Method for positioning base address and size of ntoskrnl.exe in memory based on derived function

Abstract

The invention discloses a method for positioning the base address and the size of ntoskrnl.exe in a memory based on an export function, and belongs to the technical field of memory addressing. Comprising the following steps: S1, selecting a function A derived from ntoskrnl.exe, and determining the position of the function A in a memory; s2, querying all module information loaded into the memory, and determining the information size of all loaded modules; s3, applying for a memory space with the same size as the loaded module information obtained in the step S2, wherein the memory space is used for storing the information; s4, querying all module information loaded into the memory again, and storing a result into the memory space applied in the step S3; s5, a variable of a PRTLPROCESSMODULEINFORMATION type is used for traversing the ImageBase and the ImageSize of the module, and the variable of the PRTLPROCESSMODULEINFORMATION type is used for traversing the ImageBase and the ImageSize of the module; and S6, comparing the sum of the ImageBase and the ImageSize of each module by using the address of the function A obtained in the step S1. According to the method, the function is derived from the ntoskrnl.exe, and the address of the function is used for comparing the information of each module, so that the ntoskrnl.exe module is found, and the absolute accuracy is achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of memory addressing, and in particular to a method for locating a base address and a size of ntoskrnl.exe in a memory based on a derived function. Background Art

[0002] In the process of developing anti-virus or advanced threat detection software, due to concerns that the functions provided by the various operating systems that need to be used may be tampered with by viruses, the advanced threat detection software needs to find the ntoskrnl.exe (which can be understood as the Windows kernel, which exports many functions for developers to use directly) module that has been loaded into the Windows system memory before working; the module's loading address and size information is used to obtain the module's location in the folder, and then reload it into the memory, so that the functions that have not been contaminated or tampered with can be used for virus detection and killing operations. At this time, a fast and stable method is needed to find the ntoskrnl.exe module among the many modules that have been loaded in the memory.

[0003] At present, the public technical solution is to write a Windows driver and use the driver's own _LDR_DATA_TABLE_ENTRY structure to traverse the modules that have been loaded into the memory (including ntoskrnl.exe). Most of the time, the ntoskrnl.exe module is ranked third, that is, the third module is ntoskrnl.exe. However, this method is unstable and may make mistakes; thus, it is impossible to correctly obtain the information of the ntoskrnl.exe module. Summary of the invention

[0004] The purpose of the present invention is to solve the instability problem in the prior art when locating the ntoskrnl.exe module address, and propose a method for locating the base address and size of ntoskrnl.exe in the memory based on the export function.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions: A method for locating the base address and size of ntoskrnl.exe in memory based on an export function comprises the following steps: S1. Select a function A exported from ntoskrnl.exe and determine its location in memory. S2. Query all module information loaded into the memory and determine the information size of all loaded modules; S3, applying for a memory space of the same size as the loaded module information obtained in step S2, for storing the information; S4, query all module information loaded into the memory again, and store the result in the memory space applied for in step S3; S5. Use variables of type PRTL_PROCESS_MODULE_INFORMATION to traverse the module's ImageBase and ImageSize; S6, using the address of function A obtained in step S1, to compare the sum of ImageBase+ImageSize of each module; S7. If the address of function A is greater than or equal to the ImageBase of a module and less than the ImageBase+ImageSize of the module, then it can be determined that the address of function A is in the memory range occupied by the module, and the module must be ntoskrnl.exe.

[0006] In some embodiments, the function A is the NtOpenFile function.

[0007] In some embodiments, in step S1, the MmGetSystemRoutineAddress function is used to determine the location of function A in memory.

[0008] In some embodiments, in step S2, the ZwQuerySystemInformation function is used for the first time to query information of all modules loaded into the memory.

[0009] In some embodiments, in step S3, the ExAllocatePoolWithTag function is used to apply for a memory space of the same size as the size of the loaded module information obtained in step S2.

[0010] In some embodiments, in step S4, the ZwQuerySystemInformation function is used again to query information of all modules loaded into the memory.

[0011] Compared with the prior art, the present invention provides a method for locating the base address and size of ntoskrnl.exe in memory based on an export function, which has the following beneficial effects.

[0012] 1. The present invention uses a function derived from ntoskrnl.exe to compare the information of each module with its address, thereby finding the ntoskrnl.exe module with absolute accuracy.

[0013] 2. The present invention calls the ZwQuerySystemInformation function twice; the first call is to accurately know how much information of all loaded modules is large, so as to determine how much memory space needs to be applied for storing the result returned by the second call to the ZwQuerySystemInformation function.

[0014] 3. In the present invention, since the selected function is exported by the ntoskrnl.exe module, the address of the function in the memory must be in the memory interval occupied by the ntoskrnl.exe module; therefore, as long as the address of the function in the memory is greater than or equal to the ImageBase of a certain module and less than the ImageBase+ImageSize of the module, then the module must be ntoskrnl.exe, and no error will occur.

[0015] Other advantages, objectives and features of the present invention will be described in part in the following description; and in part, will be apparent to those skilled in the art based on an examination of the following; or, may be taught from the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Flowchart of the invention. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present invention are described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0018] Reference Figure 1 , a method for locating the base address and size of ntoskrnl.exe in memory based on an export function, comprising the following steps: S1. Select a function A exported from ntoskrnl.exe and determine its location in memory. S2. Query all module information loaded into the memory and determine the information size of all loaded modules; S3, applying for a memory space of the same size as the loaded module information obtained in step S2, for storing the information; S4, query all module information loaded into the memory again, and store the result in the memory space applied for in step S3; S5. Use variables of the PRTL_PROCESS_MODULE_INFORMATION type to traverse the module's ImageBase (module base address, i.e. the first address loaded into memory) and ImageSize (module size); S6, using the address of function A obtained in step S1, to compare the sum of ImageBase+ImageSize of each module; It is understandable that the base address of the module in memory + the size of the module can be used to determine the memory interval occupied by the module in memory; if the module has an exported function, the address of the exported function must be in this memory interval; S7. If the address of function A is greater than or equal to the ImageBase of a module and less than the ImageBase+ImageSize of the module, then it can be determined that the address of function A is in the memory interval occupied by the module, and the module must be ntoskrnl.exe; That is, the ntoskrnl.exe module in memory was found.

[0019] in: Preferably, the function A adopts the NtOpenFile function.

[0020] It is understandable that any function exported from ntoskrnl.exe can be selected.

[0021] In step S1: Use the MmGetSystemRoutineAddress function to determine the location of function A in memory; That is, select a function NtOpenFile exported from ntoskrnl.exe; and use the MmGetSystemRoutineAddress function to determine the location of the NtOpenFile function in memory.

[0022] In step S2: The first use of the ZwQuerySystemInformation function queries all module information loaded into memory and determines the size of the information of all loaded modules.

[0023] In step S3: Use the ExAllocatePoolWithTag function to apply for a memory space of the same size as the loaded module information obtained in step S2 for storing information.

[0024] In step S4: Use the ZwQuerySystemInformation function again to query the information of all modules loaded into the memory, and store the results in the memory space applied for in step S3.

[0025] In the present invention, a function derived from ntoskrnl.exe is used to compare the information of each module with its address, so as to find the ntoskrnl.exe module with absolute accuracy.

[0026] In the present invention, the ZwQuerySystemInformation function needs to be called twice; the first call is to accurately know how much information of all loaded modules is large, so as to determine how much memory space needs to be applied for storing the result returned by the second call to the ZwQuerySystemInformation function.

[0027] In the present invention, since the selected function A (NtOpenFile function) is exported by the ntoskrnl.exe module, the address of the NtOpenFile function in the memory must be in the memory interval occupied by the ntoskrnl.exe module; therefore, as long as the address of the NtOpenFile function in the memory is greater than or equal to the ImageBase of a certain module and less than the ImageBase+ImageSize of the module, then the module must be ntoskrnl.exe, and no error will occur.

[0028] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0029] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0030] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for locating the base address and size of ntoskrnl.exe in memory based on an export function, characterized in that: The following steps are involved: S1. Select a function A exported from ntoskrnl.exe and determine its location in memory. S2. Query all module information loaded into the memory and determine the information size of all loaded modules; S3, applying for a memory space of the same size as the size of the loaded module information obtained in step S2, for storing the information; S4, query all module information loaded into the memory again, and store the result in the memory space applied for in step S3; S5. Use variables of type PRTL_PROCESS_MODULE_INFORMATION to traverse the module's ImageBase and ImageSize; S6, using the address of function A obtained in step S1, to compare the sum of ImageBase+ImageSize of each module; S7. If the address of function A is greater than or equal to the ImageBase of a module and less than the ImageBase+ImageSize of the module, then it can be determined that the address of function A is in the memory range occupied by the module, and the module must be ntoskrnl.exe.

2. The method for locating the base address and size of ntoskrnl.exe in memory based on the export function according to claim 1 is characterized in that: The function A is the NtOpenFile function.

3. The method for locating the base address and size of ntoskrnl.exe in memory based on the export function according to claim 1, characterized in that: In step S1, the MmGetSystemRoutineAddress function is used to determine the location of function A in memory.

4. The method for locating the base address and size of ntoskrnl.exe in memory based on the export function according to claim 1, characterized in that: In step S2, the ZwQuerySystemInformation function is used for the first time to query the information of all modules loaded into the memory.

5. The method for locating the base address and size of ntoskrnl.exe in memory based on the export function according to claim 1, characterized in that: In step S3, the ExAllocatePoolWithTag function is used to apply for a memory space of the same size as the size of the loaded module information obtained in step S2.

6. The method for locating the base address and size of ntoskrnl.exe in memory based on the export function according to claim 1, characterized in that: In step S4, the ZwQuerySystemInformation function is used again to query the information of all modules loaded into the memory.

Images