前言
看人家的工程中,都不是直接返回STATUS_ACCESS_DENIED.
在MyNtOpenProcess直接返回STATUS_ACCESS_DENIED并不会影响打开进程.
试验记录
#include <Ntddk.h>
#include <stdlib.h>
#include <stdio.h>
typedef char CHAR;
typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef unsigned int size_t;
typedef unsigned long DWORD;
#define MAXBYTE 0xff
#define MAKEDWORD(L, H) (((WORD)((DWORD_PTR)(L) & 0xffff)) | ((DWORD)((WORD)((DWORD_PTR)(H) & 0xffff))) << 16)
#pragma pack(push)
#pragma pack(1)
typedef struct _SYSTEM_SERVICE_TABLE {
PVOID ServiceTableBase;
PULONG ServiceCounterTableBase;
ULONG NumberOfService;
ULONG ParamTableBase;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;
typedef struct _SERVICE_DESCRIPTOR_TABLE {
SYSTEM_SERVICE_TABLE ntoskrnel;
SYSTEM_SERVICE_TABLE win32k;
SYSTEM_SERVICE_TABLE NotUsed1;
SYSTEM_SERVICE_TABLE NotUsed2;
} SYSTEM_DESCRIPTOR_TABLE, *PSYSTEM_DESCRIPTOR_TABLE;
#pragma pack(pop)
extern PSYSTEM_DESCRIPTOR_TABLE KeServiceDescriptorTable;
SYSTEM_SERVICE_TABLE* g_pSST = NULL;
DWORD g_dwSsdtFunIndexAddr_NtOpenProcess = 0;
DWORD g_dwPfnNtOpenProcessOrg = 0;
DWORD g_dwAddrJmp_MyNtOpenProcess = 0x805c22a0;
const DWORD g_dw_STATUS_ERR = STATUS_ACCESS_DENIED;
__declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId)
{
__asm {
_emit 0x68
_emit 0xc4
_emit 0x00
_emit 0x00
_emit 0x00
_emit 0x68
_emit 0xa8
_emit 0xaa
_emit 0x4d
_emit 0x80
pushf
pusha
}
KdPrint(("MyNtOpenProcess : don't allow open process ^_^\r\n"));
__asm {
popa
popf
pop eax
pop eax
mov eax, g_dw_STATUS_ERR
ret
}
}
void fnHook_SSDT()
{
DWORD dwAddr = 0;
do {
if (NULL == KeServiceDescriptorTable) {
break;
}
g_pSST = &KeServiceDescriptorTable->ntoskrnel;
if (NULL == g_pSST) {
break;
}
KdPrint(("g_pSST = %p\r\n", g_pSST));
if (NULL == g_pSST->ServiceTableBase) {
break;
}
KdPrint(("g_pSST->ServiceTableBase = %p\r\n", g_pSST->ServiceTableBase));
dwAddr = (DWORD)g_pSST->ServiceTableBase + 0x7a * sizeof(DWORD);
if (0 == dwAddr) {
break;
}
g_dwSsdtFunIndexAddr_NtOpenProcess = dwAddr;
KdPrint(("g_dwSsdtFunIndexAddr_NtOpenProcess = %p\r\n", g_dwSsdtFunIndexAddr_NtOpenProcess));
g_dwPfnNtOpenProcessOrg = *((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess));
KdPrint(("g_dwPfnNtOpenProcessOrg = %p\r\n", g_dwPfnNtOpenProcessOrg));
__asm {
cli
mov eax, cr0
and eax, not 10000h
mov cr0, eax
}
*((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess)) = (DWORD)MyNtOpenProcess;
__asm {
mov eax, cr0
or eax, 10000h
mov cr0, eax
sti
}
KdPrint(("Hook By MyNtOpenProcess = %p\r\n", MyNtOpenProcess));
} while (0);
}
void fnUnHook_SSDT()
{
__asm {
cli
mov eax, cr0
and eax, not 10000h
mov cr0, eax
}
*((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess)) = (DWORD)g_dwPfnNtOpenProcessOrg;
__asm {
mov eax, cr0
or eax, 10000h
mov cr0, eax
sti
}
KdPrint(("UnHook By g_dwPfnNtOpenProcessOrg = %p\r\n", g_dwPfnNtOpenProcessOrg));
}
VOID fnDrvUnLoad(__in struct _DRIVER_OBJECT* DriverObject)
{
KdPrint((">> fnDrvUnLoad"));
fnUnHook_SSDT();
}
NTSTATUS fnDrvDisPatch(__in struct _DEVICE_OBJECT* DeviceObject, __inout struct _IRP* Irp)
{
KdPrint((">> fnDrvDisPatch"));
return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(__in struct _DRIVER_OBJECT* DriverObject, __in PUNICODE_STRING RegistryPath)
{
KdPrint((">> DriverEntry"));
DriverObject->DriverUnload = fnDrvUnLoad;
DriverObject->MajorFunction[IRP_MJ_CREATE] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_CLOSE] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_READ] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_WRITE] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_QUERY_EA] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SET_EA] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_FLUSH_BUFFERS] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SET_VOLUME_INFORMATION] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_LOCK_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_CLEANUP] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_CREATE_MAILSLOT] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_QUERY_SECURITY] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SET_SECURITY] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_POWER] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CHANGE] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_QUERY_QUOTA] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_SET_QUOTA] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_PNP] = fnDrvDisPatch;
DriverObject->MajorFunction[IRP_MJ_MAXIMUM_FUNCTION] = fnDrvDisPatch;
fnHook_SSDT();
return STATUS_SUCCESS;
}