#include <ntddk.h>
#include <windef.h>
#include <stdlib.h>
NTSTATUS HookNtReadMemory( IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG NumberOfBytesToRead,
OUT PULONG NumberOfBytesReaded OPTIONAL );

NTSTATUS Hook_NtWriteVirtualMemory( IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN ULONG NumberOfBytesToWrite,
OUT PULONG NumberOfBytesWritten OPTIONAL );
void FuncitonHook();
BYTE OriginalBytes[7]={0}; //保存原始函数前五个字节
BYTE JmpAddress[7]={0xB8,0,0,0,0,0xFF,0xE0}; //跳转到HOOK函数的地址
ULONG Read_Address;
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase; //指向系统服务程序的地址(SSDT)
//指向另一个索引表，该表包含了每个服务表项被调用的次数；不过这个值只在Checkd Build的内核中有效，在Free Build的内核中，这个

值总为NULL
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices; //表示当前系统所支持的服务个数
unsigned char *ParamTableBase; //指向SSPT中的参数地址，它们都包含了NumberOfService这么多个数组单元
} ServiceDescriptorTableEntry , *PServiceDescriptorTableEntry;

extern PServiceDescriptorTableEntry KeServiceDescriptorTable;

ULONG RetFunctionAddress(ULONG id)
{
ULONG UAddress=(ULONG)KeServiceDescriptorTable->ServiceTableBase+id*4;
return UAddress;

}

void UnDriverload(IN PDRIVER_OBJECT DriverObject)
{
KdPrint(("驱动卸载成功!"));
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegPath)
{
KdPrint(("驱动加载成功"));
FuncitonHook();
DriverObject->DriverUnload=UnDriverload;
return STATUS_SUCCESS;
}

void FuncitonHook()
{
Read_Address =(ULONG)RetFunctionAddress(186);
RtlCopyMemory(OriginalBytes,Read_Address,7);
*(ULONG *)(JmpAddress+1)=(ULONG)HookNtReadMemory-(*(ULONG*)Read_Address+5);

}

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法