IDT HOOK



#include "ntddk.h"

#include "windef.h"

#pragma pack(2)

typedef struct _IDTR{

USHORT numberofidt;

ULONG highaddress;

}IDTR ,*PIDTR;

#pragma pack()

typedef struct _KTRAP_FRAME

{

ULONG DbgEbp;

ULONG DbgEip;

ULONG DbgArgMark;

ULONG DbgArgPointer;

WORD TempSegCs;

UCHAR Logging;

UCHAR Reserved;

ULONG TempEsp;

ULONG Dr0;

ULONG Dr1;

ULONG Dr2;

ULONG Dr3;

ULONG Dr6;

ULONG Dr7;

ULONG SegGs;

ULONG SegEs;

ULONG SegDs;

ULONG Edx;

ULONG Ecx;

ULONG Eax;

ULONG PreviousPreviousMode;

ULONG ExceptionList;

ULONG SegFs;

ULONG Edi;

ULONG Esi;

ULONG Ebx;

ULONG Ebp;

ULONG ErrCode;

ULONG Eip;

ULONG SegCs;

ULONG EFlags;

ULONG HardwareEsp;

ULONG HardwareSegSs;

ULONG V86Es;

ULONG V86Ds;

ULONG V86Fs;

ULONG V86Gs;

} KTRAP_FRAME, *PKTRAP_FRAME;

typedef struct _IDTENTRY

{

unsigned short LowOffset;

unsigned short selector;

unsigned char unused_lo;

unsigned char segment_type:4;  

unsigned char system_flag:1;

unsigned char DPL:2;  

unsigned char P:1; 

unsigned short HiOffset;

} IDTENTRY,*PIDTENTRY;

void onprotect();

void offprotect();

ULONG oldCr0=0;

ULONG old3=0;

PIDTENTRY idtentry;

void  DriverUnload(PDRIVER_OBJECT obj){

offprotect();

idtentry[3].LowOffset=(ULONG)old3&0xffff;

idtentry[3].HiOffset=(ULONG)old3>>16;

onprotect();

}

void _stdcall FilterExceptionInfo(PKTRAP_FRAME TrapFRame){

//*(DWORD*)(TrapFRame+0x068)=(DWORD)0;

KdPrint(("TrapFRame.eip =%X",TrapFRame->Eip));

}

void offprotect(){

__asm {

cli;

mov eax, cr0;

mov oldCr0, eax;

and eax, not 10000h;

mov cr0, eax

}

}

void onprotect(){

__asm {

mov eax, oldCr0;

mov cr0, eax;

sti;

}

}

__declspec(naked)void myidthook(){

__asm{

   push 0

mov word ptr [esp+2],0

push ebp 

push ebx

push esi

push edi

push fs

mov ebx,30h

mov fs,bx

mov ebx,dword ptr fs:[0]

   push ebx

sub esp,4h

push eax

push ecx

push edx

push ds

push es

push gs

mov ax,23h

sub esp,30h//以上构造

push esp //陷阱帧首地址

call FilterExceptionInfo

add esp,30h//恢复现场

pop gs

pop es

pop ds

pop edx

pop ecx

pop eax

add esp,4h

pop ebx

pop fs

pop edi

pop esi

pop ebx

pop ebp

add esp,4h

   jmp old3//跳回老函数

}

}

NTSTATUS DriverEntry(PDRIVER_OBJECT obj,PUNICODE_STRING pregister){

ULONG index=0;

IDTR idt;

//第一个方法获取IDTENTRY

__asm{

sidt idt

}

//第二次就是利用驱动的FS处理器控制块来获取 FS对应这个结构

/**

nt!_KPCR

+0x000 NtTib            : _NT_TIB

+0x01c SelfPcr          : Ptr32 _KPCR

+0x020 Prcb             : Ptr32 _KPRCB

+0x024 Irql             : UChar

+0x028 IRR              : Uint4B

+0x02c IrrActive        : Uint4B

+0x030 IDR              : Uint4B

+0x034 KdVersionBlock   : Ptr32 Void

+0x038 IDT              : Ptr32 _KIDTENTRY

+0x03c GDT              : Ptr32 _KGDTENTRY

+0x040 TSS              : Ptr32 _KTSS

+0x044 MajorVersion     : Uint2B

+0x046 MinorVersion     : Uint2B

+0x048 SetMember        : Uint4B

+0x04c StallScaleFactor : Uint4B

+0x050 DebugActive      : UChar

+0x051 Number           : UChar

+0x052 Spare0           : UChar

+0x053 SecondLevelCacheAssociativity : UChar

+0x054 VdmAlert         : Uint4B

+0x058 KernelReserved   : [14] Uint4B

+0x090 SecondLevelCacheSize : Uint4B

+0x094 HalReserved      : [16] Uint4B

+0x0d4 InterruptMode    : Uint4B

+0x0d8 Spare1           : UChar

+0x0dc KernelReserved2  : [17] Uint4B

+0x120 PrcbData         : _KPRCB

kd> dt _krcp

*/

//还有一个就是获取所有CPU位图也就是个数 然后运行到指定CPU

//下面代码就是通用了  我这里只处理了XP还有只是单核 把上面的CPU 弄好了就行了

idtentry=(PIDTENTRY)idt.highaddress;

old3=MAKELONG(idtentry[3].LowOffset,idtentry[3].HiOffset);//构造3号中断地址

offprotect();

idtentry[3].LowOffset=(ULONG)myidthook&0xffff;//写入中断结构的低16地址

idtentry[3].HiOffset=(ULONG)myidthook >>16;//写入中断结构高16地址

onprotect();

// KdPrint(("Don't use the automatic filtering of IDT interrupt "));

//KdPrint(("idt address: %X ,numberofidt: %d",idt.highaddress,idt.numberofidt));枚举当前处理器所有IDT表内容

/**for(;index<(idt.numberofidt+1)/sizeof(IDTENTRY);index++){

if (MAKELONG(idtentry[index].LowOffset,idtentry[index].HiOffset)!=0)

{

KdPrint(("index: %d address: %X",index,MAKELONG(idtentry[index].LowOffset,idtentry[index].HiOffset)));

}

}*/

obj->DriverUnload=DriverUnload;

return STATUS_SUCCESS;

}