一个禁止任何ring3调试的驱动

最新推荐文章于 2021-10-20 13:40:47 发布

better0332

最新推荐文章于 2021-10-20 13:40:47 发布

阅读量3.7k

点赞数 1

分类专栏：逆向调试文章标签： hook struct object include string xp

本文链接：https://blog.csdn.net/better0332/article/details/6698110

版权

本文介绍了一个旨在防止Ring3级别调试的驱动程序，适用于多核和多系统环境。内容涉及hook技术、结构体操作、对象管理及字符串处理等关键点。

摘要由CSDN通过智能技术生成

#include <ntddk.h>

#define MAKELONG(low, high) \
((ULONG)(((USHORT)((ULONG)(low) & 0xffff)) | ((ULONG)((USHORT)((ULONG)(high) & 0xffff))) << 16))

#define GET_LOW16_OF_32(data) \
((USHORT)(((ULONG)data) & 0xffff))

#define GET_HIGH16_OF_32(data) \
((USHORT)(((ULONG)data) >> 16))

#pragma pack(push,1)
typedef struct IDTR_
{
  USHORT limit;
  ULONG base;
} IDTR, *P_IDTR;

typedef struct IDTENTRY_
{
  USHORT offset_low;
  USHORT selector;
  UCHAR reserved;
  UCHAR type:4;
  UCHAR always0:1;
  UCHAR dpl:2;
  UCHAR present:1;
  USHORT offset_high;
} IDTENTRY, *P_IDTENTRY;
#pragma pack(pop)

ULONG Offset = 0;
ULONG HOOK_IDT_INDEX[] = {0x01, 0x03};
#define HOOK_IDT_NUM sizeof(HOOK_IDT_INDEX)/sizeof(ULONG)
VOID *g_old_entry[HOOK_IDT_NUM] = {0};

VOID *GetIdt()
{
  IDTR idtr;
  _asm sidt idtr
  return (VOID *)idtr.base;
}

VOID MyUserFilter()
{
  KdPrint(("Crurrent IRQL: %d\n",KeGetCurrentIrql()));
  if (Offset &