Object Hook的讲解，为了后续的HP保护做准备

forwe

Driver.h

1. #ifdef __cplusplus
   
2. extern "C"
   
3. {
   
4. #endif
   
5. #include <ntddk.h>
   
6. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
   
7. 
   
8. #ifdef __cplusplus
   
9. }
   
10. #endif
    
11. 
    
12. #define PAGEDCODE code_seg("PAGE")
    
13. #define LOCKEDCODE code_seg()
    
14. #define INITCODE code_seg("INIT")
    
15. 
    
16. #define PAGEDDATA data_seg("PAGE")
    
17. #define LOCKEDDATA data_seg()
    
18. #define INITDATA data_seg("INIT")
    
19. 
    
20. #define arraysize(p) (sizeof(p)/sizeof((p)[0]))
    
21. 
    
22. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);
    
23. 
    
24. typedef NTSTATUS (*OB_SECURITY_METHOD)(
    
25.     IN PVOID Object,
    
26.     IN SECURITY_OPERATION_CODE OperationCode,
    
27.     IN PSECURITY_INFORMATION SecurityInformation,
    
28.     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
    
29.     IN OUT PULONG CapturedLength,
    
30.     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
    
31.     IN POOL_TYPE PoolType,
    
32.     IN PGENERIC_MAPPING GenericMapping,
    
33.         IN PVOID unknown
    
34.     );
    
35. 
    
36. 
    
37. typedef struct _OBJECT_CREATE_INFORMATION {
    
38.         ULONG Attributes;
    
39.         HANDLE RootDirectory;
    
40.         PVOID ParseContext;
    
41.         KPROCESSOR_MODE ProbeMode;
    
42.         ULONG PagedPoolCharge;
    
43.         ULONG NonPagedPoolCharge;
    
44.         ULONG SecurityDescriptorCharge;
    
45.         PSECURITY_DESCRIPTOR SecurityDescriptor;
    
46.         PSECURITY_QUALITY_OF_SERVICE SecurityQos;
    
47.         SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
    
48. } OBJECT_CREATE_INFORMATION;
    
49. 
    
50. typedef struct _OBJECT_CREATE_INFORMATION *POBJECT_CREATE_INFORMATION;;
    
51. 
    
52. typedef struct _OBJECT_HEADER {
    
53.         LONG_PTR PointerCount;
    
54.         union {
    
55.                 LONG_PTR HandleCount;
    
56.                 PVOID NextToFree;
    
57.         };
    
58.         POBJECT_TYPE Type;
    
59.         UCHAR NameInfoOffset;
    
60.         UCHAR HandleInfoOffset;
    
61.         UCHAR QuotaInfoOffset;
    
62.         UCHAR Flags;
    
63. 
    
64.         union {
    
65.                 POBJECT_CREATE_INFORMATION ObjectCreateInfo;
    
66.                 PVOID QuotaBlockCharged;
    
67.         };
    
68. 
    
69.         PSECURITY_DESCRIPTOR SecurityDescriptor;
    
70.         QUAD Body;
    
71. } OBJECT_HEADER, *POBJECT_HEADER;
    
72. 
    
73. #define OBJECT_TO_OBJECT_HEADER( o ) \
    
74.         CONTAINING_RECORD( (o), OBJECT_HEADER, Body )
    
75. 
    
76. 
    
77. 
    
78. EXTERN_C NTKERNELAPI UCHAR * PsGetProcessImageFileName(
    
79.      __in PEPROCESS Process
    
80.      );
    
81. 
    
82. void HandleObjectHook(BOOLEAN bHook);

复制代码

Driver.cpp

1. #include "Driver.h"
   
2. 
   
3. 
   
4. OB_SECURITY_METHOD g_pfnSecurityProcedure;
   
5. 
   
6. void PageProtectOn()
   
7. {
   
8.         //恢复内存保护
   
9.         __asm
   
10.         {
    
11.                 mov eax, cr0
    
12.                 or eax, 10000h
    
13.                 mov cr0, eax
    
14.                 sti
    
15.         }
    
16. }
    
17. 
    
18. void PageProtectOff()
    
19. {
    
20.         //去掉内存保护
    
21.         __asm
    
22.         {
    
23.                 cli
    
24.                 mov eax, cr0
    
25.                 and eax, not 10000h
    
26.                 mov cr0, eax
    
27.         }
    
28. }
    
29. 
    
30. NTSTATUS MySecurityProcedure(
    
31.     IN PVOID Object,
    
32.     IN SECURITY_OPERATION_CODE OperationCode,
    
33.     IN PSECURITY_INFORMATION SecurityInformation,
    
34.     IN OUT PSECURITY_DESCRIPTOR SecurityDescriptor,
    
35.     IN OUT PULONG CapturedLength,
    
36.     IN OUT PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor,
    
37.     IN POOL_TYPE PoolType,
    
38.     IN PGENERIC_MAPPING GenericMapping,
    
39.         IN PVOID unknown
    
40.     )
    
41. {
    
42. 
    
43.         KdPrint(("Current Eprocess: 0x%08x Object:0x%08x\n", IoGetCurrentProcess(), Object));
    
44. 
    
45.         PUCHAR pTargetName = PsGetProcessImageFileName((PEPROCESS)Object);
    
46.         if (_stricmp((const char *)pTargetName, "calc.exe") == 0)
    
47.         {
    
48.                 return STATUS_INVALID_PARAMETER;
    
49.         }
    
50. 
    
51.         return g_pfnSecurityProcedure(
    
52.                 Object,
    
53.                 OperationCode,
    
54.                 SecurityInformation,
    
55.                 SecurityDescriptor,
    
56.                 CapturedLength,
    
57.                 ObjectsSecurityDescriptor,
    
58.                 PoolType,
    
59.                 GenericMapping,
    
60.                 unknown);
    
61. }
    
62. 
    
63. void HandleObjectHook(BOOLEAN bHook)
    
64. {
    
65. 
    
66.         PVOID pTypeInfo = (PVOID)((ULONG)*PsProcessType + 0x60);
    
67. 
    
68.         if (bHook)
    
69.         {
    
70.                 g_pfnSecurityProcedure = (OB_SECURITY_METHOD)*(PULONG)((ULONG)pTypeInfo + 0x40);
    
71.                 *(PULONG)((ULONG)pTypeInfo + 0x40) = (ULONG)MySecurityProcedure;
    
72.         }
    
73.         else
    
74.         {
    
75.                 *(PULONG)((ULONG)pTypeInfo + 0x40) = (ULONG)g_pfnSecurityProcedure;
    
76.         }
    
77. }
    
78. 
    
79. 
    
80. #pragma INITCODE
    
81. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
    
82. {
    
83.   NTSTATUS status = STATUS_SUCCESS;
    
84. 
    
85.   HandleObjectHook(TRUE);
    
86.   DriverObject->DriverUnload = DriverUnload;
    
87.   return status;
    
88. }
    
89. 
    
90. #pragma PAGEDCODE
    
91. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
    
92. {
    
93.   
    
94.   HandleObjectHook(FALSE);
    
95.   KdPrint(("DriverEntry unLoading...\n"));
    
96.   
    
97. }

复制代码