WRK中全部访问DebugPort的函数总汇。

最新推荐文章于 2024-05-18 10:46:19 发布

yeook

最新推荐文章于 2024-05-18 10:46:19 发布

阅读量1.2k

点赞数

知识点专栏收录该内容

23 篇文章 0 订阅

订阅专栏

KiDispatchException        //1处
NtQueryInformationProcess      //1处
PspCreateProcess        //1处
PsGetProcessDebugPort      //1处
PsIsProcessBeingDebugged      //1处
NtTerminateProcess        //1处
PspTerminateProcess      //1处
PspExitThread        //1处
PspProcessDelete        //3处
ObpCloseHandleTableEntry      //1处
ObpCloseHandle        //1处
MmCreatePeb        //1处
DbgkCreateThread        //1处
DbgkExitThread        //1处
DbgkExitProcess        //1处
DbgkMapViewOfSection      //1处
DbgkUnMapViewOfSection      //1处
DbgkpMarkProcessPeb      //1处
DbgkpCloseObject        //3处
DbgkCopyProcessDebugPort      //4处
DbgkOpenProcessDebugPort      //2处
DbgkpQueueMessage        //1处
DbgkClearProcessDebugObject      //2处
DbgkpSetProcessDebugObject      //4处
DbgkForwardException      //1处

对于自己通过偏移定位，清零怎么搞？？调换EPROCESS中DebugPort和CreateTime位置，更改访问DebugPort各函数相关位置的偏移呗。

.386
.model flat, stdcall
option casemap:none

include dnf_hook.inc

.const
Dspdo_1 equ 80643db6h
Dmpp_1 equ 80642d5eh
Dmpp_2 equ 80642d64h
Dct_1 equ 806445d3h
Dqm_1 equ 80643089h
Kde_1 equ 804ff5fdh
Dfe_1 equ 80644340h
Pcp_1 equ 805d1a0dh
Mcp_1 equ 805b0c06h
Mcp_2 equ 805b0d7fh
Dmvos_1 equ 8064497fh
Dumvos_1 equ 80644a45h
Pet_1 equ 805d32f8h
Det_1 equ 8064486ch
Dep_1 equ 806448e6h

.code
;还原自己的Hook
DriverUnload proc pDriverObject:PDRIVER_OBJECT
ret
DriverUnload endp

ModifyFuncAboutDbg proc addrOdFunc, cmd_1, cmd_2
pushad
mov ebx, addrOdFunc
mov eax, cmd_1
mov DWORD ptr [ebx], eax
mov eax, cmd_2
mov DWORD ptr [ebx + 4], eax
popad
ret
ModifyFuncAboutDbg endp

DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
cli
        mov   eax, cr0
        and   eax, not 10000h
        mov   cr0, eax

invoke ModifyFuncAboutDbg, Dspdo_1, 90784789h, 0fde89090h
invoke ModifyFuncAboutDbg, Dmpp_1, 90787e39h, 950f9090h
invoke ModifyFuncAboutDbg, Dct_1, 90785e39h, 840f9090h
invoke ModifyFuncAboutDbg, Dqm_1, 9078408bh, 45899090h
invoke ModifyFuncAboutDbg, Kde_1, 90787839h, 13749090h
invoke ModifyFuncAboutDbg, Dfe_1, 9078418bh, 0d2329090h
invoke ModifyFuncAboutDbg, Pcp_1, 90784389h, 45f69090h
invoke ModifyFuncAboutDbg, Mcp_1, 90785e39h, 950f9090h
invoke ModifyFuncAboutDbg, Mcp_2, 90784a89h, 5e399090h
invoke ModifyFuncAboutDbg, Dmvos_1, 9078498bh, 0cb3b9090h
invoke ModifyFuncAboutDbg, Dumvos_1, 00787983h, 74909090h
invoke ModifyFuncAboutDbg, Pet_1, 00787f83h, 74909090h
invoke ModifyFuncAboutDbg, Det_1, 9078498bh, 0c9859090h
invoke ModifyFuncAboutDbg, Dep_1, 9078498bh, 0c9859090h
;invoke ModifyFuncAboutDbg, Dmpp_2, 8bc0950fh, 8b90c032h

mov eax, pDriverObject
assume   eax : ptr DRIVER_OBJECT
mov   [eax].DriverUnload, offset DriverUnload
assume   eax : nothing

mov eax, cr0
        or eax, 10000h
        mov   cr0, eax
        sti

        mov eax, STATUS_SUCCESS
     ret
DriverEntry endp