系统回调介绍

805d0c27 56              push    esi
805d0c28 57              push    edi
805d0c29 7464            je      nt!PsSetCreateProcessNotifyRoutine+0x73 (805d0c8f)
805d0c2b bf404a5680      mov     edi,offset nt!PspCreateProcessNotifyRoutine (80564a40)   
805d0c30 57              push    edi

PspCreateProcessNotifyRoutine (80564a40)即这个数组的地址，这个数组是以下结构：
ypedef struct _EX_FAST_REF
{
    union
    {
        PVOID Object;
        ULONG_PTR RefCnt:3;
        ULONG_PTR Value;
    };
} EX_FAST_REF, *PEX_FAST_REF;

低三位RefCnt是引用指针，Value指向一个结构，如下：
typedef struct _EX_CALLBACK_ROUTINE_BLOCK
{
    EX_RUNDOWN_REF RundownProtect;
    PEX_CALLBACK_FUNCTION Function;
    PVOID Context;
} EX_CALLBACK_ROUTINE_BLOCK, *PEX_CALLBACK_ROUTINE_BLOCK;

804fa138 c7400458d75580  mov     dword ptr [eax+4],offset nt!KeBugCheckCallbackListHead (8055d758)

*
NTKERNELAPI
BOOLEAN
KeRegisterBugCheckCallback (
    __out PKBUGCHECK_CALLBACK_RECORD CallbackRecord,
    __in PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine,
    __in PVOID Buffer,
    __in ULONG Length,
    __in PUCHAR Component
    )
typedef struct _KBUGCHECK_CALLBACK_RECORD {
    LIST_ENTRY Entry;
    PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine;
    PVOID Buffer;
    ULONG Length;
    PUCHAR Component;
    ULONG_PTR Checksum;
    UCHAR State;
} KBUGCHECK_CALLBACK_RECORD, *PKBUGCHECK_CALLBACK_RECORD;

LIST_ENTRY KeBugCheckCallbackListHead;
LIST_ENTRY KeBugCheckReasonCallbackListHead;

typedef VOID (*PLEGO_NOTIFY_ROUTINE)( PKTHREAD Thread );
ULONG PsSetLegoNotifyRoutine( PLEGO_NOTIFY_ROUTINE LegoNotifyRoutine ) 
{ 
    PAGED_CODE(); 
    PspLegoNotifyRoutine = LegoNotifyRoutine; 
    return FIELD_OFFSET(KTHREAD,LegoData); 
} 

nt!PsSetLegoNotifyRoutine:
805d299a 8bff            mov     edi,edi
805d299c 55              push    ebp
805d299d 8bec            mov     ebp,esp
805d299f 8b4508          mov     eax,dword ptr [ebp+8]
805d29a2 a3c0d26780      mov     dword ptr [nt!PspLegoNotifyRoutine (8067d2c0)],eax//这里
805d29a7 b8d0000000      mov     eax,0D0h
805d29ac 5d              pop     ebp
805d29ad c20400          ret     4

LIST_ENTRY IopNotifyShutdownQueueHead;
LIST_ENTRY IopNotifyLastChanceShutdownQueueHead;

typedef struct _SHUTDOWN_PACKET {
    LIST_ENTRY ListEntry;
    PDEVICE_OBJECT DeviceObject;
} SHUTDOWN_PACKET, *PSHUTDOWN_PACKET;

ULONG GetNotifyAddr(PDEVICE_OBJECT Device_Object)
{
  ULONG Addr;
  PDRIVER_OBJECT Driver_Object;
  Driver_Object=Device_Object->DriverObject;
  Addr=*(ULONG*)((ULONG)Driver_Object+0x38+0x40);
  return Addr;
}

typedef NTSTATUS (*PSE_LOGON_SESSION_TERMINATED_ROUTINE) (
  IN PLUID LogonId
  );
typedef struct _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION {
    struct _SEP_LOGON_SESSION_TERMINATED_NOTIFICATION *Next;
    PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine;
} SEP_LOGON_SESSION_TERMINATED_NOTIFICATION, *PSEP_LOGON_SESSION_TERMINATED_NOTIFICATION;

NTSTATUS
SeRegisterLogonSessionTerminatedRoutine(
    IN PSE_LOGON_SESSION_TERMINATED_ROUTINE CallbackRoutine
    );

typedef struct _NOTIFICATION_PACKET 
{
    LIST_ENTRY ListEntry;
    PDRIVER_OBJECT DriverObject;
    ULONG NotificationRoutine;
} NOTIFICATION_PACKET, *PNOTIFICATION_PACKET;

InsertHeadList(&PnpNotifyListHead, &Entry->PnpNotifyList);
KeReleaseGuardedMutex(&PnpNotifyListLock);
DPRINT("IoRegisterPlugPlayNotification() returns NotificationEntry %p\n",
        Entry);
*NotificationEntry = Entry;

typedef struct _PNP_NOTIFY_ENTRY
{
    LIST_ENTRY PnpNotifyList;
    IO_NOTIFICATION_EVENT_CATEGORY EventCategory;
    PVOID Context;
    UNICODE_STRING Guid;
    PFILE_OBJECT FileObject;
    PDRIVER_NOTIFICATION_CALLBACK_ROUTINE PnpNotificationProc;
} PNP_NOTIFY_ENTRY, *PPNP_NOTIFY_ENTRY;

typedef struct _SETUP_NOTIFY_DATA
 {
    LIST_ENTRY ListEntry;
    IO_NOTIFICATION_EVENT_CATEGORY EventCategory;
    PDRIVER_NOTIFICATION_CALLBACK_ROUTINE Callback;
    PVOID Context;
    PDRIVER_OBJECT DriverObject;
    USHORT RefCount;
    BOOLEAN Unregistered;
    PFAST_MUTEX Lock;
} SETUP_NOTIFY_DATA, *PSETUP_NOTIFY_DATA;

/*
nt!IopInitializePlugPlayNotification:
8058a5b4 6a0d            push    0Dh
8058a5b6 b880d06780      mov     eax,offset nt!IopDeviceClassNotifyList (8067d080)  
8058a5bb 59              pop     ecx
8058a5bc 894004          mov     dword ptr [eax+4],eax
*/

0: kd> dd e1dd7698
e1dd7698  8067d080 8067d080 00000002 00000000
e1dd76a8  00000000 b2884fcc 00000000 81c26b10

  kd> dt _driver_object 81c26b10
nt!_DRIVER_OBJECT
   +0x000 Type             : 4
   +0x002 Size             : 168
   +0x004 DeviceObject     : 0x81b332d0 _DEVICE_OBJECT
   +0x008 Flags            : 0x10
   +0x00c DriverStart      : 0xf8ba4000 
   +0x010 DriverSize       : 0x1100
   +0x014 DriverSection    : 0x81f317c0 
   +0x018 DriverExtension  : 0x81c26bb8 _DRIVER_EXTENSION
   +0x01c DriverName       : _UNICODE_STRING "\Driver\swenum"
   +0x024 HardwareDatabase : 0x8067e260 _UNICODE_STRING "\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM"
   +0x028 FastIoDispatch   : (null) 
   +0x02c DriverInit       : 0xf8ba48dd     long  swenum!GsDriverEntry+0
   +0x030 DriverStartIo    : (null) 
   +0x034 DriverUnload     : 0xf8ba432a     void  swenum!DriverUnload+0
   +0x038 MajorFunction    : [28] 0xf8ba4768     long  swenum!DispatchCreate+0

NTSTATUS GetPlugPlayCallBack(ULONG KernelAddress)
{

  //未导出
  UCHAR* Base=KernelAddress;
  ULONG i=0;
  ULONG NotifyAddr;//回调函数地址
  PSETUP_NOTIFY_DATA pPnpNotifyPack;
  PLIST_ENTRY pListEntry;
  PLIST_ENTRY pListNext;
  PULONG Address;
  int count;
  Address=0;
  
  if(KernelAddress!=0)
  {
     for(i=0;i<0x20D000;i++)//内核大小硬编码了
     {
       
      if((*(UCHAR*)Base==0x6a)&&(*(UCHAR*)(Base+1)==0x0d)&&(*(UCHAR*)(Base+2)==0xb8)&&(*(UCHAR*)(Base+7)==0x59)&&(*(UCHAR*)(Base+8)==0x89))
      {
       DbgPrint("找到IopInitializePlugPlayNotification地址%x\n",Base);
       Address=*(ULONG*)(Base+3);
       break;
      }
      Base++;
     }
  }
  
  if(Address==0)
    {
     DbgPrint("获取PlugPlay回调数组失败\n");
       return STATUS_UNSUCCESSFUL;
    }
  DbgPrint("PlugPlay回调数组地址%x\n",(ULONG)Address);
  //13个元素
  for(count=0;count<NOTIFY_DEVICE_CLASS_HASH_BUCKETS*2;count+=2)
  {
    //DbgPrint("PlugPlay回调数组元素%x\n",Address[count]);
        {
      pListEntry=Address[count];
      pListNext=pListEntry;
      if(pListNext->Flink!=pListEntry)
      {
         DbgPrint("回调入口:%X  类型:PlugPlay  包地址:%X\n",*(ULONG*)((PULONG)pListNext+5),pListNext);
         PlugPlayNum++;
      }
      pListNext=pListNext->Flink;
      while(pListNext->Flink!=pListEntry)
      {
        if(pListNext<KernelAddress+0x20D000)
        {  
          pListNext=pListNext->Flink;

            DbgPrint("回调入口:%X  类型:PlugPlay  包地址:%X\n",*(ULONG*)((PULONG)pListNext+5),pListNext);
          pListNext=pListNext->Blink;
        }
        else
        {
          DbgPrint("回调入口:%X  类型:PlugPlay  包地址:%X\n",*(ULONG*)((PULONG)pListNext+5),pListNext);
        }
        PlugPlayNum++;
        pListNext=pListNext->Flink;
      }
    }
  }
   
}