!dh

The !dh extension displays the headers for the specified image.

#define IOCTL_EXAMPLE_SAMPLE_DIRECT_IN_IO  CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_IN_DIRECT, FILE_READ_DATA | FILE_WRITE_DATA)

METHOD_IN_DIRECT
METHOD_IOUT_DIRECT
METHOD_BUFFERED
METHOD_NEITHER : 3(11b), App 메모리 주소를 사용(?)

/* coded by Ray Linn */
        IOCTL_STORAGE_BASE = FileDevice.MASS_STORAGE,
        IOCTL_STORAGE_CHECK_VERIFY = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_CHECK_VERIFY2 = (IOCTL_STORAGE_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MEDIA_REMOVAL = (IOCTL_STORAGE_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_EJECT_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_LOAD_MEDIA2 = (IOCTL_STORAGE_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_RESERVE = (IOCTL_STORAGE_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
       IOCTL_STORAGE_RELEASE = (IOCTL_STORAGE_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_FIND_NEW_DEVICES = (IOCTL_STORAGE_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_MCN_CONTROL = (IOCTL_STORAGE_BASE << 16) | (0x0251 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES = (IOCTL_STORAGE_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_TYPES_EX = (IOCTL_STORAGE_BASE << 16) | (0x0301 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_MEDIA_SERIAL_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0304 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_GET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0305 << 2) | (Method.Buffered) | (0 << 14),
      
        IOCTL_STORAGE_SET_HOTPLUG_INFO = (IOCTL_STORAGE_BASE << 16) | (0x0306 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | (FileAccess.Read << 14),

        IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_BREAK_RESERVATION = (IOCTL_STORAGE_BASE << 16) | (0x0405 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_IN = (IOCTL_STORAGE_BASE << 16) | (0x0406 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_PERSISTENT_RESERVE_OUT = (IOCTL_STORAGE_BASE << 16) | (0x0407 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_GET_DEVICE_NUMBER = (IOCTL_STORAGE_BASE << 16) | (0x0420 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_PREDICT_FAILURE = (IOCTL_STORAGE_BASE << 16) | (0x0440 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_READ_CAPACITY = (IOCTL_STORAGE_BASE << 16) | (0x0450 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_QUERY_PROPERTY = (IOCTL_STORAGE_BASE << 16) | (0x0500 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES = (IOCTL_STORAGE_BASE << 16) | (0x0501 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        IOCTL_STORAGE_GET_BC_PROPERTIES = (IOCTL_STORAGE_BASE << 16) | (0x0600 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_STORAGE_ALLOCATE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0601 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_FREE_BC_STREAM = (IOCTL_STORAGE_BASE << 16) | (0x0602 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_STORAGE_CHECK_PRIORITY_HINT_SUPPORT = (IOCTL_STORAGE_BASE << 16) | (0x0620 << 2) | (Method.Buffered) | (0 << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_BUS = (IOCTL_STORAGE_BASE << 16) | (0x0400 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        OBSOLETE_IOCTL_STORAGE_RESET_DEVICE = (IOCTL_STORAGE_BASE << 16) | (0x0401 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_BASE = FileDevice.DISK,
        IOCTL_DISK_GET_DRIVE_GEOMETRY = (IOCTL_DISK_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_GET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_PARTITION_INFO = (IOCTL_DISK_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0003 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS = (IOCTL_DISK_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_REASSIGN_BLOCKS = (IOCTL_DISK_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_PERFORMANCE = (IOCTL_DISK_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_IS_WRITABLE = (IOCTL_DISK_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_LOGGING = (IOCTL_DISK_BASE << 16) | (0x000a << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_TRACKS_EX = (IOCTL_DISK_BASE << 16) | (0x000b << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_HISTOGRAM_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000c << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_DATA = (IOCTL_DISK_BASE << 16) | (0x000d << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_HISTOGRAM_RESET = (IOCTL_DISK_BASE << 16) | (0x000e << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_STRUCTURE = (IOCTL_DISK_BASE << 16) | (0x000f << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REQUEST_DATA = (IOCTL_DISK_BASE << 16) | (0x0010 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_PERFORMANCE_OFF = (IOCTL_DISK_BASE << 16) | (0x0018 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CONTROLLER_NUMBER = (IOCTL_DISK_BASE << 16) | (0x0011 << 2) | (Method.Buffered) | (0 << 14),
        SMART_GET_VERSION = (IOCTL_DISK_BASE << 16) | (0x0020 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        SMART_SEND_DRIVE_COMMAND = (IOCTL_DISK_BASE << 16) | (0x0021 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        SMART_RCV_DRIVE_DATA = (IOCTL_DISK_BASE << 16) | (0x0022 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0012 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_PARTITION_INFO_EX = (IOCTL_DISK_BASE << 16) | (0x0013 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0014 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_SET_DRIVE_LAYOUT_EX = (IOCTL_DISK_BASE << 16) | (0x0015 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_CREATE_DISK = (IOCTL_DISK_BASE << 16) | (0x0016 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_LENGTH_INFO = (IOCTL_DISK_BASE << 16) | (0x0017 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_DRIVE_GEOMETRY_EX = (IOCTL_DISK_BASE << 16) | (0x0028 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_REASSIGN_BLOCKS_EX = (IOCTL_DISK_BASE << 16) | (0x0029 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_DRIVE_SIZE = (IOCTL_DISK_BASE << 16) | (0x0032 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GROW_PARTITION = (IOCTL_DISK_BASE << 16) | (0x0034 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0035 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_SET_CACHE_INFORMATION = (IOCTL_DISK_BASE << 16) | (0x0036 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        OBSOLETE_DISK_GET_WRITE_CACHE_STATE = (IOCTL_DISK_BASE << 16) | (0x0037 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_DELETE_DRIVE_LAYOUT = (IOCTL_DISK_BASE << 16) | (0x0040 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_UPDATE_PROPERTIES = (IOCTL_DISK_BASE << 16) | (0x0050 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_FORMAT_DRIVE = (IOCTL_DISK_BASE << 16) | (0x00f3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_DISK_SENSE_DEVICE = (IOCTL_DISK_BASE << 16) | (0x00f8 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_DISK_CHECK_VERIFY = (IOCTL_DISK_BASE << 16) | (0x0200 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_MEDIA_REMOVAL = (IOCTL_DISK_BASE << 16) | (0x0201 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_EJECT_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0202 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_LOAD_MEDIA = (IOCTL_DISK_BASE << 16) | (0x0203 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RESERVE = (IOCTL_DISK_BASE << 16) | (0x0204 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_RELEASE = (IOCTL_DISK_BASE << 16) | (0x0205 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_FIND_NEW_DEVICES = (IOCTL_DISK_BASE << 16) | (0x0206 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_DISK_GET_MEDIA_TYPES = (IOCTL_DISK_BASE << 16) | (0x0300 << 2) | (Method.Buffered) | (0 << 14),

        IOCTL_DISK_RESET_SNAPSHOT_INFO = (IOCTL_DISK_BASE << 16) | (0x0084 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_BASE = FileDevice.CHANGER,
        IOCTL_CHANGER_GET_PARAMETERS = (IOCTL_CHANGER_BASE << 16) | (0x0000 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0001 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_GET_PRODUCT_DATA = (IOCTL_CHANGER_BASE << 16) | (0x0002 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_ACCESS = (IOCTL_CHANGER_BASE << 16) | (0x0004 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_GET_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0005 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_CHANGER_INITIALIZE_ELEMENT_STATUS = (IOCTL_CHANGER_BASE << 16) | (0x0006 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_SET_POSITION = (IOCTL_CHANGER_BASE << 16) | (0x0007 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_EXCHANGE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0008 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_MOVE_MEDIUM = (IOCTL_CHANGER_BASE << 16) | (0x0009 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_REINITIALIZE_TRANSPORT = (IOCTL_CHANGER_BASE << 16) | (0x000A << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        IOCTL_CHANGER_QUERY_VOLUME_TAGS = (IOCTL_CHANGER_BASE << 16) | (0x000B << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),

        IOCTL_SERIAL_LSRMST_INSERT = (FileDevice.SERIAL_PORT << 16) | (31 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_EXPOSE_HARDWARE = (FileDevice.SERENUM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_REMOVE_HARDWARE = (FileDevice.SERENUM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_PORT_DESC = (FileDevice.SERENUM << 16) | (130 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_SERENUM_GET_PORT_NAME = (FileDevice.SERENUM << 16) | (131 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_1 = (FileDevice.FILE_SYSTEM << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK_LEVEL_2 = (FileDevice.FILE_SYSTEM << 16) | (1 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_BATCH_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (2 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACKNOWLEDGE = (FileDevice.FILE_SYSTEM << 16) | (3 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPBATCH_ACK_CLOSE_PENDING = (FileDevice.FILE_SYSTEM << 16) | (4 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_OPLOCK_BREAK_NOTIFY = (FileDevice.FILE_SYSTEM << 16) | (5 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (6 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_UNLOCK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (7 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DISMOUNT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (8 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_MOUNTED = (FileDevice.FILE_SYSTEM << 16) | (10 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_PATHNAME_VALID = (FileDevice.FILE_SYSTEM << 16) | (11 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (14 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (15 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_COMPRESSION = (FileDevice.FILE_SYSTEM << 16) | (16 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_SET_BOOTLOADER_ACCESSED = (FileDevice.FILE_SYSTEM << 16) | (19 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_OPLOCK_BREAK_ACK_NO_2 = (FileDevice.FILE_SYSTEM << 16) | (20 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INVALIDATE_VOLUMES = (FileDevice.FILE_SYSTEM << 16) | (21 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FAT_BPB = (FileDevice.FILE_SYSTEM << 16) | (22 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_FILTER_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (23 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILESYSTEM_GET_STATISTICS = (FileDevice.FILE_SYSTEM << 16) | (24 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_VOLUME_DATA = (FileDevice.FILE_SYSTEM << 16) | (25 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_NTFS_FILE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (26 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_VOLUME_BITMAP = (FileDevice.FILE_SYSTEM << 16) | (27 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTERS = (FileDevice.FILE_SYSTEM << 16) | (28 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_MOVE_FILE = (FileDevice.FILE_SYSTEM << 16) | (29 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_VOLUME_DIRTY = (FileDevice.FILE_SYSTEM << 16) | (30 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ALLOW_EXTENDED_DASD_IO = (FileDevice.FILE_SYSTEM << 16) | (32 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_FIND_FILES_BY_SID = (FileDevice.FILE_SYSTEM << 16) | (35 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (38 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (39 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (40 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (41 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (42 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_REPARSE_POINT = (FileDevice.FILE_SYSTEM << 16) | (43 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_ENUM_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (44 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SECURITY_ID_CHECK = (FileDevice.FILE_SYSTEM << 16) | (45 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_READ_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (46 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SET_OBJECT_ID_EXTENDED = (FileDevice.FILE_SYSTEM << 16) | (47 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CREATE_OR_GET_OBJECT_ID = (FileDevice.FILE_SYSTEM << 16) | (48 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SPARSE = (FileDevice.FILE_SYSTEM << 16) | (49 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_ZERO_DATA = (FileDevice.FILE_SYSTEM << 16) | (50 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_ALLOCATED_RANGES = (FileDevice.FILE_SYSTEM << 16) | (51 << 2) | (Method.Neither) | (FileAccess.Read << 14),
        FSCTL_ENABLE_UPGRADE = (FileDevice.FILE_SYSTEM << 16) | (52 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (53 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_ENCRYPTION_FSCTL_IO = (FileDevice.FILE_SYSTEM << 16) | (54 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (55 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_RAW_ENCRYPTED = (FileDevice.FILE_SYSTEM << 16) | (56 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_CREATE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (57 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FILE_USN_DATA = (FileDevice.FILE_SYSTEM << 16) | (58 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_WRITE_USN_CLOSE_RECORD = (FileDevice.FILE_SYSTEM << 16) | (59 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_EXTEND_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (60 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (61 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DELETE_USN_JOURNAL = (FileDevice.FILE_SYSTEM << 16) | (62 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_HANDLE = (FileDevice.FILE_SYSTEM << 16) | (63 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_COPYFILE = (FileDevice.FILE_SYSTEM << 16) | (64 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SIS_LINK_FILES = (FileDevice.FILE_SYSTEM << 16) | (65 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        FSCTL_RECALL_FILE = (FileDevice.FILE_SYSTEM << 16) | (69 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_READ_FROM_PLEX = (FileDevice.FILE_SYSTEM << 16) | (71 << 2) | (Method.OutDirect) | (FileAccess.Read << 14),
        FSCTL_FILE_PREFETCH = (FileDevice.FILE_SYSTEM << 16) | (72 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MAKE_MEDIA_COMPATIBLE = (FileDevice.FILE_SYSTEM << 16) | (76 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_SET_DEFECT_MANAGEMENT = (FileDevice.FILE_SYSTEM << 16) | (77 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_QUERY_SPARING_INFO = (FileDevice.FILE_SYSTEM << 16) | (78 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_ON_DISK_VOLUME_INFO = (FileDevice.FILE_SYSTEM << 16) | (79 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_VOLUME_COMPRESSION_STATE = (FileDevice.FILE_SYSTEM << 16) | (80 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_MODIFY_RM = (FileDevice.FILE_SYSTEM << 16) | (81 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_QUERY_RM_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (82 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_ROLLFORWARD_REDO = (FileDevice.FILE_SYSTEM << 16) | (84 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_ROLLFORWARD_UNDO = (FileDevice.FILE_SYSTEM << 16) | (85 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_START_RM = (FileDevice.FILE_SYSTEM << 16) | (86 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_SHUTDOWN_RM = (FileDevice.FILE_SYSTEM << 16) | (87 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (88 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (89 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_SECONDARY_RM = (FileDevice.FILE_SYSTEM << 16) | (90 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_GET_METADATA_INFO = (FileDevice.FILE_SYSTEM << 16) | (91 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_GET_TRANSACTED_VERSION = (FileDevice.FILE_SYSTEM << 16) | (92 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_TXFS_SAVEPOINT_INFORMATION = (FileDevice.FILE_SYSTEM << 16) | (94 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_CREATE_MINIVERSION = (FileDevice.FILE_SYSTEM << 16) | (95 << 2) | (Method.Buffered) | (FileAccess.Write << 14),
        FSCTL_TXFS_TRANSACTION_ACTIVE = (FileDevice.FILE_SYSTEM << 16) | (99 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_SET_ZERO_ON_DEALLOCATION = (FileDevice.FILE_SYSTEM << 16) | (101 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (102 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (103 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_WAIT_FOR_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (104 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_INITIATE_REPAIR = (FileDevice.FILE_SYSTEM << 16) | (106 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSC_INTERNAL = (FileDevice.FILE_SYSTEM << 16) | (107 << 2) | (Method.Neither) | (0 << 14),
        FSCTL_SHRINK_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (108 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_SHORT_NAME_BEHAVIOR = (FileDevice.FILE_SYSTEM << 16) | (109 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_DFSR_SET_GHOST_HANDLE_STATE = (FileDevice.FILE_SYSTEM << 16) | (110 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES = (FileDevice.FILE_SYSTEM << 16) | (120 << 2) | (Method.Buffered) | (FileAccess.Read),
        FSCTL_TXFS_LIST_TRANSACTIONS = (FileDevice.FILE_SYSTEM << 16) | (121 << 2) | (Method.Buffered) | (FileAccess.Read << 14),
        FSCTL_QUERY_PAGEFILE_ENCRYPTION = (FileDevice.FILE_SYSTEM << 16) | (122 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_RESET_VOLUME_ALLOCATION_HINTS = (FileDevice.FILE_SYSTEM << 16) | (123 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_DEPENDENT_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (124 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SD_GLOBAL_CHANGE = (FileDevice.FILE_SYSTEM << 16) | (125 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_READ_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (126 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_LOOKUP_STREAM_FROM_CLUSTER = (FileDevice.FILE_SYSTEM << 16) | (127 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 = (FileDevice.FILE_SYSTEM << 16) | (128 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_FILE_TYPE_NOTIFICATION = (FileDevice.FILE_SYSTEM << 16) | (129 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_BOOT_AREA_INFO = (FileDevice.FILE_SYSTEM << 16) | (140 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_GET_RETRIEVAL_POINTER_BASE = (FileDevice.FILE_SYSTEM << 16) | (141 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_SET_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (142 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_PERSISTENT_VOLUME_STATE = (FileDevice.FILE_SYSTEM << 16) | (143 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_REQUEST_OPLOCK = (FileDevice.FILE_SYSTEM << 16) | (144 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_TUNNEL_REQUEST = (FileDevice.FILE_SYSTEM << 16) | (145 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_CSV_FILE = (FileDevice.FILE_SYSTEM << 16) | (146 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_QUERY_FILE_SYSTEM_RECOGNITION = (FileDevice.FILE_SYSTEM << 16) | (147 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAME = (FileDevice.FILE_SYSTEM << 16) | (148 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT = (FileDevice.FILE_SYSTEM << 16) | (149 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME = (FileDevice.FILE_SYSTEM << 16) | (150 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_IS_FILE_ON_CSV_VOLUME = (FileDevice.FILE_SYSTEM << 16) | (151 << 2) | (Method.Buffered) | (0 << 14),
        FSCTL_MARK_AS_SYSTEM_HIVE = FSCTL_SET_BOOTLOADER_ACCESSED,
        //IOCTL_AVIO_ALLOCATE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 1<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_FREE_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 2<<2)|( Method.Buffered)|( 0<<14),
        //IOCTL_AVIO_MODIFY_STREAM    =    (FILE_DEVICE_AVIO<<16)|( 3<<2)|( Method.Buffered)|( 0<<14),
        IOCTL_VOLUME_BASE = 0x00000056,
        IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS = (IOCTL_VOLUME_BASE << 16) | (0 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_ONLINE = (IOCTL_VOLUME_BASE << 16) | (2 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_OFFLINE = (IOCTL_VOLUME_BASE << 16) | (3 << 2) | (Method.Buffered) | ((FileAccess.Read | FileAccess.Write) << 14),
        IOCTL_VOLUME_IS_CLUSTERED = (IOCTL_VOLUME_BASE << 16) | (12 << 2) | (Method.Buffered) | (0 << 14),
        IOCTL_VOLUME_GET_GPT_ATTRIBUTES = (IOCTL_VOLUME_BASE << 16) | (14 << 2) | (Method.Buffered) | (0 << 14)

UserMode Hooking

일단 프로세스를 조작하는 API인
NTDLL.DLL의
NtOpenProcess, NtTerminateProcess, NtReadVirtualMemory,NtWriteVirtualMemory

KERNEL32.DLL의 DebugActiveProcess 등이 후킹되어야 한다

그리고 WINSTA.DLL의 WinStationTerminateProcess를 후킹하여 Terminal Service를 이용한
프로세스 종료를 차단합니다

Internal 함수 후킹

PspTerminateThreadByPointer:

프로세스 종료의 가장 근본적인 API로 쓰레드를 종료시키는 가장 저수준의 API입니다. 따라서 이 함수를 후킹해놓으면 프로세스를 함부로 종료할 수 없습니다. 이 API는 NtTerminateThread()에서 ObfDereferenceObject()전에 호출되므로 코드바이트로부터 이를 추적해나갈 수 있습니다.

KiAttachProcess:

KeAttachProcess/KeStackAttachProcess의 Internal 함수로 후킹할 수 있으면 해놓는게 좋습니다. KeAttachProcess()에서 호출하는데, 이것이 이미 후킹되어있었을 수도 있으므로, 파일로부터 구해와야 합니다. 이 방법은 제가 블로그에 쓴 적 있습니다.

참고: [Unexported Symbol] KiAttachProcess() 주소값 구하기

DKOM

적절한 DKOM은 강력한 무기가 될 수 있습니다. 아래와 같은 방법을 사용함으로써 프로세스를 효과적으로 보호할 수 있습니다.

1. DebugPort = NULL

디버거를 무력화하여 예외 처리를 프로세스에게 넘기는 방법으로, 디버거를 무력화시키는 방법중 하나입니다. 이 값이 NULL인지 아닌지 체크하는 방법도 비교적 괜찮은 방법이나, NT4/2000계열에서는 간혹 쓰레기값이 들어있는 경우가 있기 때문에 권장하지 않습니다.

EPROCESS에서의 DebugPort의 Offset 구하는 방법은 대략 아래와 같이 코딩할 수 있습니다.

VOID CalcHandleTableOffset(VOID)
{

PEPROCESS Proc = IoGetCurrentProcess();
HANDLE PID = PsGetCurrentProcessId();
PVOID GuessHandleTable = NULL;
int i = 0;
for(i = 0; i < PAGE_SIZE; i+=4)
{

GuessHandleTable = *(PVOID *)((PCHAR)Proc + i);
if(MmIsAddressValid(GuessHandleTable))
{

if(*(PHANDLE)((PCHAR)GuessHandleTable + 0x08) == PID)
{
         HANDLE_TABLE_OFFSET = i;
         return;
}

}

}

}

CalcHandleTableOffset();

DEBUG_PORT_OFFSET = HANDLE_TABLE_OFFSET - 8;

2. EPROCESS->ActiveProcessLinks Unlinking

프로세스를 숨겨서 보호합니다. 추가적으로 EPROCESS의 UniqueProcessId를 이상한 값으로 바꾸면 핸들을 얻는것을 어느정도 막을 수 있습니다. (물론 관련 ETHREAD 구조체에서 PID를 얻을수도 있기 때문에 이 방법이 꼭 좋은건 아닙니다.)

만약 프로세스 ID를 바꾸었다면 프로세스 종료 전에 복구하여야합니다.(그렇지 않으면 CID_HANDLE_DELETION 블루스크린을 맛보시게 될겁니다.)

그리고, 추가적으로 PspCidTable이라는 Unexported symbol에서 프로세스 Offset을 NULL로 만들어놓으면, 근본적으로 핸들을 얻을 수가 없을겁니다. PspCidTable은 PsLookupProcessByProcessId()에서 ExMapHandleToPointer(Ex)를 호출하기 전에 참조하는 심볼로, 바이트 코드를 트래버싱하거나, XP 이상에서는 KPCR->KdVersionBlock의 PspCidTable 필드를 참조해서 구할 수도 있습니다.

3. EPROCESS::HandleTable Unlinking

숨겨진 프로세스를 찾는 대표적인 방법으로는 크게 두가지가 있습니다. EPROCESS::HandleTable를 traverse 하거나 PspCidTable을 트레버싱하는 방법입니다. 물론, ETHREAD를 이용하거나 기타 여러가지 방법(brute-force 등등)을 이용하면 뚫리긴 합니다만, HandleTable을 끊음으로서 더욱 찾기 힘들게 할 수 있습니다.

위에서 언급한 ActiveProcessLinks와 핸들 테이블은 아래와 같은 LIST_ENTRY 구조입니다.

typedef struct _LIST_ENTRY {
    PLIST_ENTRY Flink;
    PLIST_ENTRY Blink;
} LIST_ENTRY, *PLIST_ENTRY;

드라이버를 효과적으로 숨기는 방법

1. PsLoadedModuleList unlinking

PsLoadedModuleList는 DRIVER_OBJECT 구조체의 DriverSection에 의해 Point됩니다. 그리고 아래와 같은 구조를 가지고 있습니다.(출처: rootkit.com 책)


typedef struct _MODULE_ENTRY
{

LIST_ENTRY ModuleListEntry;
DWORD Unknown1[4];
DWORD BaseAddress;
DWORD DriverStart;
DWORD Unknown2;
UNICODE_STRING Driver_Path;
UNICODE_STRING Driver_Name;

} MODULE_ENTRY, *PMODULE_ENTRY;

ModuleListEntry를 순회해서 BaseAddress가 DriverObject->DriverStart와 같은 엔트리를 찾아내서 ModuleListEntry를 끊어주면 숨겨줄 수 있을겁니다.

2. IoGetDeviceObjectPointer Hook

심볼릭 링크로부터 DEVICE_OBJECT를 얻는 대표적인 방법으로 이를 후킹하면 DEVICE_OBJECT를 얻는걸 막을 수 있고, 결과적으로 드라이버를 2차적인 루트킷 스캐너로부터 숨길 수 있게됩니다. DEVICE_OBJECT는 DRIVER_OBJECT를 포인트하기 때문에, 필수적으로 후킹해야합니다.

3. ZwOpenKey() Hook

드라이버 서비스 키를 traversing 하여 드라이버 정보를 얻는것을 차단할 수 있습니다.

4. IoCreateFile() Hook

드라이버 파일을 접근하지 못하게 함으로써 드라이버에 대한 접근을 차단합니다. ZwCreateFile()은 IoCreateFile을 직접 호출하므로, IoCreateFile()을 후킹하면 탐지되기가 더 어려우며, 그만큼 효과를 발휘하게 됩니다.