UCHAR CodeBuff[10];
status = ZwQuerySystemInformation(SystemModuleInformation,NULL,0,&length);
if (status == STATUS_INFO_LENGTH_MISMATCH)
{
SysInfo = ExAllocatePool(NonPagedPool,length);
if (NULL == SysInfo)
{
return;
}
}
status = ZwQuerySystemInformation(SystemModuleInformation,SysInfo,length,&length);
pSmi = (PSYSTEM_MODULE_INFORMATION)((char*)SysInfo+4);
kBase = (ULONG)(pSmi->Base);
kSize = (ULONG)(pSmi->Size);
InitializeObjectAttributes (
&ob,
&pdte->FullDllName,
OBJ_CASE_INSENSITIVE,
NULL,
NULL
);
status = ZwOpenFile(
&hFile,
FILE_READ_ACCESS,
&ob,
&IoStatusBlock,
FILE_SHARE_READ,
FILE_SYNCHRONOUS_IO_NONALERT
);
ob.ObjectName = NULL;
status = ZwCreateSection(
&hSection,
SECTION_MAP_EXECUTE,
&ob,
0,
PAGE_EXECUTE,
SEC_IMAGE,
hFile
);
size = 0;
status = ZwMapViewOfSection(
hSection,
NtCurrentProcess(),
&BaseAddress,
0,
1000,
0,
&size,
(SECTION_INHERIT)1,
MEM_TOP_DOWN,
PAGE_READWRITE
);
mBase = ExAllocatePool (NonPagedPool, size);
RtlCopyMemory (mBase, BaseAddress, size);
DosHead = (PIMAGE_DOS_HEADER)mBase;
NtHeads = (PIMAGE_NT_HEADERS)((ULONG)DosHead + DosHead->e_lfanew);
ExportDir = (PIMAGE_EXPORT_DIRECTORY)((PUCHAR)mBase + NtHeads->OptionalHeader.DataDirectory[0].VirtualAddress);
RelocDir = (PIMAGE_BASE_RELOCATION)((ULONG)mBase + NtHeads->OptionalHeader.DataDirectory[5].VirtualAddress);
Name = mBase + ExportDir->AddressOfNames;
Ordinal = mBase + ExportDir->AddressOfNameOrdinals;
Function = mBase + ExportDir->AddressOfFunctions;
if (RelocDir != NULL)
{
while (RelocDir->VirtualAddress != 0 || RelocDir->SizeOfBlock != 0)
{
FixAddrBase = RelocDir->VirtualAddress + (ULONG)mBase;
RelocSize = (RelocDir->SizeOfBlock - 8)/2;
for ( i = 0; i < RelocSize; i++)
{
Temp = *(PUSHORT)((ULONG)RelocDir + sizeof (IMAGE_BASE_RELOCATION) + i * 2);
if ( (Temp & 0xF000) == 0x3000)
{
Temp &= 0x0FFF;
FixAddr = FixAddrBase + (ULONG)Temp;
*(PULONG)FixAddr = *(PULONG)FixAddr + (ULONG)kBase - (ULONG)NtHeads->OptionalHeader.ImageBase;
}
}
RelocDir = (ULONG)RelocDir + RelocDir->SizeOfBlock;
}
}
for (i = 0; i < ExportDir->NumberOfNames; i++)
{
SystemFunName = (PCHAR)(*(PULONG)(Name + i * 4) + (ULONG)Base);
index = *((PUSHORT)(Ordinal + i * 2));
Address = *((PULONG)(Function + index * 4));
if (Flag == 0)
{
if (!stricmp ("NtOpenProcess", SystemFunName))
{
break;
}
}
}
memcopy (CodeBuff, Address + mBase, 10);
//到这里就获得了原始ntopenprocess函数开头10字节代码
MyNtOpenProcessAdddress = MyNtProcessBorn (CodeBuff);
//好了，什么都有了，ssdthook就ok了
ULONG MyNtProcessBorn (PUCHAR CodeBuff)
{
PUCHAR Temp;
ULONG myntopenprocessaddress;
myntopenprocessaddress = ExAllocatePool (NonPagedPool, 15);
memcpy (myntprocessaddress, CodeBuff, 10);
Temp = (PUCHAR)myntprocessaddress + 10;
*(PUCHAR)Temp = 0xE9;
Temp += 1;
offset = (ULONG)realntopenprocessaddress - (ULONG)Temp - 4;
*(PULONG)Temp = offset;
return myntopenprocessaddress;
}
