vc++ hook 拦截自己进程指定的api函数_自己动手制作一个过保护调试器

一、起因

第一次接触驱动开发的小白，事情是这样的，一个星期前突发奇想想做一个腻o调试器保护程序用于调试游戏，既然要调试驱动保护的程序，自然也要深入驱动底层做调试器必须要hook api去隐藏调试器的参数 所以就有了今天这篇文章。

二、准备的东西

第一个版本的调试器保护程序就是今天要说的用到 ETW(Event Tracing for Windows) hook 去Hook api 实现隐藏参数的

ETW Hook(下文叫做 InfinityHook

原理简单点概括为 ETW在记录系统函数被调用事件的时候被调用的系统函数的指针还存放在栈上能对应的指针从而实现Hook.更多关于InfinityHook的可以百度一下 “InfinityHook” 大佬写的比我好理解比我深入就不卖丑了infinityhook的优点是简单好用，兼容性高，不像VT只能在intel cpu用而AMD必须另写SVM很麻烦，坏处是只能做r3层的api hook,R0的API是无法拦截的.github地址:https://github.com/everdox/InfinityHook

基本的思路:

1.设置CreateProcessNotify去标记调试器进程的PID

2. 利用ObRegisterCallbacks注册process和thread的回调,当调试器打开进程时被反作弊的回调降权后再升级回去

3.hook NtQuerySystemInformation、NtSetInformationThread、NtQueryObject、NtQueryInformationThread、NtGetContextThread、NtQueryInformationProcess、pfn_NtGetContextThread XXOO anti debug

三、驱动编写

首先是抄了两个传家的ssdt函数获取的东西,通用的框架.不需要多言:

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING  RegistryPath){
      DebugPrint("\n[DebugMessage] Driver Loading!\n");  RtlInitUnicodeString(&DeviceName, L"\\Device\\HuojiDebuger");  RtlInitUnicodeString(&Win32Device, L"\\DosDevices\\HuojiDebuger");  PDEVICE_OBJECT DeviceObject = NULL;  NTSTATUS status = IoCreateDevice(DriverObject,    0,    &DeviceName,    FILE_DEVICE_UNKNOWN,    FILE_DEVICE_SECURE_OPEN,    FALSE,    &DeviceObject);  if (!NT_SUCCESS(status))  {
        DebugPrint("[DeugMessage] IoCreateDevice Error...\r\n");    return status;  }  if (!DeviceObject)  {
        DebugPrint("[DeugMessage] Unexpected I/O Error...\r\n");    return STATUS_UNEXPECTED_IO_ERROR;  }  DebugPrint("[DeugMessage] Device %.*ws created successfully!\r\n", DeviceName.Length / sizeof(WCHAR), DeviceName.Buffer);  DriverObject->DriverUnload = DriverUnload;  if (!NT_SUCCESS(NTDLL::Initialize()))  {
        DebugPrint("[DebugMessage] Ntdll::Initialize() failed...\r\n");    return STATUS_UNSUCCESSFUL;  }        //获取SSDT函数  pfn_NtQueryInformationProcess = (NTQUERYINFORMATIONPROCESS)SSDT::GetFunctionAddress("NtQueryInformationProcess");  DebugPrint("[DebugMessage] NtQueryInformationProcess: 0x%08X...\r\n", pfn_NtQueryInformationProcess);  pfn_NtGetContextThread = (NTGETCONTEXTHREAD)SSDT::GetFunctionAddress("NtGetContextThread");  DebugPrint("[DebugMessage] NtGetContextThread: 0x%08X...\r\n", pfn_NtGetContextThread);  pfn_NtQueryInformationThread = (NTQUERYINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtQueryInformationThread");  DebugPrint("[DebugMessage] NtQueryInformationThread: 0x%08X...\r\n", pfn_NtQueryInformationThread);  pfn_NtQueryObject = (NTQUERYOBJECT)SSDT::GetFunctionAddress("NtQueryObject");  DebugPrint("[DebugMessage] NtQueryObject: 0x%08X...\r\n", pfn_NtQueryObject);  pfn_NtSetInformationThread = (NTSETINFORMATIONTHREAD)SSDT::GetFunctionAddress("NtSetInformationThread");  DebugPrint("[DebugMessage] NtSetInformationThread: 0x%08X...\r\n", pfn_NtSetInformationThread);  pfn_NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)SSDT::GetFunctionAddress("NtQuerySystemInformation");  DebugPrint("[DebugMessage] NtQuerySystemInformation: 0x%08X...\r\n", pfn_NtQuerySystemInformation);  pfn_NtOpenProcess = (NTOPENPROCESS)SSDT::GetFunctionAddress("NtOpenProcess");  DebugPrint("[DebugMessage] NtOpenProcess: 0x%08X...\r\n", pfn_NtOpenProcess);  pfn_NtReadVirtualMemory = (NTREADVIRTUALMEMORY)SSDT::GetFunctionAddress("NtReadVirtualMemory");  DebugPrint("[DebugMessage] NtReadVirtualMemory: 0x%08X...\r\n", pfn_NtReadVirtualMemory);  pfn_NtWriteVirtualMemory = (NTWRITEVIRTUALMEMORY)SSDT::GetFunctionAddress("NtWriteVirtualMemory");  DebugPrint("[DebugMessage] NtWriteVirtualMemory: 0x%08X...\r\n", pfn_NtWriteVirtualMemory);  pfn_NtCreateThread = (NTCREATETHREAD)SSDT::GetFunctionAddress("NtCreateThread");  DebugPrint("[DebugMessage] NtCreateThread: 0x%08X...\r\n", pfn_NtCreateThread);  pfn_NtTerminateProcess = (NTTERMINATEPROCESS)SSDT::GetFunctionAddress("NtTerminateProcess");  DebugPrint("[DebugMessage] NtTerminateProcess: 0x%08X...\r\n", pfn_NtTerminateProcess);  // 绕过MmVerifyCallbackFunction。  PLDR_DATA_TABLE_ENTRY64 ldr = (PLDR_DATA_TABLE_ENTRY64)DriverObject->DriverSection;  ldr->Flags |= 0x20;        //安装回调  InstallCallBacks();        //初始化ETW HOOK  if (!NT_SUCCESS(IfhInitialize(SyscallCallBack)))    DebugPrint("[DebugMessage] IfhInitialize() failed...\r\n");  return STATUS_SUCCESS;

其中 

IfhInitialize(SyscallCallBack))

注册后在SyscallCallBack捕获我们的要hook api函数:

void __fastcall SyscallCallBack(_In_ unsigned int SystemCallIndex, _Inout_ void** SystemCallFunction){
       if (*SystemCallFunction == pfn_NtOpenProcess)    *SystemCallFunction = HookNtOpenProcess;  else if (*SystemCallFunction == pfn_NtReadVirtualMemory)    *SystemCallFunction = HookNtReadVirtualMemory;  else if (*SystemCallFunction == pfn_NtWriteVirtualMemory)    *SystemCallFunction = HookNtWriteVirtualMemory;  else if (*SystemCallFunction == pfn_NtCreateThread)    *SystemCallFunction = HookNtCreateThread;  if (*SystemCallFunction == pfn_NtQueryInformationProcess)    *SystemCallFunction = HookNtQueryIn