@H_403_1@
在I/O管理最后阶段,就是加载系统所有动态连接库,比如加载NTDLL动态连接库,具体实现代码如下:@H_403_1@
#001 NTSTATUS@H_403_1@
#002 NTAPI@H_403_1@
#003 PsLocateSystemDll(VOID)@H_403_1@
#004 {@H_403_1@
#005 OBJECT_ATTRIBUTES ObjectAttributes;@H_403_1@
#006 IO_STATUS_BLOCK IoStatusBlock;@H_403_1@
#007 HANDLE FileHandle,SectionHandle;@H_403_1@
#008 NTSTATUS Status;@H_403_1@
#009 ULONG_PTR HardErrorParameters;@H_403_1@
#010 ULONG HardErrorResponse;@H_403_1@
#011 @H_403_1@
@H_403_1@
加载NTDLL动态连接库。@H_403_1@
#012 /* Locate and open NTDLL to determine ImageBase and LdrStartup */@H_403_1@
#013 InitializeObjectAttributes(&ObjectAttributes,@H_403_1@
#014 &PsNtDllPathName,@H_403_1@
#015 0,@H_403_1@
#016 NULL,@H_403_1@
#017 NULL);@H_403_1@
@H_403_1@
#018 Status = ZwOpenFile(&FileHandle,@H_403_1@
#019 FILE_READ_ACCESS,@H_403_1@
#020 &ObjectAttributes,@H_403_1@
#021 &IoStatusBlock,@H_403_1@
#022 FILE_SHARE_READ,@H_403_1@
#023 0);@H_403_1@
#024 if (!NT_SUCCESS(Status))@H_403_1@
#025 {@H_403_1@
#026 /* Failed,bugcheck */@H_403_1@
#027 KeBugCheckEx(PROCESS1_INITIALIZATION_Failed,Status,2,0);@H_403_1@
#028 }@H_403_1@
#029 @H_403_1@
@H_403_1@
#030 /* Check if the image is valid */@H_403_1@
#031 Status = MmCheckSystemImage(FileHandle,TRUE);@H_403_1@
#032 if (Status == STATUS_IMAGE_CHECKSUM_MISMATCH)@H_403_1@
#033 {@H_403_1@
#034 /* Raise a hard error */@H_403_1@
#035 HardErrorParameters = (ULONG_PTR)&PsNtDllPathName;@H_403_1@
#036 NtRaiseHardError(Status,@H_403_1@
#037 1,@H_403_1@
#038 1,@H_403_1@
#039 &HardErrorParameters,@H_403_1@
#040 OptionOk,@H_403_1@
#041 &HardErrorResponse);@H_403_1@
#042 return Status;@H_403_1@
#043 }@H_403_1@
#044 @H_403_1@
@H_403_1@
为NTDLL创建一段空间。@H_403_1@
#045 /* Create a section for NTDLL */@H_403_1@
#046 Status = ZwCreateSection(&SectionHandle,@H_403_1@
#047 SECTION_ALL_ACCESS,@H_403_1@
#048 NULL,@H_403_1@
#049 NULL,@H_403_1@
#050 PAGE_EXECUTE,@H_403_1@
#051 SEC_IMAGE,@H_403_1@
#052 FileHandle);@H_403_1@
#053 ZwClose(FileHandle);@H_403_1@
#054 if (!NT_SUCCESS(Status))@H_403_1@
#055 {@H_403_1@
#056 /* Failed,bugcheck */@H_403_1@
#057 KeBugCheckEx(PROCESS1_INITIALIZATION_Failed,3,0);@H_403_1@
#058 }@H_403_1@
#059 @H_403_1@
@H_403_1@
#060 /* Reference the Section */@H_403_1@
#061 Status = ObReferenceObjectByHandle(SectionHandle,@H_403_1@
#062 SECTION_ALL_ACCESS,@H_403_1@
#063 MmSectionObjectType,@H_403_1@
#064 KernelMode,@H_403_1@
#065 (PVOID*)&PspSystemDllSection,@H_403_1@
#066 NULL);@H_403_1@
#067 ZwClose(SectionHandle);@H_403_1@
#068 if (!NT_SUCCESS(Status))@H_403_1@
#069 {@H_403_1@
#070 /* Failed,bugcheck */@H_403_1@
#071 KeBugCheckEx(PROCESS1_INITIALIZATION_Failed,4,0);@H_403_1@
#072 }@H_403_1@
#073 @H_403_1@
@H_403_1@
调用函数PspMapSystemDll来映射这个DLL到内核里。@H_403_1@
#074 /* Map it */@H_403_1@
#075 Status = PspMapSystemDll(PsGetCurrentProcess(),&PspSystemDllBase,FALSE);@H_403_1@
#076 if (!NT_SUCCESS(Status))@H_403_1@
#077 {@H_403_1@
#078 /* Failed,bugcheck */@H_403_1@
#079 KeBugCheckEx(PROCESS1_INITIALIZATION_Failed,5,0);@H_403_1@
#080 }@H_403_1@
#081 @H_403_1@
#082 /* Return status */@H_403_1@
#083 return Status;@H_403_1@
#084}@H_403_1@