/**
*描述:
* hook SSDT,用fnHooker挂接SSDT表中服务ID为sid的函数
*参数:
* sid:要挂接的函数的服务ID
* fnHooker:过滤函数
*返回:被挂接函数的真实地址
*
*/
ULONG PPHookSSDT(ULONG sid , PVOID fnHooker)
{
PULONG pRealAddr = (PULONG)((ULONG)KeServiceDescriptorTable->ServiceTableBase + 4*sid)
ULONG realAddr = *pRealAddr;
//去掉内存保护
__asm
{
push eax
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
pop eax
}
InterlockedExchange((LONG *)pRealAddr , (LONG)fnHooker);
//恢复内存保护
__asm
{
push eax
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
pop eax
}
return realAddr;
}
可重用函数:挂接SSDT的函数
最新推荐文章于 2019-01-15 12:20:55 发布