SSDT Shadow Table
typedef struct _KSYSTEM_SERVICE_TABLE
{
PULONG ServiceTableBase;
PULONG ServiceCounterTableBase;
ULONG NumberOfService;
PUCHAR ParamTableBase;
} KSYSTEM_SERVICE_TABLE, *PKSYSTEM_SERVICE_TABLE;
typedef struct _KSERVICE_TABLE_DESCRIPTOR
{
KSYSTEM_SERVICE_TABLE ntoskrnl;
KSYSTEM_SERVICE_TABLE win32k;
KSYSTEM_SERVICE_TABLE notUsed1;
KSYSTEM_SERVICE_TABLE notUsed2;
}KSERVICE_TABLE_DESCRIPTOR, *PKSERVICE_TABLE_DESCRIPTOR;
extern PKSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable;
PKSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTableShadow;
PLIST_ENTRY FindPsActiveProcessHead()
{
PEPROCESS process;
PLIST_ENTRY PsActiveProcessHead=NULL;
PLIST_ENTRY pList=NULL;
NTSTATUS status=PsLookupProcessByProcessId((HANDLE)4,&process);
if (!NT_SUCCESS(status))
{
KdPrint(("获取process失败\n"));
return NULL;
}
pList=(PLIST_ENTRY)((PUCHAR)process+0x88);
PsActiveProcessHead=pList->Blink;
return PsActiveProcessHead;
}
ULONG FindProcess(PSTRING Name)
{
PLIST_ENTRY pHead=NULL,pTemp=NULL;
ULONG pPor=0;
STRING porName;
pHead=FindPsActiveProcessHead();
pTemp=pHead->Flink;
while(pTemp!=pHead)
{
pPor=(ULONG)pTemp-0x88;
RtlInitAnsiString(&porName,(PCSZ)(pPor+0x174));
if(0==RtlCompareString(Name,&porName,0))
{
return pPor;
}
pTemp=pTemp->Flink;
}
KdPrint(("没有找到进程\r\n"));
return 0;
}
void HookNtUserFindWindowEx()
{
ULONG exlorerEproc;
PKAPC_STATE ApcState;
STRING str;
PULONG pNtFind=NULL;
KeServiceDescriptorTableShadow=(PKSERVICE_TABLE_DESCRIPTOR)((ULONG)KeServiceDescriptorTable-0x40);
RtlInitAnsiString(&str,"explorer.exe");
exlorerEproc=FindProcess(&str);
KeStackAttachProcess((PEPROCESS)exlorerEproc, ApcState);
KeServiceDescriptorTableShadow->win32k.ServiceTableBase[0x17a]=(ULONG)m_NtUserFindWindowEx;
//PageProtectOn();
}