#include <ntddk.h>
#include <windef.h>
#include <ntimage.h>

int KiAttach_dizhi,KiAttach_dizhi2,KiAttach_dnf,KiAttach_dnfhf;
char code3=(char)0xb8,code4=(char)0xe9;

__declspec(naked) void My_Kiattchprocess()
{
  __asm
  {
    mov edi,edi
    push ebp
    mov ebp,esp
    jmp KiAttach_dizhi2
  }
}

void KiAttachProcess1()
{
  char code=(char)0xe8;
  
  KiAttach_dizhi=GetFunCtionAddr(L"KeAttachProcess");
  KiAttach_dizhi=GetCallAddr(SearchFeature(KiAttach_dizhi,&code,1));
  KiAttach_dnfhf=KiAttach_dizhi+1;
  KiAttach_dizhi2=KiAttach_dizhi+5;
  KiAttach_dnf=KiAttach_dizhi+1;
  KiAttach_dnf=*(int*)KiAttach_dnf;
  temp=(int)&My_Kiattchprocess;
//要跳转到的地址(计算后的地址)
  temp=temp-((int)&dm1[1])-4;
  RtlMoveMemory((int*)KiAttach_dizhi,&code4,1);
  RtlMoveMemory((int*)KiAttach_dnfhf,&temp,4);
  DbgPrint("hook KiAttachProcess成功\n");
  
}

void UnKiAttachProcess1()
{
  RtlMoveMemory((int*)KiAttach_dizhi,&code3,1);
  RtlMoveMemory((int*)KiAttach_dnfhf,&KiAttach_dnf,4);
  DbgPrint("KiAttachProcess卸载成功\n");
}

[培训]传播安全知识、拓宽行业人脉——看雪讲师团队等你加入！