分享Win10 1903过TP的双机调试问题
差不多我用到的大部分代码都是从上面cv（Ctrl+c---->Ctrl+v）下来的
1、首先解决Thecontextispartiallyvalid.Onlyx86user-modecontextisavailable.
具体方式是hookKdpTrap
2、防止安全组件加载失败
SharedUserData->KdDebuggerEnabled=FALSE; //防止安全组件加载失败，SharedUserData这个是一个导出的全局变量直接写就行
3、XP会清零KdDebuggerEnabled
这里本来是打算做一个定时器，但是还是会导致TesNginx.Sycccccccccccccc出现蓝屏，所以只有手动的去修改
4、断链隐藏kdcom，防止kdcom内存被清空导致和windbg通讯不了
5、XP会检测KdEnteredDebugger，如果是1就直接蓝屏
处理方式是让他去找其他位置(PUCHAR)KdEnteredDebugger+0x30; //据暗中观察，+0x30的位置恒为0
做完这些之后基本上就能够下断点了，但是其实还是有问题（由于hook了系统函数有一定的几率会触发109错误->PathGuard，一开始我也分不清楚，后来慢慢的也了解了）
之后放上一张过了图片
最后把代码也带上吧，.asm文件很简单简单的inlinhook就行了
#include#include externvoiddebg(); //关闭写保护 KIRQLWPOFFx64(){ KIRQLirql=KeRaiseIrqlToDpcLevel(); UINT64cr0=__readcr0(); cr0&=0xfffffffffffeffff; __writecr0(cr0); _disable(); returnirql; } //开启写保护 voidWPONx64(KIRQLirql){ UINT64cr0=__readcr0(); cr0|=0x10000; _enable(); __writecr0(cr0); KeLowerIrql(irql); } //这里尝试过tp的双机调试，环境为win101903 //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //1、首先解决Thecontextispartiallyvalid.Onlyx86user-modecontextisavailable. /* nt!KdpTrap: fffff807`64bfffc848895c2408movqwordptr[rsp+8],rbx fffff807`64bfffcd4889542410movqwordptr[rsp+10h],rdx fffff807`64bfffd257pushrdi fffff807`64bfffd34883ec40subrsp,40h fffff807`64bfffd733d2xoredx,edx */ ULONG64orgkdt=0xfffff80166201fc8; //ULONG64orgkdt=0xfffff80764bfffc8;//直接写硬编码,这里需要进行修改<------------------------------------------------------------------------------------------------------------------------------------------------------- NTKERNELAPIUCHAR*PsGetProcessImageFileName(__inPEPROCESSProcess); externNTSTATUShdbktrap(INPKTRAP_FRAMETrapFrame,INPKEXCEPTION_FRAMEExceptionFrame,INPEXCEPTION_RECORDExceptionRecord,INPCONTEXTContextRecord,INKPROCESSOR_MODEPreviousMode,INBOOLEANSecondChanceException); //这里做一个跳转 VOIDModifyKdpTrap(PVOIDmyaddress,PVOIDtargetaddress){ KIRQLirql; ULONGLONGmyfun; UCHARjmp_code[]="\x48\xB8\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00\xFF\xE0\x00\x00";//movraxxxx,jmprax myfun=(ULONGLONG)myaddress;//替换成自己的函数地址 RtlCopyMemory(jmp_code+2,&myfun,8); //debg(); irql=WPOFFx64(); RtlCopyMemory(targetaddress,jmp_code,12); WPONx64(irql); } //这里完成hook NTSTATUSHookKdpTrap( INPKTRAP_FRAMETrapFrame, INPKEXCEPTION_FRAMEExceptionFrame, INPEXCEPTION_RECORDExceptionRecord, INPCONTEXTContextRecord, INKPROCESSOR_MODEPreviousMode, INBOOLEANSecondChanceException){ PEPROCESShp=PsGetCurrentProcess(); if(!_stricmp((char*)PsGetProcessImageFileName(hp),"TASLogin.exe")){ returnSTATUS_SUCCESS; } returnhdbktrap(TrapFrame,ExceptionFrame,ExceptionRecord,ContextRecord,PreviousMode,SecondChanceException); } //这里做一个还原 voidUnHookKdpTrap(){ KIRQLirql; UCHARorignal_code[]="\x48\x89\x5c\x24\x08\x48\x89\x54\x24\x10\x57\x48\x83\xec\x40";//movraxxxx,jmprax irql=WPOFFx64(); RtlCopyMemory(orgkdt,orignal_code,15); WPONx64(irql); } //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //2、防止安全组件加载失败 VOIDDisableKdDebuggerEnabled(){ SharedUserData->KdDebuggerEnabled=FALSE;//防止安全组件加载失败 } //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //3、TP会清零KdDebuggerEnabled,这里做一个每隔一秒的定时器 //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //4、断链隐藏kdcom，防止kdcom内存被清空导致和windbg通讯不了 /* 0:kd>dt_eprocess nt!_EPROCESS +0x000Pcb:_KPROCESS +0x2e0ProcessLock:_EX_PUSH_LOCK +0x2e8UniqueProcessId:Ptr64Void +0x2f0ActiveProcessLinks:_LIST_ENTRY */ PDRIVER_OBJECTpDriverObject=NULL; typedefstruct_KLDR_DATA_TABLE_ENTRY{ LIST_ENTRYInLoadOrderLinks; PVOIDExceptionTable; ULONGExceptionTableSize; PVOIDGpValue; ULONGUnKnow; PVOIDDllBase; PVOIDEntryPoint; ULONGSizeOfImage; UNICODE_STRINGFullDllName; UNICODE_STRINGBaseDllName; ULONGFlags; USHORTLoadCount; USHORT__Unused5; PVOIDSectionPointer; ULONGCheckSum; PVOIDLoadedImports; PVOIDPatchInformation; }KLDR_DATA_TABLE_ENTRY,*PKLDR_DATA_TABLE_ENTRY; VOIDHideDriver(){ PKLDR_DATA_TABLE_ENTRYentry=(PKLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection; PKLDR_DATA_TABLE_ENTRYfirstentry; UNICODE_STRINGuniDriverName; firstentry=entry; //初始化要隐藏驱动的驱动名 RtlInitUnicodeString(&uniDriverName,L"kdcom.dll"); while((PKLDR_DATA_TABLE_ENTRY)entry->InLoadOrderLinks.Flink!=firstentry){ if(entry->FullDllName.Buffer!=0){ if(RtlCompareUnicodeString(&uniDriverName,&(entry->BaseDllName),FALSE)==0){ //DbgPrint("隐藏驱动%ws成功!\n",entry->BaseDllName.Buffer); //修改Flink和Blink指针,以跳过我们要隐藏的驱动 *((ULONG*)entry->InLoadOrderLinks.Blink)=(ULONG)entry->InLoadOrderLinks.Flink; entry->InLoadOrderLinks.Flink->Blink=entry->InLoadOrderLinks.Blink; /* 使被隐藏驱动LIST_ENTRY结构体的Flink,Blink域指向自己 因为此节点本来在链表中,那么它邻接的节点驱动被卸载时, 系统会把此节点的Flink,Blink域指向它相邻节点的下一个节点. 但是,它此时已经脱离链表了,如果现在它原本相邻的节点驱动被 卸载了,那么此节点的Flink,Blink域将有可能指向无用的地址,而 造成随机性的BSoD. */ entry->InLoadOrderLinks.Flink=(LIST_ENTRY*)&(entry->InLoadOrderLinks.Flink); entry->InLoadOrderLinks.Blink=(LIST_ENTRY*)&(entry->InLoadOrderLinks.Flink); break; } } //链表往前走 entry=(PKLDR_DATA_TABLE_ENTRY)entry->InLoadOrderLinks.Flink; } } //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //---------------------------------------------------------------------------------------------------------------------------------------------------------------- //5、处理TP蓝屏 /* fffff807`642d221048895c2420movqwordptr[rsp+20h],rbx fffff807`642d22154488442418movbyteptr[rsp+18h],r8b fffff807`642d221a56pushrsi fffff807`642d221b57pushrdi fffff807`642d221c4154pushr12 fffff807`642d221e4155pushr13 fffff807`642d22204157pushr15 fffff807`642d22224883ec20subrsp,20h */ #defineKdEnteredDebugger0xfffff80165d061e0 //#defineKdEnteredDebugger0xfffff80764704100//直接写硬编码,这里需要进行修改<----------------------------------------------------------------------------------------------------------------------------------------------- externPMDLhookIoAllocateMdl(__drv_aliasesMemPVOIDVirtualAddress,ULONGLength,BOOLEANSecondaryBuffer,BOOLEANChargeQuota,PIRPIrp); ULONG64IoAllocateM=0; //这里做一个跳转 VOIDModifyIoAllocateMdl(PVOIDmyaddress,PVOIDtargetaddress){ KIRQLirql; ULONGLONGmyfun; UCHARjmp_code[]="\x48\xB8\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00\xFF\xE0\x00\x00";//movraxxxx,jmprax myfun=(ULONGLONG)myaddress;//替换成自己的函数地址 RtlCopyMemory(jmp_code+2,&myfun,8); //debg(); irql=WPOFFx64(); RtlCopyMemory(targetaddress,jmp_code,12); WPONx64(irql); } PMDLnewIoAllocateMdl(__drv_aliasesMemPVOIDVirtualAddress,ULONGLength,BOOLEANSecondaryBuffer,BOOLEANChargeQuota,PIRPIrp){ //debg(); if(VirtualAddress==KdEnteredDebugger){ //DbgPrint("[KdEnteredDebugger]address:%p\n",KdEnteredDebugger); VirtualAddress=(PUCHAR)KdEnteredDebugger+0x30;//据暗中观察，+0x30的位置恒为0 } returnhookIoAllocateMdl(VirtualAddress,Length,SecondaryBuffer,ChargeQuota,Irp); } //这里做一个还原 voidUnHookIoAllocateMdl(){ KIRQLirql; UCHARorignal_code[]="\x48\x89\x5c\x24\x20\x44\x88\x44\x24\x18\x56\x57\x41\x54\x41\x55"; irql=WPOFFx64(); RtlCopyMemory(IoAllocateMdl,orignal_code,15); WPONx64(irql); } //---------------------------------------------------------------------------------------------------------------------------------------------------------------- VOIDDriverUnload(PDRIVER_OBJECTDriverObject){ //还原之前的KdpTraphook UnHookKdpTrap(); //还原之前的IoAllocateMdl UnHookIoAllocateMdl(); //取消定时器 DbgPrint("SeeYou!\n"); } NTSTATUSDriverEntry(PDRIVER_OBJECTDriverObject,PUNICODE_STRINGRegPath){ pDriverObject=DriverObject; DriverObject->DriverUnload=DriverUnload; //这里把这个函数进行了hook ModifyKdpTrap(HookKdpTrap,orgkdt); //防止安全组件加载失败 DisableKdDebuggerEnabled(); //摘掉kdcom的eprocess HideDriver(); //干掉TP蓝屏 IoAllocateM=(ULONG64)IoAllocateMdl;//得到函数的地址 ModifyIoAllocateMdl(newIoAllocateMdl,IoAllocateMdl); //设置定时器 returnSTATUS_SUCCESS; }
总结
以上所述是小编给大家分享的Win101903过TP的双机调试问题，希望对大家有所帮助，如果大家有任何疑问请给我留言，小编会及时回复大家的。在此也非常感谢大家对毛票票网站的支持！
如果你觉得本文对你有帮助，欢迎转载，烦请注明出处，谢谢！
声明：本文内容来源于网络，版权归原作者所有，内容由互联网用户自发贡献自行上传，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任。如果您发现有涉嫌版权的内容，欢迎发送邮件至：czq8825#qq.com（发邮件时，请将#更换为@）进行举报，并提供相关证据，一经查实，本站将立刻删除涉嫌侵权内容。