x86重载内核[源码在最后]

X86重载内核

测试系统:WinXp, 环境:vs2017

一、内核重载简述

涉及PE文件，驱动程序编写, 对X86内核的了解
内核重载其实就是让所有的SSDT函数全部走自己写入的一块新内核

内核重载不是什么高端技术，但对于学习驱动编程的新手而言，还是有学习参考价值的

二、实现步骤(部分代码)

1.打开内核文件存为buffer,拉伸PE，修重定向表，IAT表

​
NTSTATUS LoadNtkrnlpa() 
{
   
	NTSTATUS						status = STATUS_SUCCESS;
	HANDLE							hFile = NULL;
	OBJECT_ATTRIBUTES				objAttr;
	IO_STATUS_BLOCK					ioBlock;
	UNICODE_STRING					FileName;
	FILE_STANDARD_INFORMATION		FileInfo;
	LARGE_INTEGER					Lageint; // 读取位置offset

	RtlInitUnicodeString(&FileName, FILEPATH);
	InitializeObjectAttributes(&objAttr, &FileName, OBJ_CASE_INSENSITIVE, NULL, NULL);

	status = ZwOpenFile(&hFile, FILE_ALL_ACCESS, &objAttr, &ioBlock, 0, FILE_NON_DIRECTORY_FILE);
	if (!NT_SUCCESS(status))
	{
   
		DbgPrint("ZwOpenFile Failed!, status:%d\n", status);
		return STATUS_UNSUCCESSFUL;
	}

	status = ZwQueryInformationFile(hFile, &ioBlock, &FileInfo, sizeof(FILE_STANDARD_INFORMATION), FileStandardInformation);
	if (!NT_SUCCESS(status))
	{
   
		ZwClose(hFile);
		DbgPrint("ZwQueryInformationFile Failed!\n");
		return STATUS_UNSUCCESSFUL;
	}
	FileSize = FileInfo.EndOfFile.LowPart;
	pFileBuffer = ExAllocatePool(NonPagedPool, FileSize);

	Lageint.QuadPart = 0;
	status = ZwReadFile(hFile, NULL, NULL, NULL, &ioBlock, pFileBuffer, FileSize, &Lageint, NULL);
	if (!NT_SUCCESS(status))
	{
   
		ZwClose(hFile);
		DbgPrint("ZwReadFile Failed!\n");
		return STATUS_UNSUCCESSFUL;
	}

	ZwClose(hFile);
	// 读取PE信息
	pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
	if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
	{
   
		ExFreePool(pFileBuffer);
		pFileBuffer = NUL