SSDTHOOK 12123321

最新推荐文章于 2023-06-22 21:49:59 发布

ADADQDQQ

最新推荐文章于 2023-06-22 21:49:59 发布

阅读量274

点赞数

分类专栏：系统调用

本文链接：https://blog.csdn.net/ADADQDQQ/article/details/119006468

版权

Windows内核系统调用钩子技术 ZwOpenProcess 驱动开发

关键词由CSDN通过智能技术生成

系统调用专栏收录该内容

6 篇文章 1 订阅

订阅专栏

#include <ntddk.h>

typedef struct _KSERVICE_TABLE_DESCRIPTOR {
	PULONG_PTR Base;
	PULONG Count;
	ULONG Limit;
	PUCHAR Number;
} KSERVICE_TABLE_DESCRIPTOR, * PKSERVICE_TABLE_DESCRIPTOR;

extern PKSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable;

//输入函数名自动获取服务号
#define SYSTEMCALL_INDEX(ServiceFunction) (*(PULONG)((PUCHAR)ServiceFunction + 1))

typedef NTSTATUS(*pfAddr)(
	PHANDLE            ProcessHandle,
	ACCESS_MASK        DesiredAccess,
	POBJECT_ATTRIBUTES ObjectAttributes,
	PCLIENT_ID         ClientId
	);
pfAddr pMyNtOpenProcess = 0;//保存原本的函数地址

//把这个函数替换去SSDT
 NTSTATUS MyZwOpenProcess(
	PHANDLE            ProcessHandle,
	ACCESS_MASK        DesiredAccess,
	POBJECT_ATTRIBUTES ObjectAttributes,
	PCLIENT_ID         ClientId
)
{
	 	 //DbgBreakPoint();
	 DbgPrintEx(77, 0, "ProcessID:%x\r\n", ClientId->UniqueProcess);
	 return pMyNtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}

 //关闭写保护
void PageProtectClose()
{
	__asm
	{
		cli//关闭中断
		mov eax,cr0
		and eax, not 10000h
		mov cr0,eax
	}	
}



//开启写保护
void PageProtectOpen()
{
	__asm
	{
		mov eax,cr0
		or eax,10000h
		mov cr0,eax
		sti
	}
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
	DbgBreakPoint();
	PageProtectClose();
	KeServiceDescriptorTable->Base[0xbe] = (ULONG)pMyNtOpenProcess;
	PageProtectOpen();
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDrvier, PUNICODE_STRING pReg)
{
	PageProtectClose();//关闭页保护
	ULONG uIndex = SYSTEMCALL_INDEX(ZwOpenProcess);
	pMyNtOpenProcess =KeServiceDescriptorTable->Base[uIndex];//保存原本的NtOpenProcess
	KeServiceDescriptorTable->Base[uIndex] = MyZwOpenProcess;//替换NtOpenProcess
	PageProtectOpen();//开启页保护

	pDrvier->DriverUnload = DriverUnload;
	return STATUS_SUCCESS;
}