驱动相关：过名将三国驱动保护（XP sp2系统下通过）

一个人的舞台

(只限技术交流)

1. 
   
2. (只限技术交流)[code]
   
3.        
   
4. #include<ntddk.h>
   
5. #include<windef.h>
   
6. 
   
7. typedef struct _SERVICE_DESCRIPTOR_TABLE
   
8. {
   
9. unsigned int *ServiceTableBase;
   
10. unsigned int *ServiceCounterTableBase;
    
11. unsigned int NumberTableBase;
    
12. unsigned char *ParamTableBase;
    
13. }SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;
    
14.        
    
15. extern PSERVICE_DESCRIPTOR_TABLEKeServiceDescriptorTable;
    
16.        
    
17. typedef NTSTATUS (*REALZWOPENPROCESS)
    
18.    (
    
19. OUT PHANDLE ProcessHandle,
    
20. IN ACCESS_MASK AccessMask,
    
21. IN POBJECT_ATTRIBUTES ObjectAttributes,
    
22. IN PCLIENT_ID ClientId);
    
23. 
    
24. typedef NTSTATUS (*READVIRTUALMEMORY)(
    
25.      IN HANDLE ProcessHandle,
    
26.      IN PVOID BaseAddress,
    
27.       OUT PVOID Buffer,
    
28.       N ULONG BufferLength,
    
29.      OUT PULONG ReturnLength OPTIONAL);          
    
30. 
    
31. typedef NTSTATUS (*WRITEVIRTUALMEMORY)(
    
32. IN HANDLE ProcessHandle,
    
33. IN PVOID BaseAddress,
    
34. IN PVOID Buffer,
    
35. IN ULONG BufferLength,
    
36. OUT PULONG ReturnLength OPTIONAL
    
37. );
    
38. 
    
39. 
    
40. REALZWOPENPROCESSRealZwOpenProcess;
    
41. READVIRTUALMEMORYRealNtReadVirtualMemory;
    
42. WRITEVIRTUALMEMORY RealNtWriteVirtualMemory;
    
43. //***************************************************************************
    
44. VOID Hook();
    
45. VOID Unhook();
    
46. VOID OnUnload(IN PDRIVER_OBJECT DriverObject);
    
47. NTSTATUS rc;
    
48. //NTSTATUS rc1;
    
49. //NTSTATUS rc2;
    
50. DWORD bix,tiao;
    
51. //////////////////////////////////////
    
52. ULONG JmpAddress;//跳转到NtOpenProcess里的地址  
    
53. ULONG JmpAddress1;
    
54. ULONG JmpAddress2;
    
55. ULONG OldServiceAddress;//原来NtOpenProcess的服务地址  
    
56. ULONG OldServiceAddress1;
    
57. ULONG OldServiceAddress2;
    
58. //////////////////////////////////////
    
59. 
    
60. __declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle,
    
61. ACCESS_MASK DesiredAccess,
    
62. POBJECT_ATTRIBUTES ObjectAttributes,
    
63. PCLIENT_ID ClientId)
    
64. {
    
65. 
    
66. //RealZwOpenProcess=(REALZWOPENPROCESS)OldServiceAddress;
    
67. 
    
68. //rc = (NTSTATUS)(REALZWOPENPROCESS)RealZwOpenProcess( ProcessHandle, DesiredAccess, ObjectAttributes, Client
    
69. Id );
    
70. 
    
71. __asm{
    
72. 
    
73. push0C4h
    
74. push804daab0h//共十个字节  
    
75. mov eax,80538d00h
    
76. call eax
    
77. jmp [JmpAddress]
    
78. }
    
79. }
    
80. 
    
81. __declspec(naked) NTSTATUS __stdcall MyNtReadVirtualMemory(
    
82. IN HANDLE ProcessHandle,
    
83. IN PVOID BaseAddress,
    
84. OUT PVOID Buffer,
    
85. IN ULONG BufferLength,
    
86. OUT PULONG ReturnLength OPTIONAL)  
    
87. {
    
88. 
    
89. //RealNtReadVirtualMemory=(READVIRTUALMEMORY)OldServiceAddress1;
    
90. //rc1 = (NTSTATUS)(READVIRTUALMEMORY)RealNtReadVirtualMemory( ProcessHandle, BaseAddress, Buffer, BufferLength,ReturnLength);
    
91. 
    
92. 
    
93. __asm{
    
94. push1Ch
    
95. push804da4e0h//共十个字节  
    
96. mov eax,80538d00h
    
97. call eax
    
98. jmp [JmpAddress1]
    
99. }
    
100. 
     
101. }
     
102. 
     
103. 
     
104. 
     
105. __declspec(naked) NTSTATUS __stdcall MyNtWriteVirtualMemory(
     
106. IN HANDLE ProcessHandle,
     
107. IN PVOID BaseAddress,
     
108. OUT PVOID Buffer,
     
109. IN ULONG BufferLength,
     
110. OUT PULONG ReturnLength OPTIONAL)
     
111. 
     
112. {
     
113. 
     
114. 
     
115. //RealNtWriteVirtualMemory=(WRITEVIRTUALMEMORY)OldServiceAddress2;
     
116. //rc2=(NTSTATUS)(WRITEVIRTUALMEMORY)RealNtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, BufferLen
     
117. gth,ReturnLength);
     
118. 
     
119. 
     
120. __asm{
     
121. push1Ch
     
122. push804da4f8h//共十个字节  
     
123. mov eax,80538d00h
     
124. call eax
     
125. jmp [JmpAddress2]
     
126. }
     
127.   
     
128. 
     
129. }
     
130. 
     
131. 
     
132. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
     
133. {
     
134. DriverObject->DriverUnload = OnUnload;
     
135. DbgPrint("Unhooker load");
     
136. Hook();
     
137. return STATUS_SUCCESS;
     
138. }
     
139. 
     
140. /////////////////////////////////////////////////////
     
141. VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
     
142. {
     
143. DbgPrint("Unhooker unload!");
     
144. Unhook();
     
145. }
     
146. /////////////////////////////////////////////////////
     
147. 
     
148. VOID Hook()
     
149. {
     
150. ULONG Address;
     
151. ULONG Address1;
     
152. ULONG Address2;
     
153. Address=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;
     
154. Address1=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0ba*4;
     
155. Address2=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;
     
156. DbgPrint("Address:0x%08X",Address);
     
157. DbgPrint("Address1:0x%08X",Address1);
     
158. DbgPrint("Address2:0x%08X",Address2);
     
159. 
     
160. OldServiceAddress=*(ULONG*)Address;
     
161. OldServiceAddress1=*(ULONG*)Address1;
     
162. OldServiceAddress2=*(ULONG*)Address2;
     
163. RealZwOpenProcess=(REALZWOPENPROCESS)OldServiceAddress;
     
164. DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);
     
165. DbgPrint("OldServiceAddress1:0x%08X",OldServiceAddress1);
     
166. DbgPrint("OldServiceAddress2:0x%08X",OldServiceAddress2);
     
167. 
     
168. JmpAddress=OldServiceAddress+15;
     
169. JmpAddress1=OldServiceAddress1+12;
     
170. JmpAddress2=OldServiceAddress2+12;
     
171. //JmpAddress=2153521239;
     
172. DbgPrint("JmpAddress:0x%08X",JmpAddress);
     
173. DbgPrint("JmpAddress1:0x%08X",JmpAddress1);
     
174. DbgPrint("JmpAddress2:0x%08X",JmpAddress2);
     
175. __asm{//去掉内存保护  
     
176. cli
     
177. moveax,cr0
     
178. andeax,not 10000h
     
179. movcr0,eax
     
180. }
     
181. 
     
182. 
     
183. *((ULONG*)Address) = (ULONG)MyNtOpenProcess;//HOOK SSDT
     
184. *((ULONG*)Address1) = (ULONG)MyNtReadVirtualMemory;
     
185. *((ULONG*)Address2) = (ULONG)MyNtWriteVirtualMemory;
     
186. __asm{//恢复内存保护  
     
187. moveax,cr0
     
188. or eax,10000h
     
189. movcr0,eax
     
190. sti
     
191. }
     
192. 
     
193. }
     
194. 
     
195. 
     
196. VOID Unhook()
     
197. {
     
198. ULONGAddress;
     
199. ULONGAddress1;
     
200. ULONGAddress2;
     
201. Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//查找SSDT  
     
202. Address1=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0ba*4;
     
203. Address2=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;
     
204. 
     
205. __asm{
     
206. cli
     
207. moveax,cr0
     
208. andeax,not 10000h
     
209. movcr0,eax
     
210. }
     
211. 
     
212. *((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT  
     
213. *((ULONG*)Address1) = (ULONG)OldServiceAddress1;
     
214. *((ULONG*)Address2) = (ULONG)OldServiceAddress2;
     
215. __asm{
     
216. moveax,cr0
     
217. or eax,10000h
     
218. movcr0,eax
     
219. sti
     
220. }
     
221. 
     
222. DbgPrint("Unhook");
     
223. }
     
224. 
     

复制代码

[/code]