typedef
NTSTATUS
(* NtOpenPs)(
__out PHANDLE ProcessHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in_opt PCLIENT_ID ClientId
);


typedef NTSTATUS
(* NtRead) (
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferSize,
OUT PULONG NumberOfBytesRead OPTIONAL
);

NtRead NtReadVirtualMemory = (NtRead)nNtReadVirtualMemoryAddr;
NtOpenPs NtOpenProcessnew = (NtOpenPs)nNtOpenProcessAddr;
ULONG ThreadFunAddr = 0;

VOID ReadConText(IN PCONTEXT ThreadContext,IN HANDLE Handle )
{
ULONG ReadOfByte = 0;
DbgPrint("%d",PsGetCurrentProcessId());//ThreadContext+0xB0是上下文中的eax
//即使下面这句不执行也会蓝屏
NtReadVirtualMemory(Handle,(int *)ThreadContext+0xB0,&ThreadFunAddr,4,&ReadOfByte);
}





//下面是HOOK单元
typedef struct _INITIAL_TEB {
struct {
PVOID OldStackBase;
PVOID OldStackLimit;
} OldInitialTeb;
PVOID StackBase;
PVOID StackLimit;
PVOID StackAllocationBase;
} INITIAL_TEB, *PINITIAL_TEB;


ULONG NtCreateThreadJmp = 0;


__declspec(naked) void MyNtCreateThread(__out PHANDLE ThreadHandle,
__in ACCESS_MASK DesiredAccess,
__in_opt POBJECT_ATTRIBUTES ObjectAttributes,
__in HANDLE ProcessHandle,
__out PCLIENT_ID ClientId,
__in PCONTEXT ThreadContext,
__in PINITIAL_TEB InitialTeb,
__in BOOLEAN CreateSuspended)
{
if(AssertProcessName(PROCESSNAME))
{ //ThreadContext+0xB0 线程函数
//堆栈中第七个
ReadConText(ThreadContext,ProcessHandle);
DbgPrint("%X\n",ThreadFunAddr);
}
__asm
{
jmp NtCreateThreadJmp
}

}

VOID HookNtCreateThread()
{
NtCreateThreadJmp = GetSSDTFunctionAddr(53);
DbgPrint("%X",NtCreateThreadJmp);
if (NtCreateThreadJmp != NULL)
{
SSDTHookEngine(53,(int)MyNtCreateThread);
}
return ;
}
VOID UnHookNtCreateThread()
{
if (NtCreateThreadJmp != NULL)
{
SSDTHookEngine(53,NtCreateThreadJmp);
}
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)