学习ssdt hook，hook了NtCreateFile，但我把要保护的文件名定义为全局变量时，就会BSOD。信息是nonepaged fault。我想了想，未分页内存？改了几个地方，后来把全局变量定义到函数里的时候终于不蓝屏了。想请教一下原因。谢谢！
#include <ntddk.h>
#pragma pack(1)
typedef struct _SSDT_ENTRY
{
PULONG ServiceTableBase;
PULONG ServiceCounterTableBase;
PULONG NumberOfServices;
PUCHAR ParamTableBase;
}SSDT_ENTRY, PSSDT_ENTRY;
#pragma pack()
typedef NTSTATUS (*NTCREATEFILE)(PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateOptions,
PVOID EaBuffer,
ULONG EaLength);
__declspec(dllimport) SSDT_ENTRY KeServiceDescriptorTable;
//WCHAR wProtectFileName[] = L"\\??\\C:\\protect.txt";
//UNICODE_STRING usProtectFileName = {0};
NTCREATEFILE OldNtCreateFile = NULL;
NTSTATUS MyNtCreateFile(PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateOptions,
PVOID EaBuffer,
ULONG EaLength);
VOID DriverUnload(PDRIVER_OBJECT pDriverObject);
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
pDriverObject->DriverUnload = DriverUnload;
//RtlInitUnicodeString(&usProtectFileName,wProtectFileName);
//OldNtCreateFile = (NTCREATEFILE)KeServiceDescriptorTable.ServiceTableBase[*(ULONG *)((PUCHAR)ZwCreateFile+1)];
__asm
{
cli
mov eax, cr0
and eax, ~0x10000
mov cr0, eax
}
OldNtCreateFile = (NTCREATEFILE)InterlockedExchange(&KeServiceDescriptorTable.ServiceTableBase[*(ULONG *)((PUCHAR)ZwCreateFile+1)],(ULONG)MyNtCreateFile);
//KeServiceDescriptorTable.ServiceTableBase[*(ULONG *)((PUCHAR)ZwCreateFile+1)] = (ULONG)MyNtCreateFile;
__asm
{
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
}
return STATUS_SUCCESS;
}
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
__asm
{
cli
mov eax, cr0
and eax, ~0x10000
mov cr0, eax
}
InterlockedExchange(&KeServiceDescriptorTable.ServiceTableBase[*(ULONG *)((PUCHAR)ZwCreateFile+1)],(ULONG)OldNtCreateFile);
//KeServiceDescriptorTable.ServiceTableBase[*(ULONG *)((PUCHAR)ZwCreateFile+1)] = (ULONG)OldNtCreateFile;
__asm
{
mov eax, cr0
or eax, 0x10000
mov cr0, eax
sti
}
}
NTSTATUS MyNtCreateFile(PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateOptions,
PVOID EaBuffer,
ULONG EaLength)
{
WCHAR wProtectFileName[] = L"\\??\\C:\\protect.txt";
UNICODE_STRING usProtectFileName = {0};
RtlInitUnicodeString(&usProtectFileName,wProtectFileName);
if(!RtlCompareUnicodeString(&usProtectFileName,ObjectAttributes->ObjectName,TRUE))
{
FileHandle = NULL;
return STATUS_INVALID_PARAMETER;
}
return OldNtCreateFile(FileHandle,
DesiredAccess,
ObjectAttributes,
IoStatusBlock,
AllocationSize,
FileAttributes,
ShareAccess,
CreateOptions,
EaBuffer,
EaLength);
}
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
