-
-
[求助]学习HOOK IOFCALLDRIVER出现问题
-
发表于:
2011-6-22 17:30
7388
-
[求助]学习HOOK IOFCALLDRIVER出现问题
我学习天书夜读上面的HOOK一章 然后自己写了个DEMO 蓝了 用WINDBG调试 执行HookRoutine中InterlockedExchange((PLONG)(address+2),(LONG)ChangeIoCallDriver); 前用 u iofdriver 看 是这样:
nt!IofCallDriver:
804e47c5 ff2580445580 jmp dword ptr [nt!pIofCallDriver (80554480)]
804e47cb 90 nop
804e47cc 90 nop
804e47cd 90 nop
804e47ce 90 nop
804e47cf 90 nop
执行完替换函数后变成
nt!IofCallDriver:
804e47c5 ff2590f403fa jmp dword ptr [HookIoCallDriver!NewIoCallDriver (fa03f490)]
804e47cb 90 nop
804e47cc 90 nop
804e47cd 90 nop
804e47ce 90 nop
804e47cf 90 nop
说明替换成功了 但是接下来就蓝了 我用 bp NewIoCallDriver 命令查看发现竟然是如下的汇编代码
Breakpoint 3 hit
nt!IofCallDriver:
804e47c5 ff2590f403fa jmp dword ptr [HookIoCallDriver!NewIoCallDriver (fa03f490)]
kd> t
8b55ff8b ?? ???
执行到无效命令那边了 所以蓝了 我的所有代码如下
typedef NTSTATUS (FASTCALL *PMYIOCALLDRIVER)(IN PDEVICE_OBJECT,IN PIRP);
PMYIOCALLDRIVER g_Old_IoCallDriver=NULL;
NTSTATUS FASTCALL NewIoCallDriver(IN PDEVICE_OBJECT device,IN PIRP Irp)
{
NTSTATUS status=STATUS_SUCCESS;
if(!g_Old_IoCallDriver)
return status;
__asm
{
jmp g_Old_IoCallDriver
}
return status;
}
PMYIOCALLDRIVER HookRoutine(PMYIOCALLDRIVER ChangeIoCallDriver,BOOLEAN HookOrNot)
{
PMYIOCALLDRIVER Old_Io_CallDriver=NULL;
UNICODE_STRING FunName;
PCHAR address;
RtlInitUnicodeString(&FunName,L"IofCallDriver");
address=MmGetSystemRoutineAddress(&FunName);
if(address==NULL)
return NULL;
if(HookOrNot)
{
Old_Io_CallDriver=(PMYIOCALLDRIVER)(address+2);
g_Old_IoCallDriver=Old_Io_CallDriver;
InterlockedExchange((PLONG)(address+2),(LONG)ChangeIoCallDriver);
return Old_Io_CallDriver;
}
else
{
g_Old_IoCallDriver=NULL;
InterlockedExchange((PLONG)(address+2),(LONG)ChangeIoCallDriver);
}
return Old_Io_CallDriver;
}
void HookIoCallUnload(IN PDRIVER_OBJECT DriverObject)
{
if(g_Old_IoCallDriver)
{
HookRoutine(g_Old_IoCallDriver,FALSE);
}
}
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
DriverObject->DriverUnload = HookIoCallUnload;
g_Old_IoCallDriver=HookRoutine(NewIoCallDriver,TRUE);
return STATUS_SUCCESS;
}
求高手解答 我哪里写错了?
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)