hook idt

最新推荐文章于 2020-12-19 16:31:48 发布

x313695373

最新推荐文章于 2020-12-19 16:31:48 发布

阅读量1.5k

点赞数

文章标签： hook descriptor struct object string c

本文链接：https://blog.csdn.net/x313695373/article/details/7038496

版权

extern "C"{
#include <ntddk.h>
}
typedef unsigned int DWORD;
typedef unsigned short WORD;
typedef unsigned char BYTE;
#pragma pack(1)
typedef struct{
	WORD IDTLimit;
	DWORD IDTBase;
}IDTR;
typedef struct{
	WORD LowOffset;
	WORD Selector;
	BYTE unused0;
	unsigned char unused1:3;
	unsigned char D:1;
	unsigned char unused2:1;
	unsigned char DPL:2;
	unsigned char P:1;
	WORD HiOffset;
}INTERRUPT_DESCRIPTOR;
#pragma pack()
//HookFunction:该函数需要为naked函数，寄存器需要自己维护
#define MAKEDWORD(Hi, Lo) (((DWORD)Hi<<16) | (DWORD)(Lo))
DWORD HookInterrupt(DWORD Index, DWORD HookFunction)
{
	KdPrint(("Enter HookInterrupt\n"));
	IDTR idtr;
	INTERRUPT_DESCRIPTOR *pEntry;
	DWORD OldFunction;
	__asm sidt idtr;
	pEntry = (INTERRUPT_DESCRIPTOR*)idtr.IDTBase;
	pEntry = &pEntry[Index];
	OldFunction = MAKEDWORD(pEntry[0].HiOffset, pEntry[0].LowOffset);
	__asm{
		mov eax, HookFunction;
		mov ebx, pEntry;
		cli;
		mov [ebx], ax;
		shr eax, 16;
		mov [ebx+6], ax;
		sti;
	}
	KdPrint(("Exit  HookInterrupt\n"));
	return OldFunction;

}


DWORD OriginalFunction;
__declspec(naked) XKiSystemService()
{
	__asm{
		pushad;
		pushfd;
		push fs;
		mov bx, 0x30;
		mov fs, bx;
		push ds;
		push es;
	}
	//c code
	KdPrint(("Suhk\n"));
	__asm{
		pop es;
		pop ds;
		pop fs;
		popfd;
		popad;
		jmp OriginalFunction;
	}
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriObj)
{
	KdPrint(("Enter DriverUnload"));
	HookInterrupt(14, OriginalFunction);
	KdPrint(("Exit  DriverUnload"));
}
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriObj,
		IN PUNICODE_STRING pRegPath)
{
	KdPrint(("Enter DriverEntry\n"));
	pDriObj->DriverUnload = DriverUnload;
	OriginalFunction = HookInterrupt(14, (DWORD)XKiSystemService);
	KdPrint(("Exit  DriverEntry\n"));
	return STATUS_SUCCESS;
}

发现在执行idt里面指定的代码时，irql为0