CODEWITHSUNDEEP
cwindows-xpdriverdevice
Inderpaul Singh
Inderpaul Singh

Reputation: 19

Need a kernel mode API that will find the base address of user mode Win32 Dll

I am new to device driver programming. I've followed the available tutorials on the web which has provided helpful information to get started. However now I have embarked on a new project where the exclusive goal is to search for functions which have been hooked by malware or keyloggers. So I think I have sorted out what I need to accomplish this though I still need to be able to locate the load address of the system dll's (i.e. kernel32.dll, user32.dll and the like) that are already loaded in memory. I need the load address so that I can parse their PE to get to the export and import sections. Furthermore adding the load address to the file size will give me a address range to cross reference the addresses of the export functions no ? Cross referencing the the IMPORT address will be a little more involved but it can be done according to my estimates. I thought that building a kernel mode driver would be the right way to go since accessing memory outside the kernel driver's address range would not be an issue for the driver as opposed to a user mode app. How else will I be able to access the addresses located in the EAT and IAT of the target dll ? I know there exist a user mode API that can provide the load address mainly being GetModuleHandle but I would like to find the equivalent in kernel mode. I could write a user mode application that could relay this information to the driver but prefer that this all be done in kernel mode if possible. Any suggestions or comments would be most welcome.

Thanks in advance

Victor

p.s This post has been edited for more clarity. Hopefully it will make it more clear as what I am trying to accomplish.

Upvotes: 0

Views: 2615

Answers (3)

Inderpaul Singh
Inderpaul Singh

Reputation: 19

Just wanted to thank everyone for their contribution. I did manage to some further research and discovered that there is a kernel mode API called PsLoadImageNotifyCallback that is able to find the base addresss of any process.

Upvotes: 1

user541686
user541686

Reputation: 210445

Take a look at LdrGetProcedureAddress and the rest of the gang.

Edit:

MmGetSystemRoutineAddress might also be helpful.

Upvotes: 1

Ana Betts
Ana Betts

Reputation: 74654

This is probably not a very good idea to do in kernel mode. When are you going to actually do this and guarantee the process is in a state where you could walk the IAT?

What if the process is in the middle of loading a DLL? If you're executing in-thread (i.e. from a syscall or device IOCTL), what if other threads are executing too? Doing this when you're not the OS is a very difficult proposition to correctly do, and it's very easy to destabilize your customers' machines (hell, it's reasonably hard to do even if you are the OS)

Upvotes: 3

Related Questions