SSDT HOOK的框架

#include <ntddk.h>
#include "HookManager.h"

VOID UnloadDriver(PDRIVER_OBJECT Driver)
{
	KdPrint(("Unload Driver!\n"));
	if (NewSystemCallTable)
	{
		//此处UN_HOOK

		MmUnmapLockedPages(NewSystemCallTable,KernelMode);
		IoFreeMdl(pMyMdl);
	}
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING pRegeditPath)
{
	ULONG MajorVersion;
	ULONG MinorVersion;

	pDriver->DriverUnload = UnloadDriver;

	PsGetVersion(&MajorVersion,&MinorVersion,NULL,NULL);
	if (MajorVersion == 5 && MinorVersion == 2)
	{
		KdPrint(("win2003\n"));
	}
	else if (MajorVersion == 5 && MinorVersion == 1)
	{
		KdPrint(("winXP\n"));
	}
	else if (MajorVersion == 6 && MajorVersion == 0)
	{
		KdPrint(("Win Vista\n"));
	}
	else if (MajorVersion == 6 && MajorVersion == 1)
	{
		KdPrint(("Win 7\n"));
	}
	else
	{
		KdPrint(("Unknown. "));
	}

	if (!NT_SUCCESS(Hook()))
	{
		KdPrint(("Hook fail!\n"));
		return STATUS_UNSUCCESSFUL;
	}

	return STATUS_SUCCESS;
}

#ifndef _HOOK_MANAGER_H_
#define _HOOK_MANAGER_H_

#pragma pack(1)
typedef struct _ServiceDescriptorEntry
{
	unsigned int *ServiceTableBase;
	unsigned int *ServiceCounterTableBase;
	unsigned int NumberOfService;
	unsigned char *ParamTableBase;
}ServiceDescriptorEntry,*PServiceDescriptorEntry;
#pragma pack()

ServiceDescriptorEntry KeServiceDescriptorTable;

extern PVOID *NewSystemCallTable;
extern PMDL pMyMdl;

#define HOOK_INDEX(function2hook) *(PULONG)((PCHAR)function2hook+1)
#define HOOK(functionName,newPointer2Function,oldPointer2Function) oldPointer2Function=(PVOID)InterlockedExchange((PLONG)&NewSystemCallTable[HOOK_INDEX(functionName)],(LONG)newPointer2Function)
#define UN_HOOK(functionName,oldPointer2Function) (InterlockedExchange((PLONG)&NewSystemCallTable[HOOK_INDEX(functionName)],(LONG)oldPointer2Function))

NTSTATUS Hook();

#endif

#include <ntddk.h>
#include "HookManager.h"

NTSTATUS Hook()
{
	pMyMdl = MmCreateMdl(NULL,KeServiceDescriptorTable.ServiceCounterTableBase,KeServiceDescriptorTable.NumberOfService * 4);
	if (!pMyMdl)
	{
		return STATUS_UNSUCCESSFUL;
	}
	MmBuildMdlForNonPagedPool(pMyMdl);
	pMyMdl->MdlFlags = pMyMdl->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
	NewSystemCallTable = MmMapLockedPages(pMyMdl,KernelMode);
	if (!NewSystemCallTable)
	{
		return STATUS_UNSUCCESSFUL;
	}
	//在此处加hook

	return STATUS_SUCCESS;
}