SSDT Hook

最新推荐文章于 2023-07-19 11:13:27 发布

zhuhuibeishadiao

最新推荐文章于 2023-07-19 11:13:27 发布

阅读量3.2k

点赞数

分类专栏：驱动学习文章标签：进程保护 SSDT HOOK 内核

本文链接：https://blog.csdn.net/zhuhuibeishadiao/article/details/51114107

版权

本文介绍了Windows系统中SSDT（System Service Descriptor Table）Hook的技术细节。通过分析Ntdll.dll和Kernel32.dll的API调用流程，展示了如何从Ring3层进入Ring0层，并且讲解了SSDT表的结构。内容包括如何获取Zw函数的索引号，定义宏以获取SSDT中对应函数的地址，以及SSDT Hook的基本思路，包括保存原地址、替换地址和代理函数的实现。此外，还提及了Base Hook的实现和移除HOOK的注意事项，建议使用DeviceIoControl进行卸载。

摘要由CSDN通过智能技术生成

看看大概的调用情况

左边是2000有的,右边是xp后走的

Ntdll.dll 中的 API 是一个简单的包装函数。
当 Kernel32.dll 中的 API 通过 Ntdll.dll 时，会完成参数的检查再调用一个中断(int 2Eh 或者 SysEnter 指令)，从而实现从 Ring3 进入 Ring0 层
并且将所要调用的服务号(也就是在 SSDT 数组中的索引值)存放到寄存器 EAX 中
再根据存放在 EAX 中的索引值来在 SSDT 数组中调用指定的服务即Nt*系列函数

SSDT表结构

结构：
#pragma pack(1)
typedef struct ServiceDescriptorEntry
{
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t,
*PServiceDescriptorTableEntry_t;
#pragma pack()

导入：
__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

我们要获得SSDT下某个函数的地址我们只需要知道那个Zw函数的开头的2-6字节即可

就是获取那个Index 索引号

比如ZwReadFile 0B7就是Index

然后我们搞一个宏吧给一个Zw的地址返回它在SSDT对应函数的地址
引用：
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
#define SDT SYSTEMSERVICE

SSDT HOOK 思路：

找到函数地址---保存原地址--替换地址当然代理函数要与原始函数一致

typedef NTSTATUS (*ZWCREATESECTION)(
  	OUT PHANDLE            		SectionHandle,
  	IN ULONG                		DesiredAccess,
  	IN POBJECT_ATTRIBUTES  	ObjectAttributes OPTIONAL,
  	IN PLARGE_INTEGER     	 MaximumSize OPTIONAL,
          IN ULONG                		PageAttributess,
  	IN ULONG                		SectionAttributes,
 	IN HANDLE              		FileHandle OPTIONAL );

static ZWCREATESECTION            OldZwCreateSection;

NTSTATUS NTAPI HOOK_NtCreateSection(PHANDLE SectionHandle,
				  ACCESS_MASK DesiredAccess,
				  POBJECT_ATTRIBUTES ObjectAttributes,
				  PLARGE_INTEGER SectionSize,
				  ULONG Protect,
				  ULONG Attributes,
				  HANDLE FileHandle) 
{
	return OldZwCreateSection(SectionHandle,
				  DesiredAccess,
				  ObjectAttributes,
				  SectionSize,
				  Protect,
				  Attributes,
				  FileHandle);
}

开始HOOK

void StartHook (void)
{
    //获取未导出的服务函数索引号
    
    __asm
    {
        push    eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    
    OldZwCreateSection                = 
        (ZWCREATESECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateSection),//必须是ZwCreateSection，而不能是NtCreateSection
                                                        (LONG)HOOK_NtCreateSection);
    
    //关闭
    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    return ;
}

移除HOOK 这部很容易蓝屏建议还是使用DeviceIControl进行卸载 (写一个恢复函数然后通过下发请求调用)

void StartHook (void)
{
    //获取未导出的服务函数索引号
    
    __asm
    {
        push    eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    
    OldZwCreateSection                = 
        (ZWCREATESECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateSection),//必须是ZwCreateSection，而不能是NtCreateSection
                                                        (LONG)HOOK_NtCreateSection);
    
    //关闭
    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    return ;
}

查看HOOK的SSDT


x nt!kes*des*table*
dd addr
dds addr L length

Base Hook 实现大量的HOOK 但没有实际拦截:

#include <ntddk.h>
#include <ntimage.h>

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport)  ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
#define SDT     SYSTEMSERVICE
#define KSDT KeServiceDescriptorTable

//---------------------------------------------------------------------------
//
// Defines
// 
//---------------------------------------------------------------------------

#define FILE_DEVICE_UNKNOWN            0x00000022
#define IOCTL_UNKNOWN_BASE              FILE_DEVICE_UNKNOWN
#define IOCTL_INIT                       CTL_CODE(IOCTL_UNKNOWN_BASE, 0x0800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/********************************************************************************

    补充定义数据及结构

********************************************************************************/

typedef struct _INITIAL_TEB {
  PVOID                StackBase;
  PVOID                StackLimit;
  PVOID                StackCommit;
  PVOID                StackCommitMax;
  PVOID                StackReserved;
} INITIAL_TEB, *PINITIAL_TEB;

typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemNotImplemented1,
    SystemProcessesAndThreadsInformation,
    SystemCallCounts,
    SystemConfigurationInformation,
    SystemProcessorTimes,
    SystemGlobalFlag,
    SystemNotImplemented2,
    SystemModuleInformation,
    SystemLockInformation,
    SystemNotImplemented3,
    SystemNotImplemented4,
    SystemNotImplemented5,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPagefileInformation,
    SystemInstructionEmulationCounts,
    SystemInvalidInfoClass1,
    SystemCacheInformation,
    SystemPoolTagInformation,
    SystemProcessorStatistics,
    SystemDpcInformation,
    SystemNotImplemented6,
    SystemLoadImage,
    SystemUnloadImage,
    SystemTimeAdjustment,
    SystemNotImplemented7,
    SystemNotImplemented8,
    SystemNotImplemented9,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemLoadAndCallImage,
    SystemPrioritySeparation,
    SystemNotImplemented10,
    SystemNotImplemented11,
    SystemInvalidInfoClass2,
    SystemInvalidInfoClass3,
    SystemTimeZoneInformation,
    SystemLookasideInformation,
    SystemSetTimeSlipEvent,
    SystemCreateSession,
    SystemDeleteSession,
    SystemInvalidInfoClass4,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemAddVerifier,
    SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG            ProcessId;
    UCHAR            ObjectTypeNumber;
    UCHAR            Flags;
    USHORT          Handle;
    PVOID            Object;
    ACCESS_MASK      GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

/*************************************************************************************************

     私有变量

*************************************************************************************************/

typedef struct _DEVICE_EXTENSION
{
    PDEVICE_OBJECT DeviceObject;
    PKEVENT Event;

    BOOLEAN bPCreate;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;


//    全局设备对象
PDEVICE_OBJECT g_pDeviceObject;

UNICODE_STRING g_RegPath;

/********************************************************************************

    补充定义函数

********************************************************************************/

NTKERNELAPI NTSTATUS ObQueryNameString (
    IN PVOID                        Object,
    IN OUT PUNICODE_STRING            Name,
    IN ULONG                        MaximumLength,
    OUT PULONG                      ActualLength
);

NTKERNELAPI NTSTATUS ZwSetSecurityObject(
    IN HANDLE Handle,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR SecurityDescriptor
    );

NTKERNELAPI NTSTATUS ZwTerminateProcess(
  IN HANDLE              ProcessHandle OPTIONAL,
  IN NTSTATUS            ExitStatus );

NTKERNELAPI NTSTATUS ZwOpenProcess(
  OUT PHANDLE            ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTKERNELAPI NTSTATUS ZwOpenThread(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTKERNELAPI NTSTATUS ZwLoadDriver(
  IN PUNICODE_STRING DriverServiceName );

NTKERNELAPI NTSTATUS ZwSetSystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength );

NTKERNELAPI NTSTATUS ZwQuerySystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );


/***********************************************************************************

    函数声明

***********************************************************************************/

NTSTATUS DriverEntry(
  IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
void UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchIoCtrl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);

void StartHook(void);
void RemoveHook(void);


NTSTATUS Hook_ZwWriteFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

NTSTATUS Hook_ZwReadFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID              Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

NTSTATUS Hook_ZwSetSystemInformation