#include "ssdthook.h"

#pragma  pack(1)

typedef struct _SSDT_TABLE
{
  PVOID   ServiceTableBase;
  PULONG  ServiceCounterTableBase;
  ULONG   NumberOfService;
  ULONG   ParamTableBase;
}SSDT_TABLE,* PSSDT_TABLE;
#pragma pack()

struct _SYSTEM_THREADS
{
  LARGE_INTEGER           KernelTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           CreateTime;
  ULONG                           WaitTime;
  PVOID                           StartAddress;
  CLIENT_ID                       ClientIs;
  KPRIORITY                       Priority;
  KPRIORITY                       BasePriority;
  ULONG                           ContextSwitchCount;
  ULONG                           ThreadState;
  KWAIT_REASON            WaitReason;
};


//===================================================
struct _SYSTEM_PROCESSES
{
  ULONG                           NextEntryDelta;
  ULONG                           ThreadCount;
  ULONG                           Reserved[6];
  LARGE_INTEGER           CreateTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           KernelTime;
  UNICODE_STRING          ProcessName;
  KPRIORITY                       BasePriority;
  ULONG                           ProcessId;
  ULONG                           InheritedFromProcessId;
  ULONG                           HandleCount;
  ULONG                           Reserved2[2];
  VM_COUNTERS                     VmCounters;
  IO_COUNTERS                     IoCounters; //windows 2000 only
  struct _SYSTEM_THREADS          Threads[1];
};

struct _SYSTEM_PROCESSOR_TIMES
{
   LARGE_INTEGER          IdleTime;
   LARGE_INTEGER          KernelTime;
   LARGE_INTEGER          UserTime;
   LARGE_INTEGER          DpcTime;
   LARGE_INTEGER          InterruptTime;
   ULONG              InterruptCount;
};

//======================================================
typedef NTSTATUS (__stdcall *ZWQUERYSYSTEMINFORMATION)(
   IN ULONG SystemInformationClass, 
   IN PVOID SystemInformation, 
   IN ULONG SystemInformationLength, 
   OUT PULONG ReturnLength);

NTSTATUS MyZwQuerySystemInformation( 
   IN ULONG SystemInformationClass, 
   IN PVOID SystemInformation, 
   IN ULONG SystemInformationLength, 
   OUT PULONG ReturnLength);

//定义全局变量
extern "C" extern PSSDT_TABLE  KeServiceDescriptorTable;
ULONG  OldAddress;
ZWQUERYSYSTEMINFORMATION        OldZwQuerySystemInformation;
PVOID Base;

void UnHook();

VOID Unload (IN PDRIVER_OBJECT pDriverObject) 
{
        KdPrint(("Enter DriverUnload\n"));
        UnHook();   // mark

}

NTSTATUS MyZwQuerySystemInformation(IN ULONG SystemInformationClass, 
                                    IN PVOID SystemInformation, 
                                    IN ULONG SystemInformationLength, 
                                    OUT PULONG ReturnLength) //定义自己的Hook函数
{ 
    
    NTSTATUS rc; 
    UNICODE_STRING process_name;
    
    RtlInitUnicodeString(&process_name, L"taskmgr.exe");
    
    rc = (OldZwQuerySystemInformation) ( 
        SystemInformationClass, 
        SystemInformation, 
        SystemInformationLength, 
        ReturnLength); 
    
    if(NT_SUCCESS(rc)) 
    {
        if(5 == SystemInformationClass)
        { 
            struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation; 
            
            while(curr)
            {
                if (RtlEqualUnicodeString(&process_name, &curr->ProcessName, 1))
                {
                                        DbgPrint("before %wZ\n",&process_name); 
                                        RtlInitUnicodeString(&(curr->ProcessName), L"haha");                                          
                                        DbgPrint("after %wZ\n",&(curr->ProcessName)); 


                } // if (RtlEqualUnicodeString(&process_name, &curr->ProcessName, 1))
                

                if(curr->NextEntryDelta)
                    curr = (_SYSTEM_PROCESSES *)((ULONG)curr + curr->NextEntryDelta); 
                else 
                    curr = NULL;

            } //while(curr)
            
        } // if(5 == SystemInformationClass)
        
    }// if(NT_SUCCESS(rc))
    
    // KdPrint(("HookZwQuerySystemInformation is Succeessfully. \n"));
    return rc;
}

VOID Hook()

{

        DbgPrint("Entry Hook()\n");
        OldAddress =(ULONG)KeServiceDescriptorTable->ServiceTableBase + 4*0xAd;//用windbg反汇编查到zwquerysysteminformationde的ID号是0xADh
        DbgPrint("KeServiceDescriptorTable->ServiceTableBase is :0x%0x\n",KeServiceDescriptorTable->ServiceTableBase);
        //保存原来函数的地址
        OldZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION) *(ULONG *)OldAddress;
        DbgPrint("OldZwQuerySystemInformation is :0x%0x\n", OldZwQuerySystemInformation);
        DbgPrint("MyZwQuerySystemInformation is :0x%0x\n", MyZwQuerySystemInformation);
        
        //取消内存写保护
        _asm
        { 
        cli
        mov  eax,cr0
        and  eax,not 10000h
        mov  cr0,eax
        }

        *(ULONG*)OldAddress =(ULONG) MyZwQuerySystemInformation;       //mark   MyZwQuerySystemInformation;
        
        //还原内存写保护
        _asm
        {
        mov  eax,cr0
        or   eax,10000h
        mov  cr0,eax 
        sti
        }
}

void UnHook()
{
  ULONG  Address;

  Address =(ULONG) KeServiceDescriptorTable->ServiceTableBase +0xAD*4;

  __asm
  {
    cli
    mov  eax,cr0
    and  eax,not 10000h
    mov  cr0,eax
  }

  *(ULONG*)Address =(ULONG) OldZwQuerySystemInformation;

  __asm
  {  
    mov  eax,cr0
    or   eax,10000h
    mov  cr0,eax
    sti
  }

  DbgPrint("Unhook leave!\n");
}

extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT  pDriverObject, IN PUNICODE_STRING  pRegistryPath)
{

  DbgPrint("Entry Hook Function!\n");
  pDriverObject->DriverUnload = Unload;
  Hook();
  DbgPrint("Leave DriverEntry!\n");
  return STATUS_SUCCESS;
} 

[CTF入门培训]顶尖高校博士及硕士团队亲授《30小时教你玩转CTF》，视频+靶场+题目！助力进入CTF世界