFORMATION) Argument2); case RegNtPostCreate

11、KeyEx : / post 操作return HOOK_PostNtCreateKeyEx(PRGG_POST_OPERATION_INFORMATION ) NTSTATUS HOOK_PreNtDeleteKey(PREG_DELETE_KEY_INFORMATION Data)NTSTATUS status = 0;PUNICODE_STRING keyName;UNICODE_STRING uTarget;return STATUS_SUCCESS;Callback 實現(xiàn)的功能nMonitorn主要用在系統(tǒng)工具上,procmon,regmonnBlockn防御上，維護上等等nModi

12、fynSandbox,虛擬化等等Callback 實現(xiàn)的功能nMonitornRegistryCallback routine returns STATUS_SUCCESS nBlocknRegistryCallback routine NT_SUCCESS(status) equals FALSE, 這時候直接前往形狀status 給系統(tǒng)調用,假設注冊了post 操作的話,post 操作將不會執(zhí)行n Callback 實現(xiàn)的功能nModifyn1. 修正REG_xxx_KEY_INFORMATION 構造里面的然后 Callback 函數(shù)前往STATUS_SUCCESS n2. 修正REG_

13、POST_OPERATION_INFORMATION 構造里的ReturnStatus,然后Callback 函數(shù)前往STATUS_CALLBACK_BYPASS Callback 設計中心思想nWindow 操作系統(tǒng)的設計中心n音訊分發(fā)：運用層nn分層：從運用到內核nn回調：也相當于分層，其實回調應該是設計的一種接口方式Callback 設計中心分層思想Callback 設計中心思想ntOpenKey().if(isCallback() return regcalllist-preOpen();.if(isCallback() return regcalllist-postOpen();1.

14、在注冊的時候把要注冊的函數(shù)放到全局鏈表里2.在調用的時候，先判別能否注冊，假設注冊，調用函數(shù)Callback 原理nNTSTATUSnCmRegisterCallback(_in PEX_CALLBACK_FUNCTION Function, _in_opt PVOID Context,_out PLARGE_INTEGER Cookie)nn PEX_CALLBACK_ROUTINE_BLOCK RoutineBlock;n ULONG i;n PCM_CALLBACK_CONTEXT_BLOCK CmCallbackContext;n PAGED_CODE();n CmCallbackCo

15、ntext = (PCM_CALLBACK_CONTEXT_BLOCK)ExAllocatePoolWithTag (PagedPool, sizeof (CM_CALLBACK_CONTEXT_BLOCK), bcMC);n if( CmCallbackContext = NULL ) n return STATUS_INSUFFICIENT_RESOURCES;n n RoutineBlock = ExAllocateCallBack (Function,CmCallbackContext);n if( RoutineBlock = NULL ) n ExFreePool(CmCallba

16、ckContext);n return STATUS_INSUFFICIENT_RESOURCES;n n/ init the contextnKeQuerySystemTime(&(CmCallbackContext-Cookie);n *Cookie = CmCallbackContext-Cookie;n InitializeListHead(&(CmCallbackContext-ThreadListHead); nExInitializePushLock(&(CmCallbackContext-ThreadListLock);n CmCallbackConte

17、xt-CallerContext = Context;n/ find a spot where we could add this callbacknfor( i=0;iCmpCallCallBacksCallback 原理：注冊的函數(shù)什么時間調用1.NtOpenKey 和NtCreateKey CmpParseKeyNtOpenKey-ObOpenObjectByName(ObInsertObject ObReferenceObjectByName)-ObpLookupObjectName(ParseProcedure)Callback 原理：注冊的函數(shù)什么時間調用2pParseKeyPha

18、se1Initialization-Phase1InitializationDiscard-CmInitSystem1-CmpCreateObjectTypes-CmpParseKey-CmpCallCallBacks RtlZeroMemory(&ObjectTypeInitializer, sizeof(ObjectTypeInitializer); ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer); ObjectTypeInitializer.InvalidAttributes = CMP_KEY_INVAL

19、ID_ATTRIBUTES; ObjectTypeInitializer.GenericMapping = CmpKeyMapping; ObjectTypeInitializer.ValidAccessMask = KEY_ALL_ACCESS; ObjectTypeInitializer.DefaultPagedPoolCharge = sizeof(CM_KEY_BODY);. ObjectTypeInitializer.DumpProcedure = NULL; ObjectTypeInitializer.OpenProcedure = NULL; ObjectTypeInitiali

20、zer.CloseProcedure = CmpCloseKeyObject; ObjectTypeInitializer.DeleteProcedure = CmpDeleteKeyObject; ObjectTypeInitializer.ParseProcedure = CmpParseKey; ObjectTypeInitializer.SecurityProcedure = CmpSecurityMethod; ObjectTypeInitializer.QueryNameProcedure = CmpQueryKeyName;a.從上面可以看出：在創(chuàng)建key object 類型的時

21、候，注冊key對象的ParseProcedure，從而把對象類型和詳細的對象聯(lián)絡起來b.從CmpParseKey可知道，用CmAreCallbacksRegistered 判別能否注冊Callback 原理：注冊的函數(shù)什么時間調用CmpParseKeybasentosconfig if ( CmAreCallbacksRegistered() ) REG_CREATE_KEY_INFORMATION PreCreateInfo; PreCreateInfopleteName = CompleteName; PreCreateInfo.RootObject = ParseObject; if(

22、ARGUMENT_PRESENT(lcontext) ) / / NtCreateKey / status = CmpCallCallBacks(RegNtPreCreateKeyEx,&PreCreateInfo,TRUE,RegNtPostCreateKeyEx,ParseObject); else / / NtOpenKey / status = CmpCallCallBacks(RegNtPreOpenKeyEx,(PREG_OPEN_KEY_INFORMATION)(&PreCreateInfo),TRUE,RegNtPostOpenKeyEx,ParseObject); if( !NT_SUCCESS(status) ) / 前往到哪里去了 ObpLookupObjectName return status; BEGIN_LOCK_CHECKPOINT; kcb = (PCM_KEY_BODY)ParseObject)-KeyControlBlock; Callback 原理：注冊的函數(shù)什么時間調用 練習n1.regmonn2.特殊技藝n3.了解回調設計架構n4. file 的回調分析注冊表的構成注冊表的構成注冊表的類型注冊表與文件對應關系注冊表的調用關系重定向方案n1.ntdll hookn需求x64的hook 引擎