通用ssdt hook的详解以及代码的编写

forwe

Driver.h

1. #ifdef __cplusplus
   
2. extern "C"
   
3. {
   
4. #endif
   
5. #include <ntddk.h>
   
6. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
   
7. 
   
8. #ifdef __cplusplus
   
9. }
   
10. #endif
    
11. 
    
12. #define PAGEDCODE code_seg("PAGE")
    
13. #define LOCKEDCODE code_seg()
    
14. #define INITCODE code_seg("INIT")
    
15. 
    
16. #define PAGEDDATA data_seg("PAGE")
    
17. #define LOCKEDDATA data_seg()
    
18. #define INITDATA data_seg("INIT")
    
19. 
    
20. #define arraysize(p) (sizeof(p)/sizeof((p)[0]))
    
21. 
    
22. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);
    
23. 
    
24. #pragma pack(1)
    
25. typedef struct ServiceDescriptorEntry {
    
26.         unsigned int *ServiceTableBase;
    
27.         unsigned int *ServiceCounterTableBase; //仅适用于checked build版本
    
28.         unsigned int NumberOfServices;
    
29.         unsigned char *ParamTableBase;
    
30. } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
    
31. #pragma pack()
    
32. 
    
33. extern "C" PServiceDescriptorTableEntry_t KeServiceDescriptorTable;
    
34. 
    
35. ULONG GetSDDTAddr(ULONG uIndex);
    
36. BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr);
    
37. BOOLEAN UnHookSSDT(ULONG uIndex, ULONG uOldAddr);
    
38. NTSTATUS MyNtCreateFile (
    
39.     __out PHANDLE FileHandle,
    
40.     __in ACCESS_MASK DesiredAccess,
    
41.     __in POBJECT_ATTRIBUTES ObjectAttributes,
    
42.     __out PIO_STATUS_BLOCK IoStatusBlock,
    
43.     __in_opt PLARGE_INTEGER AllocationSize,
    
44.     __in ULONG FileAttributes,
    
45.     __in ULONG ShareAccess,
    
46.     __in ULONG CreateDisposition,
    
47.     __in ULONG CreateOptions,
    
48.     __in_bcount_opt(EaLength) PVOID EaBuffer,
    
49.     __in ULONG EaLength);
    
50. 
    
51. typedef NTSTATUS (*PFNNtCreateFile) (
    
52.     __out PHANDLE FileHandle,
    
53.     __in ACCESS_MASK DesiredAccess,
    
54.     __in POBJECT_ATTRIBUTES ObjectAttributes,
    
55.     __out PIO_STATUS_BLOCK IoStatusBlock,
    
56.     __in_opt PLARGE_INTEGER AllocationSize,
    
57.     __in ULONG FileAttributes,
    
58.     __in ULONG ShareAccess,
    
59.     __in ULONG CreateDisposition,
    
60.     __in ULONG CreateOptions,
    
61.     __in_bcount_opt(EaLength) PVOID EaBuffer,
    
62.     __in ULONG EaLength);

复制代码

Driver.cpp

1. #include "Driver.h"
   
2. 
   
3. PFNNtCreateFile g_pfnNtCreateFile = NULL;
   
4. 
   
5. void PageProtectOn()
   
6. {
   
7.         //恢复内存保护
   
8.         __asm
   
9.         {
   
10.                 mov eax, cr0
    
11.                 or eax, 10000h
    
12.                 mov cr0, eax
    
13.                 sti
    
14.         }
    
15. }
    
16. 
    
17. void PageProtectOff()
    
18. {
    
19.         //去掉内存保护
    
20.         __asm
    
21.         {
    
22.                 cli
    
23.                 mov eax, cr0
    
24.                 and eax, not 10000h
    
25.                 mov cr0, eax
    
26.         }
    
27. }
    
28. 
    
29. NTSTATUS MyNtCreateFile (
    
30.     __out PHANDLE FileHandle,
    
31.     __in ACCESS_MASK DesiredAccess,
    
32.     __in POBJECT_ATTRIBUTES ObjectAttributes,
    
33.     __out PIO_STATUS_BLOCK IoStatusBlock,
    
34.     __in_opt PLARGE_INTEGER AllocationSize,
    
35.     __in ULONG FileAttributes,
    
36.     __in ULONG ShareAccess,
    
37.     __in ULONG CreateDisposition,
    
38.     __in ULONG CreateOptions,
    
39.     __in_bcount_opt(EaLength) PVOID EaBuffer,
    
40.     __in ULONG EaLength
    
41.     )
    
42. {
    
43.         if (ObjectAttributes && ObjectAttributes->ObjectName)
    
44.         {
    
45.                 if (wcsstr(ObjectAttributes->ObjectName->Buffer, L"1.txt"))
    
46.                 {
    
47.                         KdPrint(("NtCreateFile %wZ\n", ObjectAttributes->ObjectName));
    
48.                         return STATUS_UNSUCCESSFUL;
    
49.                 }
    
50.         }
    
51. 
    
52.         return g_pfnNtCreateFile(
    
53.                 FileHandle,
    
54.                 DesiredAccess,
    
55.                 ObjectAttributes,
    
56.                 IoStatusBlock,
    
57.                 AllocationSize,
    
58.                 FileAttributes,
    
59.                 ShareAccess,
    
60.                 CreateDisposition,
    
61.                 CreateOptions,
    
62.                 EaBuffer,
    
63.                 EaLength);
    
64. }
    
65. 
    
66. 
    
67. 
    
68. #pragma PAGEDCODE
    
69. ULONG GetSDDTAddr(ULONG uIndex)
    
70. {
    
71.         //ULONG u_index;
    
72. 
    
73.         //for (u_index = 0; u_index < KeServiceDescriptorTable->NumberOfServices; u_index++)
    
74.         //{
    
75.         //        KdPrint(("ServiceTableBase[%d]:%X\n", u_index, KeServiceDescriptorTable->ServiceTableBase[u_index]));
    
76.         //}
    
77. 
    
78.         ULONG uAddr = (ULONG)KeServiceDescriptorTable->ServiceTableBase[uIndex];
    
79. 
    
80.         return uAddr;
    
81. }
    
82. 
    
83. 
    
84. BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr)
    
85. {
    
86.         if (uNewAddr == 0)
    
87.         {
    
88.                 return FALSE;
    
89.         }
    
90.        
    
91.         PageProtectOff();
    
92.         KeServiceDescriptorTable->ServiceTableBase[uIndex] = uNewAddr;
    
93.         PageProtectOn();
    
94. 
    
95.         return TRUE;
    
96. }
    
97. 
    
98. 
    
99. BOOLEAN UnHookSSDT(ULONG uIndex, ULONG uOldAddr)
    
100. {
     
101.         if (uOldAddr == 0)
     
102.         {
     
103.                 return FALSE;
     
104.         }
     
105.        
     
106.         PageProtectOff();
     
107.         KeServiceDescriptorTable->ServiceTableBase[uIndex] = uOldAddr;
     
108.         PageProtectOn();
     
109. 
     
110.         return TRUE;
     
111. }
     
112. 
     
113. #pragma INITCODE
     
114. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
     
115. {
     
116.   NTSTATUS status = STATUS_SUCCESS;
     
117. 
     
118.   ULONG uAddr = GetSDDTAddr(37);
     
119.   if (uAddr)
     
120.   {
     
121.           g_pfnNtCreateFile = (PFNNtCreateFile)uAddr;
     
122.           KdPrint(("NtCreateFile: 0x%08X\n", uAddr));
     
123.           HookSSDT(37, (ULONG)MyNtCreateFile);
     
124.   }
     
125. 
     
126.   DriverObject->DriverUnload = DriverUnload;
     
127.   return status;
     
128. }
     
129. 
     
130. #pragma PAGEDCODE
     
131. VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
     
132. {
     
133.   
     
134.   UnHookSSDT(37, (ULONG)g_pfnNtCreateFile);
     
135.   KdPrint(("DriverEntry unLoading...\n"));
     
136.   
     
137. }

复制代码