查找所有打开的句柄或对 USB 驱动器的引用

Question

我正在分析事后内核转储，并尝试识别可能引用 USB 存储驱动器或打开句柄的所有进程和筛选器驱动程序。我尝试检查所有打开的句柄，但即使将其限制为仅 File 对象，数据也不可管理。所以我浏览了 ！object \ 列表以找到我正在寻找的卷：

3: kd> !devobj fffffa8007169cd0
Device object (fffffa8007169cd0) is for:
 HarddiskVolume6 Drivervolmgr DriverObject fffffa8006af2060
Current Irp 00000000 RefCount 34 Type 00000007 Flags 00001050
Vpb fffffa8007168940 Dacl fffff9a10033a3c0 DevExt fffffa8007169e20 DevObjExt fffffa8007169f88 Dope fffffa80071688d0 DevNode fffffa800716b890 
3: kd> !vpb fffffa8007168940
Vpb at 0xfffffa8007168940
Flags: 0x1 mounted 
DeviceObject: 0xfffffa8008880030
RealDevice:   0xfffffa8007169cd0
RefCount: 34
Volume Label: 

是否有可能找到所有这 34 个参考文献是什么？是否有一种简单的方法可以从内存转储中识别使用任何给定卷的内容？

Answer 1

devobject 上的 devhandle 不会为您提供任何详细信息吗？

kd> .shell -ci "！object \Device" grep -i 硬盘

xxxxxxxxxx
     20  849a8e20 Device        HarddiskVolume8
xxxxxxxx

KD> ！devobj 849a8e20

Device object (849a8e20) is for:
 HarddiskVolume8 Drivervolmgr DriverObject 851708b0
Current Irp 00000000 RefCount 5 Type 00000007 Flags 00003050
Vpb 8594de78 Dacl b0c8b8a4 DevExt 849a8ed8 DevObjExt 849a8fc0 Dope 8493ee10 DevNode 86643708 
ExtensionFlags (0000000000)  
Characteristics (0x00000001)  FILE_REMOVABLE_MEDIA  <--------
AttachedDevice (Upper) 866f04c8 Driverfvevol
Device queue is not busy.

KD> ！devhandle 849a8e20

Checking handle table for process 0x84830ae8
Kernel handle table at 89601b80 with 636 entries in use
xxxxxxxxxxxxxxxxxxxxxxxx
PROCESS 86479210  SessionId: 1  Cid: 05e8    Peb: 7ffdf000  ParentCid: 05b0
    DirBase: 7e28f2c0  ObjectTable: 94dcc900  HandleCount: 923.
    Image: explorer.exe
121c: Object: 84a03550  GrantedAccess: 00100081 Entry: adac3438
Object: 84a03550  Type: (848adde8) File
    ObjectHeader: 84a03538 (new version)
        HandleCount: 1  PointerCount: 2
        Directory Object: 00000000  Name:  {HarddiskVolume8} <----
PROCESS 86479210  SessionId: 1  Cid: 05e8    Peb: 7ffdf000  ParentCid: 05b0
    DirBase: 7e28f2c0  ObjectTable: 94dcc900  HandleCount: 923.
    Image: explorer.exe
12ac: Object: 84a0a038  GrantedAccess: 00100081 Entry: adac3558
Object: 84a0a038  Type: (848adde8) File
    ObjectHeader: 84a0a020 (new version)
        HandleCount: 1  PointerCount: 2
        Directory Object: 00000000  Name:  {HarddiskVolume8} <-----