extern "C"{
#include <ntddk.h>
}
typedef unsigned int DWORD;
typedef unsigned short WORD;
typedef unsigned char BYTE;
#pragma pack(1)
typedef struct{
WORD IDTLimit;
DWORD IDTBase;
}IDTR;
typedef struct{
WORD LowOffset;
WORD Selector;
BYTE unused0;
unsigned char unused1:3;
unsigned char D:1;
unsigned char unused2:1;
unsigned char DPL:2;
unsigned char P:1;
WORD HiOffset;
}INTERRUPT_DESCRIPTOR;
#pragma pack()
//HookFunction:该函数需要为naked函数,寄存器需要自己维护
#define MAKEDWORD(Hi, Lo) (((DWORD)Hi<<16) | (DWORD)(Lo))
DWORD HookInterrupt(DWORD Index, DWORD HookFunction)
{
KdPrint(("Enter HookInterrupt\n"));
IDTR idtr;
INTERRUPT_DESCRIPTOR *pEntry;
DWORD OldFunction;
__asm sidt idtr;
pEntry = (INTERRUPT_DESCRIPTOR*)idtr.IDTBase;
pEntry = &pEntry[Index];
OldFunction = MAKEDWORD(pEntry[0].HiOffset, pEntry[0].LowOffset);
__asm{
mov eax, HookFunction;
mov ebx, pEntry;
cli;
mov [ebx], ax;
shr eax, 16;
mov [ebx+6], ax;
sti;
}
KdPrint(("Exit HookInterrupt\n"));
return OldFunction;
}
DWORD OriginalFunction;
__declspec(naked) XKiSystemService()
{
__asm{
pushad;
pushfd;
push fs;
mov bx, 0x30;
mov fs, bx;
push ds;
push es;
}
//c code
KdPrint(("Suhk\n"));
__asm{
pop es;
pop ds;
pop fs;
popfd;
popad;
jmp OriginalFunction;
}
}
VOID DriverUnload(IN PDRIVER_OBJECT pDriObj)
{
KdPrint(("Enter DriverUnload"));
HookInterrupt(14, OriginalFunction);
KdPrint(("Exit DriverUnload"));
}
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriObj,
IN PUNICODE_STRING pRegPath)
{
KdPrint(("Enter DriverEntry\n"));
pDriObj->DriverUnload = DriverUnload;
OriginalFunction = HookInterrupt(14, (DWORD)XKiSystemService);
KdPrint(("Exit DriverEntry\n"));
return STATUS_SUCCESS;
}
发现在执行idt里面指定的代码时,irql为0
hook idt
最新推荐文章于 2020-12-19 16:31:48 发布