最近在看和尚老师的过TP驱动保护教程，看到第六课我就不理解了。教程里构建了一个KiAttchProcess，那一大堆汇编，我一看就晕了，他说和系统的KiAttchProcess差不多，若是一样，调用系统的KiAttchProcess就行了；若是改了哪，我就看不懂了。若是DNF的进程，就执行汇编；不是，就执行原来的KiAttchProcess。我不明白这些汇编有什么用，附上代码，请各位指导一下：
#ifndef HOOKKEATTCH
#define HOOKKEATTCH
int HookKeAttachProcessAddr;
int KiMoveApcState1;
int KiReadyThread2;
int KiSwapProcess3;
int KiUnlockDispatcherDatabase4;
int KiSetSwapEvent5;
int KiSwapThread6;
int KiAttachProcessAddr;
int KiProcessInSwapListHeadAddr;
__declspec(naked) NTSTATUS MyKiAttachProcess()
{
if(PanDuanProcessName("DNF.exe")||PanDuanProcessName("TenSafe.exe"))
{
__asm
{
mov edi,edi
push ebp
mov ebp,esp
push ebx
mov ebx,dword ptr [ebp+0Ch]
inc word ptr [ebx+60h]
push esi
mov esi,dword ptr [ebp+8]
push edi
push dword ptr [ebp+14h]
lea edi,[esi+34h]
push edi
call KiMoveApcState1 //(804f8174) 1
mov dword ptr [edi+4],edi
mov dword ptr [edi],edi
lea eax,[esi+3Ch]
mov dword ptr [eax+4],eax
mov dword ptr [eax],eax
lea eax,[esi+14Ch]
cmp dword ptr [ebp+14h],eax
mov dword ptr [esi+44h],ebx
mov byte ptr [esi+48h],0
mov byte ptr [esi+49h],0
mov byte ptr [esi+4Ah],0
jne KiAttachProcess58// (804f8490)
mov dword ptr [esi+138h],eax
mov dword ptr [esi+13Ch],edi
mov byte ptr [esi+165h],1
KiAttachProcess58:
cmp byte ptr [ebx+65h],0
jne KiAttachProcess98 //(804f84d0)
lea esi,[ebx+40h]
jmp KiAttachProcess7C// (804f84b4)
KiAttachProcess63:
mov edx,dword ptr [eax]
lea ecx,[eax-60h]
mov eax,dword ptr [eax+4]
mov dword ptr [eax],edx
mov dword ptr [edx+4],eax
mov byte ptr [ecx+129h],0
call KiReadyThread2 //(80500dac) 2
KiAttachProcess7C:
mov eax,dword ptr [esi]
cmp eax,esi
jne KiAttachProcess63 //(804f849b)
mov eax,dword ptr [ebp+14h]
push dword ptr [eax+10h]
push ebx
call KiSwapProcess3 //3
mov cl,byte ptr [ebp+10h]
call KiUnlockDispatcherDatabase4 // (80541908) 4
jmp KiAttachProcessF7 // (804f852f)
KiAttachProcess98:
mov byte ptr [esi+2Dh],1
mov byte ptr [esi+129h],1
lea ecx,[ebx+40h]
mov edx,dword ptr [ecx+4]
lea eax,[esi+60h]
mov dword ptr [eax],ecx
mov dword ptr [eax+4],edx
mov dword ptr [edx],eax
mov dword ptr [ecx+4],eax
cmp byte ptr [ebx+65h],1
jne KiAttachProcessEC // (804f8524)
mov byte ptr [ebx+65h],2
mov eax,dword ptr [KiProcessInSwapListHeadAddr]//[0x80552fc0]//[0x80552fc0]//eax,dword ptr [nt!KiProcessInSwapListHead (80552fc0)]
lea edi,[ebx+48h]
mov dword ptr [ebp+0Ch],edi
mov dword ptr [ebp+14h],eax
KiAttachProcessCE:
mov dword ptr [edi],eax
mov ebx,eax
mov eax,dword ptr [ebp+14h]
mov ecx,KiProcessInSwapListHeadAddr//0x80552fc0//0x80552fc0//offset nt!KiProcessInSwapListHead (80552fc0)
mov edx,dword ptr [ebp+0Ch]
cmpxchg dword ptr [ecx],edx
cmp eax,ebx
mov dword ptr [ebp+14h],eax
jne KiAttachProcessCE// (804f8506)
call KiSetSwapEvent5 //(804f81d2) 5
KiAttachProcessEC:
mov al,byte ptr [ebp+10h]
mov byte ptr [esi+58h],al
call KiSwapThread6 //(80501134) 6
KiAttachProcessF7:
pop edi
pop esi
pop ebx
pop ebp
ret 10h
}
}
__asm jmp KiAttachProcessAddr
}
VOID HookKeAttchProcess()
{
// KeAttachProcessAddr=GetFunCtionAddr(L"KeAttachProcess");
KiAttachProcessAddr=GetKiAttachProcessAddr();
DbgPrint("KiAttachProcessAddr=%x\n",KiAttachProcessAddr);
char code=(char)0xe8;
int addr=SearchFeature(KiAttachProcessAddr,&code,1);
KiMoveApcState1=GetCallAddr(addr); //1
addr=SearchFeature(addr+1,&code,1);
KiReadyThread2=GetCallAddr(addr); //2
addr=SearchFeature(addr+1,&code,1);
KiSwapProcess3=GetCallAddr(addr); //3
addr=SearchFeature(addr+1,&code,1);
KiUnlockDispatcherDatabase4=GetCallAddr(addr); //4
char code2[2]={(char)0x65,(char)0x02};
addr=SearchFeature(addr+1,code2,2);
KiProcessInSwapListHeadAddr=GetCallAddr(addr); //7
char s=(char)0xe8;
int nCallAddr=SearchFeature(GetFunCtionAddr(L"KeAttachProcess"),&s,1);
HookKeAttachProcessAddr=nCallAddr;
CallHook(nCallAddr,(int)MyKiAttachProcess);
// DbgPrint("nCallAddr=%x\n",nCallAddr);
}
VOID UnHookKeAttchProcess()
{
CallHook(HookKeAttachProcessAddr,(int)KiAttachProcessAddr);
}
#endif
GetKiAttachProcessAddr();//得到KiAttachProcess的地址
SearchFeature(KiAttachProcessAddr,&code,1);//搜索特征码，返回特征码后面的地址
GetFunCtionAddr(L"KeAttachProcess")//通过函数名查找内核函数的地址
[注意]看雪招聘，专注安全领域的专业人才平台！
