0环下没有veh
有seh
#include <ntifs.h>
VOID DriverUnload(PDRIVER_OBJECT pDriver);
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pPath)
{
UNREFERENCED_PARAMETER(pPath);
DbgBreakPoint();
__try
{
int *p = 0;
*p = 100;
}
except(1)
{
KdPrint(("哈哈:掠过了一个异常"));
}
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
UNREFERENCED_PARAMETER(pDriver);
}
Object-Hook
条件是要自己声名相关结构(用的windbg查看)
问题是函数与平台相关
例:
win32下
#include <ntifs.h>
VOID DriverUnload(PDRIVER_OBJECT objDriver);
typedef ULONG(*OBGETOBJECTTYPE)(PVOID Object);
typedef NTSTATUS(*PARSEPRODECEDURE)(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object);
PARSEPRODECEDURE g_OldFun;
NTSTATUS NewParseProcedure(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object)
{
KdPrint(("Hook Success\n"));
return g_OldFun(ParseObject, ObjectType, AccessState, AccessMode, Attributes,
CompleteName,
RemainingName, Context, SecurityQos, Object);
}
OBGETOBJECTTYPE g_OBGetObjectType;
//获得一个函数地址,这个函数能够通过内核对象得到内核对象的类型
VOID GetObjectTypeAddress()
{
PUCHAR addr;
UNICODE_STRING pslookup;
RtlInitUnicodeString(&pslookup, L"ObGetObjectType");
// 类似于应用层的GetProcAddress
addr = (PUCHAR)MmGetSystemRoutineAddress(&pslookup);
g_OBGetObjectType = (OBGETOBJECTTYPE)addr;
}
typedef struct _OBJECT_TYPE_INITIALIZER {
USHORT Length;
UCHAR ObjectTypeFlags;
UCHAR CaseInsensitive;
UCHAR UnnamedObjectsOnly;
UCHAR UseDefaultObject;
UCHAR SecurityRequired;
UCHAR MaintainHandleCount;
UCHAR MaintainTypeList;
UCHAR SupportsObjectCallbacks;
UCHAR CacheAligned;
ULONG ObjectTypeCode;
BOOLEAN InvalidAttributes;
GENERIC_MAPPING GenericMapping;
BOOLEAN ValidAccessMask;
BOOLEAN RetainAccess;
POOL_TYPE PoolType;
BOOLEAN DefaultPagedPoolCharge;
BOOLEAN DefaultNonPagedPoolCharge;
PVOID DumpProcedure;
ULONG OpenProcedure;
PVOID CloseProcedure;
PVOID DeleteProcedure;
ULONG ParseProcedure;
ULONG SecurityProcedure;
ULONG QueryNameProcedure;
UCHAR OkayToCloseProcedure;
} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
typedef struct _OBJECT_TYPE {
LIST_ENTRY TypeList;
UNICODE_STRING Name;
PVOID DefaultObject;
ULONG Index;
ULONG TotalNumberOfObjects;
ULONG TotalNumberOfHandles;
ULONG HighWaterNumberOfObjects;
ULONG HighWaterNumberOfHandles;
OBJECT_TYPE_INITIALIZER TypeInfo;
ULONG TypeLock;
ULONG Key;
LIST_ENTRY CallbackList;
} OBJECT_TYPE, *POBJECT_TYPE;
HANDLE KernelCreateFile(
IN PUNICODE_STRING pstrFile, // 文件路径符号链接
IN BOOLEAN bIsDir) // 是否为文件夹
{
HANDLE hFile = NULL;
NTSTATUS Status = STATUS_UNSUCCESSFUL;
IO_STATUS_BLOCK StatusBlock = { 0 };
ULONG ulShareAccess =
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE;
ULONG ulCreateOpt =
FILE_SYNCHRONOUS_IO_NONALERT;
// 1. 初始化OBJECT_ATTRIBUTES的内容
OBJECT_ATTRIBUTES objAttrib = { 0 };
ULONG ulAttributes =
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE;
InitializeObjectAttributes(
&objAttrib, // 返回初始化完毕的结构体
pstrFile, // 文件对象名称
ulAttributes, // 对象属性
NULL, NULL); // 一般为NULL
// 2. 创建文件对象
ulCreateOpt |= bIsDir ?
FILE_DIRECTORY_FILE : FILE_NON_DIRECTORY_FILE;
Status = ZwCreateFile(
&hFile, // 返回文件句柄
GENERIC_ALL, // 文件操作描述
&objAttrib, // OBJECT_ATTRIBUTES
&StatusBlock, // 接受函数的操作结果
0, // 初始文件大小
FILE_ATTRIBUTE_NORMAL, // 新建文件的属性
ulShareAccess, // 文件共享方式
FILE_OPEN_IF, // 文件存在则打开不存在则创建
ulCreateOpt, // 打开操作的附加标志位
NULL, // 扩展属性区
0); // 扩展属性区长度
if (!NT_SUCCESS(Status))
return (HANDLE)-1;
return hFile;
}
void OnHook()
{
//1 随便打开一个文件,得到一个文件对象
UNICODE_STRING ustrFilePath;
RtlInitUnicodeString(&ustrFilePath,
L"\\??\\D:\\123.txt");
HANDLE hFile = KernelCreateFile(&ustrFilePath, FALSE);
PVOID pObject;
ObReferenceObjectByHandle(hFile, GENERIC_ALL, NULL, KernelMode, &pObject, NULL);
//2 通过这个文件对象得到OBJECT_TYPE这个结构体
OBJECT_TYPE * FileType = NULL;
FileType = (OBJECT_TYPE *)g_OBGetObjectType(pObject);
//3 把这个函数地址保存起来
g_OldFun = (PARSEPRODECEDURE)FileType->TypeInfo.ParseProcedure;
//4 把这个函数地址替换为自己的函数。
FileType->TypeInfo.ParseProcedure = (ULONG)NewParseProcedure;
}
void OffHook()
{
}
NTSTATUS DriverEntry(
PDRIVER_OBJECT pDriver,
PUNICODE_STRING strRegPath)
{
// 避免编译器报未引用参数的警告
UNREFERENCED_PARAMETER(strRegPath);
// 打印一行字符串,并注册驱动卸载函数,以便于驱动卸载
DbgBreakPoint();//_asm int 3
__try
{
GetObjectTypeAddress();
OnHook();
}
except(1)
{
KdPrint(("掠过一个异常\n"));
}
KdPrint(("My First Dirver!"));
pDriver->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
VOID DriverUnload(PDRIVER_OBJECT objDriver) {
// 避免编译器报未引用参数的警告
UNREFERENCED_PARAMETER(objDriver);
// 什么也不做,只打印一行字符串
KdPrint(("My Dirver is unloading..."));
}
转载于:https://blog.51cto.com/haidragon/2131761