能力值：
( LV2，RANK：10 )
|
-
-
2 楼
转贴一个别人写的例子，忘了哪看到的了
原理就是这样的
.386
.model flat, stdcall
option casemap:none
include \masm32\include\w2k\ntstatus.inc
include \masm32\include\w2k\ntddk.inc
include \masm32\include\w2k\ntoskrnl.inc
include \masm32\include\w2k\w2kundoc.inc
includelib \masm32\lib\w2k\ntoskrnl.lib
include \masm32\Macros\Strings.mac
.data
P_addr dd 0
realaddr dd 0
CR0Reg dd 0
Messaga1 db "OpenProcess",0
Messaga2 db "Driver loaded", 0
.code
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
local pDeviceObject:PVOID
pushad
invoke DbgPrint, addr Messaga2
mov edi, dword ptr KeServiceDescriptorTable
mov edi, [edi]
lea eax, [edi+(07ah*4)] ;edi+07ah*4 = NtOpenProcess
mov P_addr, eax ;保存地址指针
push [edi+(07ah*4)]
pop realaddr ;保存原来的地址
cli
mov eax, CR0
mov CR0Reg, eax
and eax,0fffeffffh
mov cr0, eax
mov eax,P_addr
mov [eax], dword ptr offset hookproc
mov eax, CR0Reg
mov CR0, eax
sti
mov eax, pDriverObject
assume eax:PTR DRIVER_OBJECT
mov [eax].DriverUnload, offset DriverUnload
assume eax:nothing
popad
mov eax, STATUS_SUCCESS
ret
DriverEntry endp
;:::::::::::::::::::::::::::::::::::::::::::::::::::::
DriverUnload proc pDriverObject:PDRIVER_OBJECT
pushad
cli
mov eax, CR0
mov CR0Reg, eax
and eax,0fffeffffh
mov cr0, eax
mov eax,P_addr
mov edx,realaddr
mov [eax], edx
mov eax, CR0Reg
mov CR0, eax
sti
popad
ret
DriverUnload endp
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
hookproc proc
invoke DbgPrint, addr Messaga1
jmp dword ptr realaddr
hookproc endp
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
end DriverEntry
|
|
|
|
