[Flopik]

Im used to check DriverObject to look at MajorFunction, but how to get those for system drivers that doesnt have a DriverObject, like hall.dll , tdi.sys, etc

[EP_X0FF]

What kind of MJ routines you want to get for a DLL? You don't see a difference between kmode driver and dll?

And for tdi.

Code: Select all

NTSTATUS TDIAPI GsDriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
     security_init_cookie();
     return STATUS_SUCCESS
}

[Flopik]

I mean more how to check them with Windbg : for scsiport.sys , I have some malware infection, since some ARK detect them

[rkhunter]

I think here need a separate approach for each driver.
In your case, you told about disk port-driver. It functions will be registered as MJ by mini-port.
Moreover, in systems like XP, port and miniport driver (hard disk case) is an alone driver.
For example, in my system, port-driver - storport.sys and miniport - LSI_SCSI.sys.

Code: Select all

0: kd> !object \device\harddisk0\dr0
Object: 83cbf1c0  Type: (82e02b90) Device
    ObjectHeader: 83cbf1a8 (new version)
    HandleCount: 0  PointerCount: 3
    Directory Object: 86d8b790  Name: DR0

0: kd> !devstack 83cbf1c0  
  !DevObj   !DrvObj            !DevExt   ObjectName
  83cc0020  \Driver\partmgr    83cc00d8  
> 83cbf1c0  \Driver\Disk       83cbf278  DR0
  83ae2c78  \Driver\LSI_SCSI   83ae2d30  00000059 -> mini-port
!DevNode 83ae2708 :
  DeviceInst is "SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S\4&3b5019be&0&000000"
  ServiceName is "disk"

0: kd> dt _device_object driverobject 83ae2c78  
nt!_DEVICE_OBJECT
   +0x008 DriverObject : 0x83ac2640 _DRIVER_OBJECT

0: kd> !drvobj 0x83ac2640  7
Driver object (83ac2640) is for:
 \Driver\LSI_SCSI
Driver Extension List: (id , addr)
(85da21fb 83ac3610)  
Device Object list:
83ae2c78  83beb920  

DriverEntry:   85d9603e	lsi_scsi!GsDriverEntry
DriverStartIo: 00000000	
DriverUnload:  85da169f	storport!RaDriverUnload
AddDevice:     85da132b	storport!RaDriverAddDevice

Dispatch routines:
[00] IRP_MJ_CREATE                      85dd1b1c	storport!RaDriverCreateIrp -> storport dispatch
[01] IRP_MJ_CREATE_NAMED_PIPE           816e9437	nt!IopInvalidDeviceRequest
[02] IRP_MJ_CLOSE                       85dd1bc1	storport!RaDriverCloseIrp -> storport dispatch
[03] IRP_MJ_READ                        816e9437	nt!IopInvalidDeviceRequest
[04] IRP_MJ_WRITE                       816e9437	nt!IopInvalidDeviceRequest
[05] IRP_MJ_QUERY_INFORMATION           816e9437	nt!IopInvalidDeviceRequest
[06] IRP_MJ_SET_INFORMATION             816e9437	nt!IopInvalidDeviceRequest
[07] IRP_MJ_QUERY_EA                    816e9437	nt!IopInvalidDeviceRequest
[08] IRP_MJ_SET_EA                      816e9437	nt!IopInvalidDeviceRequest
[09] IRP_MJ_FLUSH_BUFFERS               816e9437	nt!IopInvalidDeviceRequest
[0a] IRP_MJ_QUERY_VOLUME_INFORMATION    816e9437	nt!IopInvalidDeviceRequest
[0b] IRP_MJ_SET_VOLUME_INFORMATION      816e9437	nt!IopInvalidDeviceRequest
[0c] IRP_MJ_DIRECTORY_CONTROL           816e9437	nt!IopInvalidDeviceRequest
[0d] IRP_MJ_FILE_SYSTEM_CONTROL         816e9437	nt!IopInvalidDeviceRequest
[0e] IRP_MJ_DEVICE_CONTROL              85dd1c66	storport!RaDriverDeviceControlIrp
[0f] IRP_MJ_INTERNAL_DEVICE_CONTROL     85da14b1	storport!RaDriverScsiIrp
[10] IRP_MJ_SHUTDOWN                    816e9437	nt!IopInvalidDeviceRequest
[11] IRP_MJ_LOCK_CONTROL                816e9437	nt!IopInvalidDeviceRequest
[12] IRP_MJ_CLEANUP                     816e9437	nt!IopInvalidDeviceRequest
[13] IRP_MJ_CREATE_MAILSLOT             816e9437	nt!IopInvalidDeviceRequest
[14] IRP_MJ_QUERY_SECURITY              816e9437	nt!IopInvalidDeviceRequest
[15] IRP_MJ_SET_SECURITY                816e9437	nt!IopInvalidDeviceRequest
[16] IRP_MJ_POWER                       85da1556	storport!RaDriverPowerIrp
[17] IRP_MJ_SYSTEM_CONTROL              85dd1db8	storport!RaDriverSystemControlIrp
[18] IRP_MJ_DEVICE_CHANGE               816e9437	nt!IopInvalidDeviceRequest
[19] IRP_MJ_QUERY_QUOTA                 816e9437	nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA                   816e9437	nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP                         85dd1d0b	storport!RaDriverPnpIrp