uf KeAddSystemServiceTable
[
]
一个叫二石的人在元月,在树下,吃月饼:
1.获取NtCreateFile索引:
方法一,不能用xuetr,xuetr只能看被HOOK的。PowerTool也只能看被HOOK的,不知道是不是比xuetr深入,可以看TP保护。KD:
方法二,OD:
附加随便一个进程。不需要运行,直接右击--查询--符号,进入下面的界面:
右击--选择反汇编窗口中跟随输入函数:
Ctrl+Shift+X,添加类向导:
删除代码段:
**********************************************************************************
ULONG GetSDDTAddr(ULONG uIndex)
{
}
typedef struct _SDT_ENTRY
{
PVOID *ServiceTableBase;
PULONG ServiceCounterTableBase; //Used only in checked build
ULONG NumberOfServices;
PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;
***********************************************************************************************************
<img src="https://img-blog.csdn.net/20150115135603025?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />
<pre name="code" class="cpp">//源文件
#include <ntddk.h>
#include "SSDTHOOK.h"
void UnloadDriver(PDRIVER_OBJECT pDriver);
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING str)
{
#if DBG
_asm int 3
#endif
//驱动 ->驱动卸载=卸载驱动
pDriver->DriverUnload = UnloadDriver;
//调试输出
DbgPrint("Loading MyDriver...\r");//有一个换行的空格
ULONG uAddr = GetSDDTAddr(0x42);
if (uAddr)
{
KdPrint(("NtCreateFile:0x%08x\r", uAddr));
}
return 1;
}
void UnloadDriver(PDRIVER_OBJECT pDriver)
{
//调试输出
DbgPrint("unLoading MyDriver...\r");
}
<img src="https://img-blog.csdn.net/20150115135612946?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />
<pre name="code" class="cpp">//SSDTHOOK.cpp
#include "SSDTHOOK.h"
ULONG GetSDDTAddr(ULONG uIndex)
{
ULONG uAddr = *(PULONG)((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
return uAddr;
}
</pre><img src="https://img-blog.csdn.net/20150115135815109?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" /><br /><pre name="code" class="cpp">//SSDTHOOK.h
#pragma once
#ifdef __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef __cplusplus
};// extern "C"
#endif
typedef struct _SDT_ENTRY
{
PVOID *ServiceTableBase;
PULONG ServiceCounterTableBase; //Used only in checked build
ULONG NumberOfServices;
PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;
EXTERN_C SDT_ENTRY *KeServiceDescriptorTable;
ULONG GetSDDTAddr(ULONG uIndex);
Alt+5打开debug的内存窗口。
FlashFXP
windows XP桌面路径:C:\Documents and Settings\用户名\桌面
//没有VMTOOL 竟然可以共享剪贴板
Microsoft Windows XP [版本 5.1.2600]
(C) 版权所有 1985-2001 Microsoft Corp.
C:\Documents and Settings\Administrator>ipconfig
Windows IP Configuration
Ethernet adapter 本地连接:
Connection-specific DNS Suffix . : localdomain
IP Address. . . . . . . . . . . . : 192.168.232.129
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.232.2
C:\Documents and Settings\Administrator>
FileZilla(在查看里,把消息日志取消)可以比较目录。
FlashFXP建立本地连接不行;安装在系统盘。
//源文件
#include "mini_ddk.h"
#include "SSDTHOOK.h"
ULONG g_uOldNtCreateFileAddr = 0;
PFNNTCREATEFILE g_pfnNtCreateFile = NULL;
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING str)
{
//#if DBG
// _asm int 3
//#endif
//驱动 ->驱动卸载=卸载驱动
pDriver->DriverUnload = UnloadDriver;
//调试输出
DbgPrint("Loading MyDriver...\r");//有一个换行的空格
ULONG uAddr = GetSDDTAddr(0x42);
if (uAddr)
{
g_pfnNtCreateFile = (PFNNTCREATEFILE)uAddr;
HookSSDTByMdl(0x42, (ULONG)rlNtCreateFile, &g_uOldNtCreateFileAddr);
KdPrint(("NtCreateFile:0x%08x\r", uAddr));
}
return 1;
}
void UnloadDriver(PDRIVER_OBJECT pDriver)
{
UnHookSSDTByMdl(0x42, g_uOldNtCreateFileAddr);
//调试输出
DbgPrint("unLoading MyDriver...\r");
}
NTSTATUS rlNtCreateFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_ PVOID EaBuffer,
_In_ ULONG EaLength
)
{
if (ObjectAttributes && ObjectAttributes->ObjectName)
{
if (wcsstr(ObjectAttributes->ObjectName->Buffer, L"1.txt") != 0)
{
KdPrint(("NtCreateFile %wZ\r"), ObjectAttributes->ObjectName);
return STATUS_UNSUCCESSFUL;
}
}
return g_pfnNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes,
ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
//SSDTHOOK.cpp
#include "SSDTHOOK.h"
ULONG GetSDDTAddr(ULONG uIndex)
{
ULONG uAddr = *(PULONG)((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
return uAddr;
}
BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr)
{
if (uNewAddr == 0 || puOldAddr == NULL)
{
return FALSE;
}
ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
*puOldAddr = *(PULONG)uAddr;
//DisableWP();
*(PULONG)uAddr=uNewAddr;
//EnableWP();
return TRUE;
}
BOOLEAN unHookSSDT(ULONG uIndex, PULONG uOldAddr)
{
if (uOldAddr == 0)
{
return FALSE;
}
ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
//DisableWP();
*(PULONG)uAddr = uOldAddr;
//EnableWP();
return TRUE;
}
void DisableWP()
{
_asm
{
cli//不要切换到其他CPU
push eax
mov eax,cr0
and eax,0xfffeffff
mov cr0,eax
pop eax
}
}
void EnableWP()
{
_asm
{
push eax
mov eax,cr0
or eax,0x10000
mov cr0,eax
pop eax
sti
}
}
BOOLEAN HookSSDTByMdl(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr)
{
if (uNewAddr == 0 || puOldAddr == NULL)
{
return FALSE;
}
PMDL pSSDTMdl= MmCreateMdl(NULL, (*KeServiceDescriptorTable).ServiceTableBase, sizeof(ULONG)* (*KeServiceDescriptorTable).NumberOfServices);
if (pSSDTMdl == NULL)
{
return FALSE;
}
MmBuildMdlForNonPagedPool(pSSDTMdl);
pSSDTMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;
PVOID pServiceTableBase = MmMapLockedPages(pSSDTMdl, KernelMode);
if (pServiceTableBase == NULL)
{
return FALSE;
}
ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex);
*puOldAddr = *(PULONG)uAddr;
*(PULONG)uAddr = uNewAddr;
IoFreeMdl(pSSDTMdl);
return TRUE;
}
BOOLEAN UnHookSSDTByMdl(ULONG uIndex, ULONG uOldAddr)
{
if ( uOldAddr == NULL)
{
return FALSE;
}
PMDL pSSDTMdl = MmCreateMdl(NULL, (*KeServiceDescriptorTable).ServiceTableBase, sizeof(ULONG)* (*KeServiceDescriptorTable).NumberOfServices);
if (pSSDTMdl == NULL)
{
return FALSE;
}
MmBuildMdlForNonPagedPool(pSSDTMdl);
pSSDTMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;
PVOID pServiceTableBase = MmMapLockedPages(pSSDTMdl, KernelMode);
if (pServiceTableBase == NULL)
{
return FALSE;
}
ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex);
*(PULONG)uAddr = uOldAddr;
IoFreeMdl(pSSDTMdl);
return TRUE;
}
//SSDTHOOK.h
#pragma once
#ifdef __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef __cplusplus
};// extern "C"
#endif
typedef struct _SDT_ENTRY
{
PVOID *ServiceTableBase;
PULONG ServiceCounterTableBase; //Used only in checked build
ULONG NumberOfServices;
PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;
EXTERN_C SDT_ENTRY *KeServiceDescriptorTable;
ULONG GetSDDTAddr(ULONG uIndex);
//BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr);
//BOOLEAN unHookSSDT(ULONG uIndex, PULONG uOldAddr);
//void DisableWP();
//void EnableWP();
BOOLEAN HookSSDTByMdl(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr);
BOOLEAN UnHookSSDTByMdl(ULONG uIndex, ULONG uOldAddr);
//mini_ddk.h
#include <ntddk.h>
void UnloadDriver(PDRIVER_OBJECT pDriver);
NTSTATUS rlNtCreateFile(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_ PVOID EaBuffer,
_In_ ULONG EaLength
);
typedef NTSTATUS (*PFNNTCREATEFILE)(
_Out_ PHANDLE FileHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_In_opt_ PLARGE_INTEGER AllocationSize,
_In_ ULONG FileAttributes,
_In_ ULONG ShareAccess,
_In_ ULONG CreateDisposition,
_In_ ULONG CreateOptions,
_In_ PVOID EaBuffer,
_In_ ULONG EaLength
);