使用自旋锁的各种HOOK

#include

#define MEM_TAG 'TMEM'

typedef struct _THREAD_BASIC_INFORMA TION

{

NTSTATUS ExitStatus;

PVOID TebBaseAddress;

CLIENT_ID ClientId;

KAFFINITY AffinityMask;

KPRIORITY Priority;

KPRIORITY BasePriority;

}THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMA TION; typedef BOOL (*NTUSERPOSTTHREADMESSAGE)

(

DWORD idThread,

UINT Msg,

WPARAM wParam,

LPARAM lParam

);

typedef NTSTATUS (*NTOPENPROCESS)

(

OUT PHANDLE ProcessHandle,

IN ACCESS_MASK AccessMask,

IN POBJECT_A TTRIBUTES ObjectAttributes,

IN PCLIENT_ID ClientId

);

typedef NTSTATUS (*NTOPENTHREAD)

(

OUT PHANDLE ThreadHandle,

IN ACCESS_MASK DesiredAccess,

IN POBJECT_A TTRIBUTES ObjectAttributes,

IN PCLIENT_ID ClientId

);

typedef NTSTATUS (*NTDUPLICATEOBJECT)

(

IN HANDLE SourceProcessHandle,

IN HANDLE SourceHandle,

IN HANDLE TargetProcessHandle,

OUT PHANDLE TargetHandle OPTIONAL,

IN ACCESS_MASK DesiredAccess,

IN ULONG Attributes,

IN ULONG Options

);

NTKERNELAPI KeAddSystemServiceTable(PVOID, PVOID, PVOID, PVOID, PVOID); NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(IN HANDLE ProcessId,OUT PEPROCESS *Process);

NTKERNELAPI NTSTATUS PsLookupThreadByThreadId(IN HANDLE ThreadId,OUT PETHREAD *Thread);

NTKERNELAPI PEPROCESS IoThreadToProcess(IN PETHREAD Thread);

NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess

(

IN HANDLE ProcessHandle,

IN ULONG ProcessInformationClass,

OUT PVOID ProcessInformation,

IN ULONG ProcessInformationLength,

OUT PULONG ReturnLength OPTIONAL

);

NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread

(

IN HANDLE ThreadHandle,

IN ULONG ThreadInformationClass,

OUT PVOID ThreadInformation,

IN ULONG ThreadInformationLength,

OUT PULONG ReturnLength OPTIONAL

);

ULONG idPTM=476; //XP HARD CODE

BYTE JmpCode[5]={0xE9,0x00,0x00,0x00,0x00};

BYTE OrgCode[5]={0x8B,0x3F,0x8B,0x1C,0x87};

BYTE PushRetCode[6]={0x68,0x00,0x00,0x00,0x00,0xc3};

KIRQL f_oldirql;

KSPIN_LOCK f_spinlock;

NTOPENTHREAD OldNtOpenThread;

NTOPENPROCESS OldNtOpenProcess;

NTDUPLICATEOBJECT OldNtDuplicateObject;

NTUSERPOSTTHREADMESSAGE OldNtUserPostThreadMessage;

ULONG uKiFastCallEntryAddr=0;

ULONG HookAddr=0;

ULONG JMPRet=0;

ULONG PushRetMem=0;

ULONG ppid=0;

PEPROCESS ppep=NULL;

PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow;

extern PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable;

ULONG GetShadowTableAddress()

{

ULONG dwordatbyte,i;

PUCHAR p = (PUCHAR) KeAddSystemServiceTable;

for(i = 0; i < PAGE_SIZE; i++, p++)// 往下找一页指针递增1

{

__try

{

dwordatbyte = *(PULONG)p;

}

__except(EXCEPTION_EXECUTE_HANDLER)

{

return FALSE;

}

if(MmIsAddressValid((PVOID)dwordatbyte))

{

if(memcmp((PVOID)dwordatbyte, KeServiceDescriptorTable, 16) == 0)//对比前16字节相同则找到

{

if((PVOID)dwordatbyte == KeServiceDescriptorTable)//排除自己

{

continue;

}

return dwordatbyte;

}

}

}

return FALSE;

}

ULONG GetSSDTCurAddr(IN ULONG Index,BOOL IsShadow)

{

ULONG ServiceCount,BaseAddr;

if (KeServiceDescriptorTableShadow!=NULL)

{

ServiceCount=KeServiceDescriptorTableShadow[IsShadow?1:0].NumberOfServices;

BaseAddr = (ULONG)KeServiceDescriptorTableShadow[IsShadow?1:0].ServiceTableBase;

if (Index>=ServiceCount) return FALSE;

return *(PULONG)(BaseAddr+Index * 4);

}

return FALSE;

}

NTSTATUS MyNtOpenThread(OUT PHANDLE ThreadHandle,

IN ACCESS_MASK DesiredAccess,

IN POBJECT_ATTRIBUTES ObjectAttributes,

IN PCLIENT_ID ClientId)

{

PETHREAD tcmp;

PEPROCESS pcmp;

NTSTATUS st,ntotst;

if(MmIsAddressValid(ClientId)==TRUE)

{

st=PsLookupThreadByThreadId((HANDLE)ClientId->UniqueThread,&tcmp);

if (!NT_SUCCESS(st))

{

ntotst=STATUS_ACCESS_DENIED;

}

else

{

pcmp=IoThreadToProcess(tcmp);

if(pcmp==ppep)

ntotst=STATUS_ACCESS_DENIED;

else

ntotst=OldNtOpenThread(ThreadHandle,DesiredAccess,ObjectAttributes,ClientId);

}

}

else

{

ntotst=STATUS_ACCESS_DENIED;

}

return ntotst;

}

NTSTATUS MyNtOpenProcess(OUT PHANDLE ProcessHandle,

IN ACCESS_MASK AccessMase,

IN POBJECT_A TTRIBUTES ObjectAttributes,

IN PCLIENT_ID ClientId)

{

PEPROCESS pcmp;

NTSTATUS st,ntopst;

if(MmIsAddressValid(ClientId)==TRUE)

{

st=PsLookupProcessByProcessId((HANDLE)ClientId->UniqueProcess,&pcmp);

if (!NT_SUCCESS(st))

{

ntopst=STA TUS_ACCESS_DENIED;

}

else

{

if(pcmp==ppep)

ntopst=STA TUS_ACCESS_DENIED;

else

ntopst=OldNtOpenProcess(ProcessHandle,AccessMase,ObjectAttributes,ClientId);

}

}

else

{

ntopst=STA TUS_ACCESS_DENIED;

}

return ntopst;

}

NTSTATUS MyNtDuplicateObject(IN HANDLE SourceProcessHandle,

IN HANDLE SourceHandle,

IN HANDLE TargetProcessHandle,

OUT PHANDLE TargetHandle OPTIONAL,

IN ACCESS_MASK DesiredAccess,

IN ULONG Attributes,

IN ULONG Options)

{

NTSTATUS ntStatus,Tmp;

PROCESS_BASIC_INFORMATION PBI;

THREAD_BASIC_INFORMATION TBI;

ULONG NowPid;

ntStatus=OldNtDuplicateObject(SourceProcessHandle,SourceHandle,TargetProcessHandle,T argetHandle,DesiredAccess,Attributes,Options);

if (NT_SUCCESS(ntStatus) )

{

Tmp=ZwQueryInformationProcess(*TargetHandle,0,&PBI,sizeof(PBI),NULL);

if (NT_SUCCESS(Tmp))

{

NowPid=PBI.UniqueProcessId;

if (NowPid==ppid || NowPid==ppid+1 || NowPid==ppid+2 || NowPid==ppid+3)

{

ZwClose(*TargetHandle);

*TargetHandle=0;

ntStatus= STATUS_UNSUCCESSFUL;

}

}

Tmp=ZwQueryInformationThread(*TargetHandle,0,&TBI,sizeof(TBI),NULL);

if (NT_SUCCESS(Tmp))

{

NowPid=(ULONG)TBI.ClientId.UniqueProcess;

if (NowPid==ppid || NowPid==ppid+1 || NowPid==ppid+2 || NowPid==ppid+3)

{

ZwClose(*TargetHandle);

*TargetHandle=0;

ntStatus= STATUS_UNSUCCESSFUL;

}

}

}

return ntStatus;

}

BOOL MyNtUserPostThreadMessage(DWORD idThread,UINT Msg,WPARAM wParam,LPARAM lParam)

{

PEPROCESS pcmp=NULL;

PETHREAD tcmp=NULL;

NTSTATUS st=STATUS_UNSUCCESSFUL;

BOOL rt=FALSE;

st=PsLookupThreadByThreadId((HANDLE)idThread,&tcmp);

if (NT_SUCCESS(st))

{

pcmp=IoThreadToProcess(tcmp);

if(pcmp==ppep)

rt=FALSE;

else

rt=OldNtUserPostThreadMessage(idThread,Msg,wParam,lParam);

}

else

{

rt=FALSE;

}

return rt;

}

//HOOK KiFastCallEntry过滤函数

__declspec(naked)void FakeKiFastCallEntry()

{

_asm

{

pushfd

pushad

mov edi,dword ptr [edi]

mov ebx,dword ptr [edi+eax*4]

cmp OldNtOpenProcess,ebx; //比较是否为NtOpenProcess

je Label1

cmp OldNtDuplicateObject,ebx; //比较是否为NtDuplicateObject

je Label2

cmp OldNtOpenThread,ebx; //比较是否为NtOpenThread

je Label3

cmp OldNtUserPostThreadMessage,ebx; //比较是否为NtOpenThread

je Label4

popad

popfd

mov edi,dword ptr [edi]

mov ebx,dword ptr [edi+eax*4]

jmp [JMPRet];

Label1:

popad

popfd

mov ebx,MyNtOpenProcess //修改NtOpenProcess为我们的代理函数

jmp [JMPRet];

Label2:

popad

popfd

mov ebx,MyNtDuplicateObject //修改NtDuplicateObject为我们的代理函数

jmp [JMPRet];

Label3:

popad

popfd

mov ebx,MyNtOpenThread //修改NtOpenThread为我们的代理函数

jmp [JMPRet];

Label4:

popad

popfd

mov ebx,MyNtUserPostThreadMessage //修改NtUserPostThreadMessage为我们的代理函数

jmp [JMPRet];

}

}

NTSTATUS LoadKiHooker()

{

NTSTATUS status = STATUS_UNSUCCESSFUL;

KIRQL oldIrql;

PMDL pMdl = NULL;

UNICODE_STRING ustrFunctionName,ustrFunctionName2;

//获得“阴影表”的地址

KeServiceDescriptorTableShadow=(PSYSTEM_SERVICE_TABLE)GetShadowTableAddres s();

if (!KeServiceDescriptorTableShadow)

{

DbgPrint("Find SSSDT Error!");

return STATUS_UNSUCCESSFUL;

}

//获取NtUserPostThreadMessage地址

OldNtUserPostThreadMessage=(NTUSERPOSTTHREADMESSAGE)GetSSDTCurAddr(id PTM,TRUE);

DbgPrint("NtUserPostThreadMessaged=0x%08X",OldNtUserPostThreadMessage);

//获取NtOpenProcess地址

RtlInitUnicodeString(&ustrFunctionName, L"NtOpenProcess");

OldNtOpenProcess=(NTOPENPROCESS)MmGetSystemRoutineAddress( &ustrFunctionNa me);

DbgPrint("NtOpenProcess=0x%08X",OldNtOpenProcess);

//获取NtDuplicateObject地址

RtlInitUnicodeString(&ustrFunctionName2, L"NtDuplicateObject");

OldNtDuplicateObject=(NTDUPLICATEOBJECT)MmGetSystemRoutineAddress(&ustrFun ctionName2);

DbgPrint("NtDuplicateObject=0x%08X",OldNtDuplicateObject);

//获取NtOpenThread地址

OldNtOpenThread=(NTOPENTHREAD)GetSSDTRealAddr(GetSysCallIndex("NtOpenThre ad"));

DbgPrint("NtOpenThread=0x%08X",OldNtOpenThread);

//系统调用管理器的地址保存在MSR寄存器里面,标识ID为0x176是SYSENTER_EIP_MSR寄存器,存放着KiFastCallEntry地址！所以在这里用rdmsr读取KiFastCallEntry地址；

__asm

{

pushfd

pushad

mov ecx,0x176

rdmsr

mov uKiFastCallEntryAddr,eax //获取KiFastCallEntry地址

xor ecx,ecx

Label1:

cmp ecx,0x100

je Label3

mov edx,DWORD ptr [eax]

cmp edx,0x1C8B3F8B //搜索特征码,获取要Hook的位置

je Label2

inc eax

inc ecx

jmp Label1

Label2:

mov HookAddr,eax

Label3:

popad

popfd

}

if (HookAddr==0)

{

return status;

}

//申请分配二级跳转内存

PushRetMem=(ULONG)ExAllocatePoolWithTag(NonPagedPool,6,MEM_TAG);

if ((PVOID)PushRetMem==NULL)

{

return status;

}

DbgPrint("PushRetMem=0x%08X",PushRetMem);

//一级跳转地址

*(ULONG*)&JmpCode[1]=(ULONG)(PushRetMem)-(HookAddr+5);

//二级跳转地址

*(ULONG*)&PushRetCode[1]=(ULONG)FakeKiFastCallEntry;

//HOOK返回地址

JMPRet=HookAddr+5;

//申请MDL

pMdl = IoAllocateMdl((PBYTE)HookAddr, 5, FALSE, FALSE, NULL);

if (pMdl)

{

//锁定内存页面

__try

{

MmProbeAndLockPages(pMdl, KernelMode, IoWriteAccess);

}

__except(EXCEPTION_EXECUTE_HANDLER)

{

IoFreeMdl(pMdl);

return status;

}

//申请并使用自旋锁

KeInitializeSpinLock(&f_spinlock);

KeAcquireSpinLock(&f_spinlock,&f_oldirql);

//提升中断请求级

oldIrql = KeRaiseIrqlToDpcLevel();

//关闭中断

_asm

{

CLI

MOV EAX, CR0

AND EAX, NOT 10000H

MOV CR0, EAX

}

//进行HOOK操作

RtlCopyMemory((PVOID)PushRetMem,PushRetCode,6);

RtlCopyMemory((PVOID)HookAddr,JmpCode,5);

//开启中断

_asm

{

MOV EAX, CR0

OR EAX, 10000H

MOV CR0, EAX

STI

}

//恢复先前中断请求级

KeLowerIrql(oldIrql);

//释放自旋锁

KeReleaseSpinLock(&f_spinlock, f_oldirql);

DbgPrint("KiFastCallEntry=0x%08X",uKiFastCallEntryAddr);

DbgPrint("HookAddr=0x%08X",HookAddr);

status=STATUS_SUCCESS;

}

return status;

}

VOID UnloadKiHooker()

{

PMDL pMdl = NULL;

KIRQL oldIrql;

if (HookAddr!=0)

{

pMdl = IoAllocateMdl((PBYTE)HookAddr, 5, FALSE, FALSE, NULL);

if (pMdl)

{

//锁定内存页面

__try

{

MmProbeAndLockPages(pMdl, KernelMode, IoWriteAccess);

}

__except(EXCEPTION_EXECUTE_HANDLER)

{

IoFreeMdl(pMdl);

return;

}

//申请并使用自旋锁

KeInitializeSpinLock(&f_spinlock);

KeAcquireSpinLock(&f_spinlock,&f_oldirql);

//提升中断请求级

oldIrql = KeRaiseIrqlToDpcLevel();

//关闭中断

_asm

{

CLI

MOV EAX, CR0

AND EAX, NOT 10000H

MOV CR0, EAX

}

//进行还原HOOK操作

RtlCopyMemory((PVOID)HookAddr,OrgCode,5);

_asm

{

MOV EAX, CR0

OR EAX, 10000H

MOV CR0, EAX

STI

}

//恢复先前中断请求级

KeLowerIrql(oldIrql);

//释放自旋锁

KeReleaseSpinLock(&f_spinlock, f_oldirql);

//释放内存

ExFreePool((PVOID)PushRetMem);

}

}

}