eac 反调试_自己动手制作一个过保护调试器

一、起因

本人是新手第一次接触驱动开发的小白，事情是这样的，一个星期前突发奇想想做一个调试器保护程序用于调试游戏，既然要调试驱动保护的程序，自然也要深入驱动底层。做调试器必须要hook api去隐藏调试器的参数，所以就有了今天这篇文章。

二、准备的东西

第一个版本的调试器保护程序就是今天要说的用到 ETW(Event Tracing for Windows) hook 去Hook api 实现隐藏参数的

ETW Hook(下文叫做 InfinityHook

原理简单点概括为 ETW在记录系统函数被调用事件的时候被调用的系统函数的指针还存放在栈上,能对应的指针从而实现Hook. 更多关于InfinityHook的可以百度一下 "InfinityHook" 看雪的大佬写的比我好,理解比我深入,就不卖丑了.

infinityhook的优点是简单好用,兼容性高,不像VT只能在intel cpu用而AMD必须另写SVM很麻烦,坏处是只能做r3层的api hook,R0的API是无法拦截的.github地址:https://github.com/everdox/InfinityHook

基本的思路:1.设置CreateProcessNotify去标记调试器进程的PID

2. 利用ObRegisterCallbacks注册process和thread的回调,当调试器打开进程时被反作弊的回调降权后再升级回去

3.hook NtQuerySystemInformation、NtSetInformationThread、NtQueryObject、NtQueryInformationThread、NtGetContextThread、NtQueryInformationProcess、pfn_NtGetContextThread XXOO anti debug

三、驱动编写

首先是抄了两个传家的ssdt函数获取的东西,通用的框架.不需要多言:extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)

{

DebugPrint("\n[DebugMessage] Driver Loading!\n");

RtlInitUnicodeString(&DeviceName, L"\\Device\\HuojiDebuger");

RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\HuojiDebuger");

PDEVICE_OBJECT DeviceObject = NULL;

NTSTATUS status = IoCreateDevice(DriverObject,

0,

&DeviceName,

FILE_DEVICE_UNKNOWN,

FILE_DEVICE_SECURE_OPEN,

FALSE,

&DeviceObject);

if (!NT_SUCCESS(status))

{

DebugPrint("[DeugMessage] IoCreateDevice Error...\r\n");

return status;

}

if (!DeviceObject)

{

DebugPrint("[DeugMessage] Unexpected I/O Error...\r\n");

return STATUS_UNEXPECTED_IO_ERROR;

}

DebugPrint("[DeugMessage] Device %.*ws created successfully!\r\n", DeviceName.Length / sizeof(WCHAR), DeviceName.Buffer);

DriverObject->DriverUnload = DriverUnload;

if (!NT_SUCCESS(NTDLL::Initialize()))

{

DebugPrint("[DebugMessage] Ntdll::Initialize() failed...\r\n");

return STATUS_UNSUCCESSFUL;

}

//获取SSDT函数

pfn_NtQueryInformationProcess = (NTQUERYINFORMATIONPROCESS)SSDT::GetFunctionAddress("NtQueryInformationProcess");

DebugPrint("[DebugMessage] NtQueryInformationProcess: 0x%08X...\r\n", pfn_NtQueryInformationProcess);

pfn_NtGetContextThread = (NTGETCONTEXTHREAD)SSDT::GetFunctionAddress("NtGetContextThread");

DebugPrint("[DebugMessage] NtGetContextThread: 0x%08X...\r\n", pfn_NtGetContextThread);

pfn_NtQueryInformationThread = (NTQUERYINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtQueryInformationThread");

DebugPrint("[DebugMessage] NtQueryInformationThread: 0x%08X...\r\n", pfn_NtQueryInformationThread);

pfn_NtQueryObject = (NTQUERYOBJECT)SSDT::GetFunctionAddress("NtQueryObject");

DebugPrint("[DebugMessage] NtQueryObject: 0x%08X...\r\n", pfn_NtQueryObject);

pfn_NtSetInformationThread = (NTSETINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtSetInformationThread");

DebugPrint("[DebugMessage] NtSetInformationThread: 0x%08X...\r\n", pfn_NtSetInformationThread);

pfn_NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)SSDT::GetFunctionAddress("NtQuerySystemInformation");

DebugPrint("[DebugMessage] NtQuerySystemInformation: 0x%08X...\r\n", pfn_NtQuerySystemInformation);

pfn_NtOpenProcess = (NTOPENPROCESS)SSDT::GetFunctionAddress("NtOpenProcess");

DebugPrint("[DebugMessage] NtOpenProcess: 0x%08X...\r\n", pfn_NtOpenProcess);

pfn_NtReadVirtualMemory = (NTREADVIRTUALMEMORY)SSDT::GetFunctionAddress("NtReadVirtualMemory");

DebugPrint("[DebugMessage] NtReadVirtualMemory: 0x%08X...\r\n", pfn_NtReadVirtualMemory);

pfn_NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)SSDT::GetFunctionAddress("NtWriteVirtualMemory");

DebugPrint("[DebugMessage] NtWriteVirtualMemory: 0x%08X...\r\n", pfn_NtWriteVirtualMemory);

pfn_NtCreateThread = (NTCREATETHREAD)SSDT::GetFunctionAddress("NtCreateThread");

DebugPrint("[DebugMessage] NtCreateThread: 0x%08X...\r\n", pfn_NtCreateThread);

pfn_NtTerminateProcess = (NTTERMINATEPROCESS)SSDT::GetFunctionAddress("NtTerminateProcess");

DebugPrint("[DebugMessage] NtTerminateProcess: 0x%08X...\r\n", pfn_NtTerminateProcess);

// 绕过MmVerifyCallbackFunction。

PLDR_DATA_TABLE_ENTRY64 ldr = (PLDR_DATA_TABLE_ENTRY64)DriverObject->DriverSection;

ldr->Flags |= 0x20;

//安装回调

InstallCallBacks();

//初始化ETW HOOK

if (!NT_SUCCESS(IfhInitialize(SyscallCallBack)))

DebugPrint("[DebugMessage] IfhInitialize() failed...\r\n");

return STATUS_SUCCESS;

}

其中IfhInitialize(SyscallCallBack))

注册后在SyscallCallBack捕获我们的要hook api函数:void __fastcall SyscallCallBack(_In_ unsigned int SystemCallIndex, _Inout_ void** SystemCallFunction)

{

if (*SystemCallFunction == pfn_NtOpenProcess)

*SystemCallFunction = HookNtOpenProcess;

else if (*SystemCallFunction == pfn_NtReadVirtualMemory)

*SystemCallFunction = HookNtReadVirtualMemory;

else if (*SystemCallFunction == pfn_NtWriteVirtualMemory)

*SystemCallFunction = HookNtWriteVirtualMemory;

else if (*SystemCallFunction == pfn_NtCreateThread)

*SystemCallFunction = HookNtCreateThread;

if (*SystemCallFunction == pfn_NtQueryInformationProcess)

*SystemCallFunction = HookNtQueryInformationProcess;

else if (*SystemCallFunction == pfn_NtGetContextThread)

*Syste