ring0-Traversal IAT (special case Ntos)

http://blog.csdn.net/hgy413/article/details/7786530

The IAT of the original ntos can only be obtained through Image_directory_entry_iat (12), because the init mode is loaded after the ntos is loaded, so image_directory_entry_import corresponding area is released!
Hang on, Dad.
Can be used WinDbg very intuitive to see:
X86:x64: The other IAT traversal codes are as follows: [CPP]View Plaincopy

2. NTSTATUS enumiattable (ulong_ptr pbase)
4. {
6. Pimage_dos_header PDos = (pimage_dos_header) pbase;
8. Pimage_nt_headers pNt = NULL;
10. Pimage_import_descriptor pimport = NULL;
12. Pimage_thunk_data pthunk = NULL;
16. if (NULL = = PDos
18. || Image_dos_signature! = pdos->e_magic)
20. {
22. return Status_invalid_image_format;
24. }
28. PNt = (pimage_nt_headers) ((Puchar) pbase+pdos->e_lfanew);
30. if (image_nt_signature! = pnt->signature)
32. {
34. return Status_invalid_image_format;
36. }
40. Pimport = (pimage_import_descriptor) ((Puchar) pbase+pnt->optionalheader.datadirectory[image_directory_ Entry_import].  virtualaddress);
44. //Enumerate print
46. While (NULL!=pimport
48. && Mmisaddressvalid (Pimport)
50. &&pimport->name! = 0)
52. {
54. Pthunk = (Pimage_thunk_data) ((Puchar) pbase+pimport->firstthunk);
56. While (NULL! = Pthunk
58. && Mmisaddressvalid (Pthunk)
60. && pthunk->u1. Function! = 0)
62. {
64. Kdprint ("[Enumiattable]-import module:%s-function:%p\r\n", (Puchar) Pbase+pimport->name, PTHUNK->U1 .  Function));
66. pthunk++;
68. }
72. pimport++;
74. }
78. return status_success;
80. }

ring0-Traversal IAT (special case Ntos)