ULONG clearaddr1=0;
ULONG clearaddr2=0;
ULONG KiDebugRoutineaddr=0;
ULONG returnaddr2=0;
ULONG calltimes=0;
typedef unsigned char byte;
void my_kddisabledebugger();
VOID MY_PloadImageNotifyRoutine(IN PUNICODE_STRING  FullImageName,IN HANDLE  ProcessId,IN PIMAGE_INFO  ImageInfo)
{
	if (NULL!=wcsstr(FullImageName->Buffer,L"TesSafe.sys"))
	{
		KdPrint(("要加载的内存映像名称为%ws,进程ID=%x,映像基地址=%x,映像大小=%x\r\n",FullImageName->Buffer,ProcessId,ImageInfo->ImageBase,ImageInfo->ImageSize));
		_asm int 3;
		clearaddr1=(ULONG)ImageInfo->ImageBase+0x17b6c;
		clearaddr2=(ULONG)ImageInfo->ImageBase+0x13268;
		KiDebugRoutineaddr=*PULONG((ULONG)KdDisableDebugger+0x4a);
		returnaddr2=(ULONG)ImageInfo->ImageBase+0x7008;
		WPOFF();
		byte jmpcode[6];
		jmpcode[0]=0x90;
		jmpcode[1]=0xe9;
		*(ULONG*)(jmpcode+2)=(ULONG)my_kddisabledebugger-((ULONG)KdDisableDebugger+1+5);
		RtlCopyMemory((PVOID)KdDisableDebugger,jmpcode,6);
		WPON();
	}
	
}
void showhookkddisabledeguggermessage()
{
	KdPrint(("tp还在调用kddisabledebugger,当前线程ID=%d\r\n",PsGetCurrentThreadId()));
}
void _declspec (naked) my_kddisabledebugger()
{
	showhookkddisabledeguggermessage();
//将第一个数改为39f1	//17b68
//读取KiDebugRoutine里面的数值，付给13268
	__asm
	{
		mov eax,calltimes
		cmp eax,0
		jne return3
		mov eax,clearaddr1
		mov eax,[eax]
		mov edi,[eax+0x28]
		sub edi,1
		mov [eax+0x28],edi
		mov edi,[esp]
		cmp edi,returnaddr2
		jne return2
		sub esi,1
return2:
		mov edi,[KiDebugRoutineaddr]
		mov edi,[edi]
		mov eax,clearaddr2
		mov [eax],edi
		lea eax,calltimes
		mov edi,calltimes
		add edi,1
		mov [eax],edi
return3:
		ret
	}
}

[峰会]看雪.第八届安全开发者峰会10月23日上海龙之梦大酒店举办！