c语言hook内核作用,hook内核函数的基本方法（附代码，经测试不蓝屏）

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

来看看汇编代码和注释:

IoCallDriver:

nt!IoCallDriver:

804f04f2 8bff mov edi,edi

804f04f4 55 push ebp

804f04f5 8bec mov ebp,esp

804f04f7 8b550c mov edx,dword ptr [ebp+0Ch]//irp,edx

804f04fa 8b4d08 mov ecx,dword ptr [ebp+8]//deviceobject,ecx

804f04fd ff1500d25480 call dword ptr [nt!pIofCallDriver (8054d200)]

804f0503 5d pop ebp

804f0504 c20800 ret 8

IopfCallDriver:

nt!IopfCallDriver:

804ef0e8 fe4a23 dec byte ptr [edx+23h]//CurrentLocation--

804ef0eb 8a4223 mov al,byte ptr [edx+23h]

804ef0ee 84c0 test al,al//CurrentLocation是否为0

804ef0f0 7f0e jg nt!IopfCallDriver+0x18 (804ef100)

804ef0f2 6a00 push 0

804ef0f4 6a00 push 0

804ef0f6 6a00 push 0

804ef0f8 52 push edx

804ef0f9 6a35 push 35h

804ef0fb e89aab0000 call nt!KeBugCheckEx (804f9c9a)//报错

804ef100 8b4260 mov eax,dword ptr [edx+60h]//Tail.Overlay.CurrentStackLocation

804ef103 83e824 sub eax,24h//IO_STACK_LOCATION为0x24字节

804ef106 56 push esi//--Tail.Overlay.CurrentStackLocation

804ef107 894260 mov dword ptr [edx+60h],eax//irpStack(PIO_STACK_LOCATION)

804ef10a 894814 mov dword ptr [eax+14h],ecx//irpStack->DeviceObject=deviceobject

804ef10d 0fb600 movzx eax,byte ptr [eax]//irpStack->MajorFunction

804ef110 8b7108 mov esi,dword ptr [ecx+8]//deviceobject->DriverObject

804ef113 52 push edx

804ef114 51 push ecx

804ef115 ff548638 call dword ptr [esi+eax*4+38h]//deviceobject->DriverObject->MajorFuntion[eax]

804ef119 5e pop esi

804ef11a c3 ret//返回到调用函数