SSDT HOOK

路灯下的花盆

于 2022-07-19 19:13:02 发布

阅读量187

点赞数

分类专栏： Windows内核文章标签：系统安全安全 windows

本文链接：https://blog.csdn.net/weixin_45678798/article/details/125878847

版权

Windows内核专栏收录该内容

21 篇文章 3 订阅

订阅专栏

ssdt.h

#pragma warning( disable : 4100)
#include<ntddk.h>

typedef struct _SDTItem				//服务表内容
{
	PULONG_PTR base;
	ULONG Count;
	ULONG Limit;
	ULONG Number;
}SDT_TEM,*PSDT_ITEM;
typedef struct _SSDT_TABLE		//服务表
{
	SDT_TEM Servicetable;
}SSDT_TABLE,*PSSDT_TABLE;
typedef struct _MyHook
{
	ULONG Number;					//HOOK服务的编号
	ULONG OldFunAddress;				//HOOK的服务地址
	ULONG NewFunAddress;				//新的地址
	ULONG Success;						//是否被使用
}MYHOOK,*PMYHOOK;

main.c

#include "ssdt.h"
#define MAXNUMBER 50
// 39 NtCreateFile
//用于寻找服务表
extern SSDT_TABLE KeServiceDescriptorTable;						
//HOOK的NtCreateFile函数
NTSTATUS __stdcall MyNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, 
	PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes, 
	ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
//开启HOOK
NTSTATUS SetHook(ULONG Number, ULONG NewAddress);
//关闭写保护
void OffWP();
//开启写保护
void OnWP();

MYHOOK MyHook[MAXNUMBER] = { 0 };

ULONG findfunaddr(ULONG NewFunAddr)
{
	for (int i = 0; i < MAXNUMBER;i++)
	{
		if (MyHook[i].Success == 1)
		{
			if(MyHook[i].NewFunAddress==NewFunAddr)
			{
				return MyHook[i].OldFunAddress;
			}
		}
	}
	return 0;
}
_declspec(naked) void OffWP()
{
	_asm
	{
		cli;
		mov eax, cr0;
		and eax, 0xFFFEFFFF;
		mov cr0, eax;
		ret;
	}
}
_declspec(naked) void OnWP()
{
	_asm
	{
		mov eax, cr0;
		or eax, 0x10000;
		mov cr0, eax;
		sti;
		ret;
	}
}

NTSTATUS __stdcall MyNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
	PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
	ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
{

	NTSTATUS Success=0;
	ULONG funAddress = findfunaddr((ULONG)MyNtCreateFile);			//找到原函数位置
	DbgPrint("NtCreateFile Hook Success!\n ");
	

		_asm {
			push FileHandle
			push DesiredAccess
			push ObjectAttributes
			push IoStatusBlock
			push AllocationSize
			push FileAttributes
			push ShareAccess
			push CreateDisposition
			push CreateOptions
			push EaBuffer
			push EaLength

			call funAddress;

			mov Success, eax;
		}

	
	
	return Success;

}

//传入编号和地址
NTSTATUS SetHook(ULONG Number, ULONG NewAddress)
{
	for (int i = 0;i < MAXNUMBER;i++)
	{
		if (MyHook[i].Success == 0)
		{
			
			MyHook[i].NewFunAddress = NewAddress;			//填入新地址
			MyHook[i].Number = Number;						//填入编号

			MyHook[i].OldFunAddress = *(((PULONG)*(KeServiceDescriptorTable.Servicetable.base)) + Number);			//填入旧地址
			
			MyHook[i].Success = 1;

			OffWP();			//关闭写保护,
			*(((PULONG) * (KeServiceDescriptorTable.Servicetable.base)) + Number) = MyHook[i].NewFunAddress;
			OnWP();				//开启写保护
			return STATUS_SUCCESS;
		}
	}
	return -1;
}
NTSTATUS OffHook(ULONG Number, ULONG NewAddress)
{
	for (int i = 0;i < MAXNUMBER;i++)
	{
		if (MyHook[i].Success == 1)
		{
			if (MyHook[i].NewFunAddress == NewAddress)
			{
				OffWP();
				*(((PULONG) * (KeServiceDescriptorTable.Servicetable.base)) + Number) = MyHook[i].OldFunAddress;
				OnWP();
				MyHook[i].Success = 0;
				return STATUS_SUCCESS;

			}
		}
	}
	return -1;
}
void DriverUnload(PDRIVER_OBJECT DriverObject)
{

	DbgPrint("卸载成功");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Rtl)
{
	SetHook((ULONG)0x25, (ULONG)MyNtCreateFile);
	DriverObject->DriverUnload = DriverUnload;

	return STATUS_SUCCESS;
}