Win10 X64 HOOK KiUserExceptionDispatcher

Win10 X64 HOOK KiUserExceptionDispatcher

HOOK.ASM

extrn NewKiUserExceptionDispatcher : proc 
extrn OrgKiUserExceptionDispatcher : proc  
extrn OldKiUserExceptionDispatcher : proc 
.data
.code


;hook 
public MyKiUserExceptionDispatcher

MyKiUserExceptionDispatcher PROC  
    mov   rcx, rsp 
    add  rcx,4F0h
    mov   rdx,rsp  
    call  NewKiUserExceptionDispatcher ;先经过我们自己的异常处理

    ;mov rax,[OldKiUserExceptionDispatcher]  ;这样跳转回去会异常 原因未知
    ;jmp rax 

    ;
    mov   rax, [OrgKiUserExceptionDispatcher] ;直接用原函数+偏移 跳到RtlDispatchException 这样可以
    mov   rax,[rax]
    add   rax ,1ch
    jmp   rax; RtlDispatchException
    ret
MyKiUserExceptionDispatcher ENDP

END

HOOKFUC.H

#pragma once
#include <windows.h>

typedef VOID(WINAPI* PtrKiUserExceptionDispatcher)();
namespace HookEmu {
	//extern "C" C形式导出
	extern "C" PtrKiUserExceptionDispatcher OrgKiUserExceptionDispatcher;
	extern "C" PtrKiUserExceptionDispatcher OldKiUserExceptionDispatcher;
	extern HMODULE hNtDll ;
	
}
 

namespace HookFunction {
	 extern VOID HookKi();

}

namespace KiuserExc
{
	extern "C" void MyKiUserExceptionDispatcher();//汇编导出
	extern "C" void   NewKiUserExceptionDispatcher(PEXCEPTION_RECORD ExceptionRecord, PCONTEXT  Context);
}
namespace VEH_Tess
{
	extern LONG __stdcall VEHandler(
		EXCEPTION_POINTERS* ExceptionInfo
	);
	extern void InitVeh();
}


namespace HelpFuc {

	static VOID StackTrace64(PCONTEXT  Context);
}

HOOKFUC.CPP

#include "hookFun.h"
#include "MinHook.h"
#include <stdio.h>
namespace HookEmu {
	PtrKiUserExceptionDispatcher OrgKiUserExceptionDispatcher = 0;
	HMODULE hNtDll = NULL;
	PtrKiUserExceptionDispatcher OldKiUserExceptionDispatcher = nullptr;
}
namespace HookFunction {

	  VOID HookKi()
	{
		printf("ADDRESS：%llx", &KiuserExc::MyKiUserExceptionDispatcher);
		HookEmu::hNtDll = GetModuleHandleA("Ntdll.dll");
		HookEmu::OrgKiUserExceptionDispatcher = (PtrKiUserExceptionDispatcher)GetProcAddress(HookEmu::hNtDll, "KiUserExceptionDispatcher");


		if (MH_Initialize() == MH_OK)
		{
			if (MH_OK == MH_CreateHook(HookEmu::OrgKiUserExceptionDispatcher, (DWORD64*)&KiuserExc::MyKiUserExceptionDispatcher, reinterpret_cast<void**>(&HookEmu::OldKiUserExceptionDispatcher)))
			{
				if (MH_OK == MH_EnableHook(HookEmu::OrgKiUserExceptionDispatcher))
				{
					printf("钩子安装成功!\n");
				}
			}
		}
		return;
	}
}

namespace KiuserExc {

	void   NewKiUserExceptionDispatcher(PEXCEPTION_RECORD ExceptionRecord, PCONTEXT  Context)
	{
		printf(":HK\n");
		if (Context)
		{
			//HelpFuc::StackTrace64(Context);
			if (Context->ContextFlags & CONTEXT_DEBUG_REGISTERS)
			{
				printf(":HK\n");

				// Now each Thread handle should have its own CONTEXT.
				/*BeckupHardwareBP[CurrOffset].Dr0 = Context->Dr0;
				BeckupHardwareBP[CurrOffset].Dr1 = Context->Dr1;
				BeckupHardwareBP[CurrOffset].Dr2 = Context->Dr2;
				BeckupHardwareBP[CurrOffset].Dr3 = Context->Dr3;
				BeckupHardwareBP[CurrOffset].Dr6 = Context->Dr6;
				BeckupHardwareBP[CurrOffset].Dr7 = Context->Dr7;
	*/

				Context->Dr0 = 0;
				Context->Dr1 = 0;
				Context->Dr2 = 0;
				Context->Dr3 = 0;
				Context->Dr6 = 0;
				Context->Dr7 = 0;
				//Context->Rip += 1;
			}
		}
	}
}
namespace  VEH_Tess
{
	LONG __stdcall VEHandler(
		EXCEPTION_POINTERS* ExceptionInfo
	)
	{
		ExceptionInfo->ContextRecord->Rip += 1;
		printf("VEH 异常将被忽略 发生地址:%p RAX:0x%016I64x RCX:0x%016I64x RDX:0x%016I64x R8:0x%016I64x  R9:0x%016I64x\n", ExceptionInfo->ContextRecord->Rip, ExceptionInfo->ContextRecord->Rax, ExceptionInfo->ContextRecord->Rcx, ExceptionInfo->ContextRecord->Rdx, ExceptionInfo->ContextRecord->R8, ExceptionInfo->ContextRecord->R9);

		return EXCEPTION_CONTINUE_EXECUTION;//忽略异常=什么都没发生 try块当然也无法捕获到
	}


	void InitVeh()
	{
		AddVectoredExceptionHandler(1, VEHandler);//正常的监视全局异常
	}
}


namespace HelpFuc
{
	static VOID StackTrace64(PCONTEXT  Context)
	{

		KNONVOLATILE_CONTEXT_POINTERS NvContext;
		UNWIND_HISTORY_TABLE          UnwindHistoryTable;
		PRUNTIME_FUNCTION             RuntimeFunction;
		PVOID                         HandlerData;
		ULONG64                       EstablisherFrame;
		ULONG64                       ImageBase;

		RtlZeroMemory(
			&UnwindHistoryTable,
			sizeof(UNWIND_HISTORY_TABLE));

		RuntimeFunction = RtlLookupFunctionEntry(
			Context->Rip,
			&ImageBase,
			&UnwindHistoryTable
		);

		RtlZeroMemory(
			&NvContext,
			sizeof(KNONVOLATILE_CONTEXT_POINTERS));

		if (!RuntimeFunction)
		{
			printf("Rip:%llx\n", Context->Rip);
			Context->Rip = (ULONG64)(*(PULONG64)Context->Rsp);
			printf("new Rip:%llx\n", Context->Rip);
			Context->Rsp += 8;
			printf("RSP+=8\n");
		}
		else
		{
			RtlVirtualUnwind(
				UNW_FLAG_EHANDLER,
				ImageBase,
				Context->Rip,
				RuntimeFunction,
				Context,
				&HandlerData,
				&EstablisherFrame,
				&NvContext);
		}

		printf("ret Rip:%llx\n", Context->Rip);
		return;
	}
}

MAIN.CPP

#include <iostream>
#include "hookFun.h"
#include "MinHook.h"
 



void func(int cc) {

    __debugbreak();
	printf("func ok\n");
}

int main()
{ 
    VEH_Tess::InitVeh();
    HookFunction::HookKi();
    while(1){
        func(11);
        getchar();
    }
	printf("********************\n");
    getchar();

     
}