ssdt.h
#pragma warning( disable : 4100)
#include<ntddk.h>
typedef struct _SDTItem //服务表内容
{
PULONG_PTR base;
ULONG Count;
ULONG Limit;
ULONG Number;
}SDT_TEM,*PSDT_ITEM;
typedef struct _SSDT_TABLE //服务表
{
SDT_TEM Servicetable;
}SSDT_TABLE,*PSSDT_TABLE;
typedef struct _MyHook
{
ULONG Number; //HOOK服务的编号
ULONG OldFunAddress; //HOOK的服务地址
ULONG NewFunAddress; //新的地址
ULONG Success; //是否被使用
}MYHOOK,*PMYHOOK;
main.c
#include "ssdt.h"
#define MAXNUMBER 50
// 39 NtCreateFile
//用于寻找服务表
extern SSDT_TABLE KeServiceDescriptorTable;
//HOOK的NtCreateFile函数
NTSTATUS __stdcall MyNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength);
//开启HOOK
NTSTATUS SetHook(ULONG Number, ULONG NewAddress);
//关闭写保护
void OffWP();
//开启写保护
void OnWP();
MYHOOK MyHook[MAXNUMBER] = { 0 };
ULONG findfunaddr(ULONG NewFunAddr)
{
for (int i = 0; i < MAXNUMBER;i++)
{
if (MyHook[i].Success == 1)
{
if(MyHook[i].NewFunAddress==NewFunAddr)
{
return MyHook[i].OldFunAddress;
}
}
}
return 0;
}
_declspec(naked) void OffWP()
{
_asm
{
cli;
mov eax, cr0;
and eax, 0xFFFEFFFF;
mov cr0, eax;
ret;
}
}
_declspec(naked) void OnWP()
{
_asm
{
mov eax, cr0;
or eax, 0x10000;
mov cr0, eax;
sti;
ret;
}
}
NTSTATUS __stdcall MyNtCreateFile(PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock, PLARGE_INTEGER AllocationSize, ULONG FileAttributes,
ULONG ShareAccess, ULONG CreateDisposition, ULONG CreateOptions, PVOID EaBuffer, ULONG EaLength)
{
NTSTATUS Success=0;
ULONG funAddress = findfunaddr((ULONG)MyNtCreateFile); //找到原函数位置
DbgPrint("NtCreateFile Hook Success!\n ");
_asm {
push FileHandle
push DesiredAccess
push ObjectAttributes
push IoStatusBlock
push AllocationSize
push FileAttributes
push ShareAccess
push CreateDisposition
push CreateOptions
push EaBuffer
push EaLength
call funAddress;
mov Success, eax;
}
return Success;
}
//传入编号和地址
NTSTATUS SetHook(ULONG Number, ULONG NewAddress)
{
for (int i = 0;i < MAXNUMBER;i++)
{
if (MyHook[i].Success == 0)
{
MyHook[i].NewFunAddress = NewAddress; //填入新地址
MyHook[i].Number = Number; //填入编号
MyHook[i].OldFunAddress = *(((PULONG)*(KeServiceDescriptorTable.Servicetable.base)) + Number); //填入旧地址
MyHook[i].Success = 1;
OffWP(); //关闭写保护,
*(((PULONG) * (KeServiceDescriptorTable.Servicetable.base)) + Number) = MyHook[i].NewFunAddress;
OnWP(); //开启写保护
return STATUS_SUCCESS;
}
}
return -1;
}
NTSTATUS OffHook(ULONG Number, ULONG NewAddress)
{
for (int i = 0;i < MAXNUMBER;i++)
{
if (MyHook[i].Success == 1)
{
if (MyHook[i].NewFunAddress == NewAddress)
{
OffWP();
*(((PULONG) * (KeServiceDescriptorTable.Servicetable.base)) + Number) = MyHook[i].OldFunAddress;
OnWP();
MyHook[i].Success = 0;
return STATUS_SUCCESS;
}
}
}
return -1;
}
void DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("卸载成功");
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING Rtl)
{
SetHook((ULONG)0x25, (ULONG)MyNtCreateFile);
DriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}