勘误 win7x64下对OpenProcedure的ObjectHook

最新推荐文章于 2023-06-11 20:41:35 发布

zhuhuibeishadiao

最新推荐文章于 2023-06-11 20:41:35 发布

阅读量2.7k

点赞数

分类专栏：驱动学习杂谈文章标签： ObjectHook x64 ObjectHook 进程保护

本文链接：https://blog.csdn.net/zhuhuibeishadiao/article/details/51627912

版权

驱动学习同时被 2 个专栏收录

94 篇文章 24 订阅

订阅专栏

杂谈

42 篇文章 1 订阅

订阅专栏

那个时候刚接触ObjectHook

我对进程对象下的OpenProcedure进行HOOK 保护程序

OBJECT_TYPE->OBJECT_TYPE_INITIALIZER ->OpenProcedure

帖子发在了看雪

http://bbs.pediy.com/showthread.php?t=203767

那个时候理解错了应该rsp+28h 我是除了8 = 5 要在4个寄存器一共是9个参数

那天写完测试后没有蓝屏,就放下了

前几天,我给学校弄教学程序保护的时候用了此方法,

发现蓝屏了,于是回来看了看

才发现自己SB了

这个OpenProcedure历程的参数就是5个(IDA解析是5个)(但符号解析工具是6个)

IDA解析:

signed __int64 __fastcall PspProcessOpen(__int64 a1, char a2, __int64 a3, __int64 a4, __int64 a5)

符号解析

typedef LONG32 (NEAR CDECL FUNCT_005B_0FC1_OpenProcedure) (enum _OB_OPEN_REASON, CHAR, UINT64 /*struct _EPROCESS**/, UINT64 /*VOID**/, UINT64 /*ULONG32**/, ULONG32);

typedef enum _OB_OPEN_REASON  // 5 elements, 0x4 bytes
{
    ObCreateHandle    = 0 /*0x0*/,
    ObOpenHandle      = 1 /*0x1*/,
    ObDuplicateHandle = 2 /*0x2*/,
    ObInheritHandle   = 3 /*0x3*/,
    ObMaxOpenReason   = 4 /*0x4*/
}OB_OPEN_REASON, *POB_OPEN_REASON;

保险期限,我使用了6个参数进行HOOK

代码如下:

代码有很多不严谨的地方,我是测试写的,如果需要应用到真正的软件中,请务必严谨一些

strstr是很危险的,当如很多时候不是判断文件名,Hook的时候请使用安全的hook方式,否则一定几率蓝屏,最好使用原子操作

#include "ntifs.h"


typedef LONG32 (*PSPPROCESSOPEN) (__int64 a1, CHAR a2, UINT64 eprocess/*struct _EPROCESS**/, UINT64 tagEprocess/*VOID**/, UINT64 a5 /*ULONG32**/, ULONG32 a6);

PSPPROCESSOPEN g_org_pspopenprocess = NULL;

NTSTATUS MyPspProcessOpen(__int64 a1, char a2, UINT64 eprocess, UINT64 tagEprocss, UINT64 a5,ULONG32 a6)
{
	if(strstr((char*)tagEprocss+0x2e0,"haha.exe")!=0)
	{
		if(strstr((char*)eprocess+0x2e0,"explorer.exe")!=0 ||
			strstr((char*)eprocess+0x2e0,"csrss.exe")!=0 ||
			strstr((char*)eprocess+0x2e0,"System")!=0 ||
			strstr((char*)eprocess+0x2e0,"svchost.exe")!=0)//过滤explorer.exe
		{
			if(g_org_pspopenprocess)
				return g_org_pspopenprocess(a1,a2,eprocess,tagEprocss,a5,a6);
			else
				return STATUS_SUCCESS;
		}
		DbgPrint("%s OpenProcess %s\n",(char*)eprocess+0x2e0,(char*)tagEprocss+0x2e0);
		return STATUS_UNSUCCESSFUL;
	}
	
	if(g_org_pspopenprocess)
		return g_org_pspopenprocess(a1,a2,eprocess,tagEprocss,a5,a6);
	else
		return STATUS_SUCCESS;
}


void SetObjectHook()
{
	g_org_pspopenprocess = (PSPPROCESSOPEN)*(ULONG_PTR*)((ULONG_PTR)*PsProcessType + 0x78);
	*(ULONG_PTR*)((ULONG_PTR)*PsProcessType + 0x78) = (ULONG_PTR)MyPspProcessOpen;
	if(g_org_pspopenprocess == NULL)
		DbgPrint("PspProcessOpen is NULL!\n");
}

void ResObjectHook()
{
	if(g_org_pspopenprocess)
		*(ULONG_PTR*)((ULONG_PTR)*PsProcessType+0x78) = (ULONG_PTR)g_org_pspopenprocess;
}

void DriverUnLoad(PDRIVER_OBJECT pDriverObject)
{
	ResObjectHook();
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING usRegistPath)
{
	SetObjectHook();
	pDriverObject->DriverUnload = DriverUnLoad;
	return STATUS_SUCCESS;
}

效果跟看雪上的一致

线程思路一致