监控应用层通信_hook_kifastcallentry(系统服务调用)

#include"ntddk.h"
#pragma pack(1) //写这个内存以一字节对齐 如果不写是以4字节的对齐的    
typedef struct ServiceDescriptorEntry {//这个结构就是为了管理这个数组而来的 内核api所在的数组 才有这个结构的 这个是ssdt    
	unsigned int *ServiceTableBase;//就是ServiceTable ssdt数组    
	unsigned int *ServiceCounterTableBase; //仅适用于checked build版本 无用    
	unsigned int NumberOfServices;//(ServiceTableBase)数组中有多少个元素 有多少个项    
	unsigned char *ParamTableBase;//参数表基址 我们层传过来的api的参数 占用多少字节 多大    
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack(1)    
_declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;//(名字不要写错)  //导入ssdt表  
ULONG sosuohookdiandizhi();
void yebaohuguanbi();
void yebaohukaiqi();
unsigned int lao_ntopenfile;//老的ntopenfile函数的地址
ULONG dizhi1 = 0;//KiFasetCallEntry汇编代码中的 (call ntcreatefile)下一句的地址
ULONG dizhi2 = 0;//KiFasetCallEntry汇编代码中要hook的地址
typedef  NTSTATUS(*hanshuzhizhen1)(
	__out PHANDLE FileHandle,
	__in ACCESS_MASK DesiredAccess,
	__in POBJECT_ATTRIBUTES ObjectAttributes,
	__out PIO_STATUS_BLOCK IoStatusBlock,
	__in_opt PLARGE_INTEGER AllocationSize,
	__in ULONG FileAttributes,
	__in ULONG ShareAccess,
	__in ULONG CreateDisposition,
	__in ULONG CreateOptions,
	__in_bcount_opt(EaLength) PVOID EaBuffer,
	__in ULONG EaLength
	);
VOID xiezai1(PDRIVER_OBJECT qudongduixiang)
{
	yebaohuguanbi();//页保护关闭    
	KeServiceDescriptorTable.ServiceTableBase[66] = (unsigned int)lao_ntopenfile;//还原ntcreatefile
	yebaohukaiqi();//页保护开启    
	UCHAR tezhengma[5] = { 0x2b, 0xe1, 0xc1, 0xe9, 0x02 };
	yebaohuguanbi();//页保护关闭    
	RtlCopyMemory((PVOID)dizhi2, tezhengma, 5);//还原kifastcallentry 
	yebaohukaiqi();//页保护开启    
	KdPrint(("已经执行到驱动卸载历程\n"));
}
void yebaohuguanbi()//页保护关闭    
{
	__asm{//去掉内存保护    
		cli
			mov  eax, cr0
			and  eax, not 10000h
			mov  cr0, eax
	}
}
void yebaohukaiqi()//页保护开启    
{
	__asm{//恢复内存保护      
		mov  eax, cr0
			or   eax, 10000h
			mov  cr0, eax
			sti
	}
}

void lisaisaide_guolvhanshu(ULONG ServiceTableBase, ULONG NumberOfServices)//李赛赛的过滤函数 注意不要在这里加 __declspec (naked)这个不是汇编代码 注意传过来的参数是ulong类型
{
	//KdPrint(("进入到我的的过滤函数来了 欧耶 可以监控应用层传过来的请求(调用nt函数的信息)\n"));
	if (ServiceTableBase == (ULONG)KeServiceDescriptorTable.ServiceTableBase)
	{
		if (NumberOfServices==190)
		{
	KdPrint(("看那些进入KiFasetCallEntry调用ntopenkey进程名是%s\n", (char*)PsGetCurrentProcess() + 0x16c));
		}
	}
}
__declspec (naked)
VOID lisaisaide_KiFasetCallEntry()//李赛赛的KiFasetCallEntry
{
	__asm
	{
		pushad 
		pushfd
		push eax
		push edi 
		call lisaisaide_guolvhanshu //调用我们的过滤函数
		popfd
		popad
		pop eax
		sub esp,ecx         //call lisaisaide_KiFasetCallEntry 替换掉的5个字节的代码
		shr ecx,2
		jmp eax
	}
}
VOID hook_KiFasetCallEntry()//inlinehookKiFasetCallEntry
{
	ULONG  pianyi1 = 0;
	UCHAR tezhengma[5];
	pianyi1 = (ULONG)lisaisaide_KiFasetCallEntry - 5 - dizhi2;
	tezhengma[0] = 0xe8;
	*(ULONG*)&tezhengma[1] = pianyi1;
	//KdPrint(("李赛赛的KiFasetCallEntry地址%x  计算出来的 偏移%x\n", (ULONG)lisaisaide_KiFasetCallEntry, pianyi1));
	yebaohuguanbi();//页保护关闭   
	RtlCopyMemory((PVOID)dizhi2, tezhengma, 5);//inlinehook_KiFasetCallEntry
	yebaohukaiqi();//页保护开启  
}
NTSTATUS lisaisaide_NtCreateFile(    //李赛赛的_NtCreateFile函数
	__out PHANDLE FileHandle,
	__in ACCESS_MASK DesiredAccess,
	__in POBJECT_ATTRIBUTES ObjectAttributes,
	__out PIO_STATUS_BLOCK IoStatusBlock,
	__in_opt PLARGE_INTEGER AllocationSize,
	__in ULONG FileAttributes,
	__in ULONG ShareAccess,
	__in ULONG CreateDisposition,
	__in ULONG CreateOptions,
	__in_bcount_opt(EaLength) PVOID EaBuffer,
	__in ULONG EaLength
	)
{
	__asm
	{
		pushad
		mov eax, [ebp + 0x4]
		mov dizhi1, eax
		popad
	}
	//KdPrint(("通过内核栈得到地址call ebx下一句的地址%x\n", dizhi1));//得到地址正确
	sosuohookdiandizhi();//搜索hook KiFastCallEntry 
	//yebaohuguanbi();//页保护关闭    
	//KeServiceDescriptorTable.ServiceTableBase[66] = (unsigned int)lao_ntopenfile;//还原ntcreatefile
	//yebaohukaiqi();//页保护开启    
	hook_KiFasetCallEntry(); //开始hook
	return   ((hanshuzhizhen1)lao_ntopenfile)(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
}
ULONG sosuohookdiandizhi()//搜索hook KiFastCallEntry 
{
	UCHAR *p = (UCHAR *)dizhi1;
	for (ULONG i = 0; i < 300;i++)
	{
		if (*p==0x2b&&*(p+1)==0xe1&&*(p+2)==0xc1&&*(p+3)==0xe9&&*(p+4)==0x02)
		{
			//KdPrint(("找到地址kifastcallentry的hook点地址  %x\n",(ULONG)p));
			dizhi2 = (ULONG)p;
			return (ULONG)p;
		}
		p--;
	}
	//KdPrint(("没有找到hook点的地址%x 是错误的", (ULONG)p));
	return 0;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT qudongduixiang,PUNICODE_STRING zhucebiao)
{
	lao_ntopenfile = KeServiceDescriptorTable.ServiceTableBase[66];//保存老的ntopenfile函数地址
	yebaohuguanbi();//页保护关闭    
	KeServiceDescriptorTable.ServiceTableBase[66] = (unsigned int)lisaisaide_NtCreateFile;//ssdthook_ntopenfile 属于ssdthook
	yebaohukaiqi();//页保护开启    
	qudongduixiang->DriverUnload = xiezai1;
	return STATUS_SUCCESS;
}