首页
社区
课程
招聘
[求助]AFD HOOK的问题
发表于: 2013-8-6 17:24 5128

[求助]AFD HOOK的问题

2013-8-6 17:24
5128
大致代码如下:
NTSTATUS
NewZwDeviceIoControlFile(
    IN HANDLE FileHandle,
    IN HANDLE Event,
    IN PIO_APC_ROUTINE ApcRoutine,
    IN PVOID ApcContext,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    IN ULONG IoControlCode,
    IN PVOID InputBuffer,
    IN ULONG InputBufferLength,
    OUT PVOID OutputBuffer,
    IN ULONG OutputBufferLength
    )
{
    NTSTATUS Status = OldZwDeviceIoControlFile(
        FileHandle,
        Event,
        ApcRoutine,
        ApcContext,
        IoStatusBlock,
        IoControlCode,
        InputBuffer,
        InputBufferLength,
        OutputBuffer,
        OutputBufferLength
        );

    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    if (IOCTL_AFD_RECV == IoControlCode)
    {
        KdPrint(("IOCTL_AFD_RECV Size:%d\n", IoStatusBlock->Information));
    }
    else if(IOCTL_AFD_RECV_DATAGRAM == IoControlCode)
    {
        KdPrint(("IOCTL_AFD_RECV_DATAGRAM Size:%d\n", IoStatusBlock->Information));
    }

    return Status;
}

SSDT HOOK的ZwDeviceIoControlFile,做网络接收的HOOK,
看一些文章说 IoStatusBlock->Information 表示接收到的字节数,但我这边的输出除首次接收外几乎总是错误的:
00000001        0.00000000        IOCTL_AFD_RECV Size:21       
00000002        0.00053554        IOCTL_AFD_RECV Size:1027       
00000003        1.99772573        IOCTL_AFD_RECV Size:1027       
00000004        3.99766707        IOCTL_AFD_RECV Size:1027       
00000005        5.99776459        IOCTL_AFD_RECV Size:18481052       
00000006        7.99785948        IOCTL_AFD_RECV Size:1027       
00000007        9.99797726        IOCTL_AFD_RECV Size:1027       
00000008        11.99815083        IOCTL_AFD_RECV Size:1027       
00000009        13.99810982        IOCTL_AFD_RECV Size:18481052       
00000010        15.99808884        IOCTL_AFD_RECV Size:1027       
00000011        17.99811172        IOCTL_AFD_RECV Size:1027       

请问大神,这是怎么回事

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!

收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 55
活跃值: (25)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
2
udp的大部分是可行的,TCP的总是不行,有人做过吗
2013-8-7 09:07
0
雪    币: 55
活跃值: (25)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
3
afd部分的主要代码在下面:
#include <ntddk.h>

#define AFD_RECV 5
#define AFD_RECV_DATAGRAM 6
#define FSCTL_AFD_BASE FILE_DEVICE_NETWORK
#define _AFD_CONTROL_CODE(Operation, Method) ((FSCTL_AFD_BASE) << 12 | (Operation << 2) | Method)
#define IOCTL_AFD_RECV _AFD_CONTROL_CODE(AFD_RECV, METHOD_NEITHER)
#define IOCTL_AFD_RECV_DATAGRAM _AFD_CONTROL_CODE(AFD_RECV_DATAGRAM, METHOD_NEITHER)
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[*(PULONG)((PUCHAR)_function + 1)]

struct AFD_WSABUF
{
    ULONG Length;
    PCHAR Buff;
};

struct AFD_TCP_RECV_INFO
{
    struct AFD_WSABUF* BufferArray;
    ULONG BuffCount;
    ULONG AfdFlags;
    ULONG TdiFlags;
};

struct AFD_UDP_RECV_INFO
{
    struct AFD_WSABUF* BufferArray;
    ULONG BuffCount;
    ULONG AfdFlags;
    ULONG TdiFlags;
    PVOID Address;
    int* AddressLength;
};

typedef NTSTATUS (*PZwDeviceIoControlFile)(
    IN HANDLE FileHandle,
    IN HANDLE Event,
    IN PIO_APC_ROUTINE ApcRoutine,
    IN PVOID ApcContext,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    IN ULONG IoControlCode,
    IN PVOID InputBuffer,
    IN ULONG InputBufferLength,
    OUT PVOID OutputBuffer,
    IN ULONG OutputBufferLength
    );

typedef struct _ServiceDescriptorTable
{
    PULONG ServiceTableBase;
    PULONG ServiceCounterTable;
    ULONG NumberOfServices;
    ULONG ParamTableBase;
} ServiceDescriptorTable, *PServiceDescriptorTable;

__declspec(dllimport) ServiceDescriptorTable KeServiceDescriptorTable;

static PZwDeviceIoControlFile OldZwDeviceIoControlFile = 0;
static ULONG gsOldCR0;

static
void
_SetCR0()
{
    _asm mov eax, cr0
    _asm mov gsOldCR0, eax
    _asm and eax, 0xfffeffff
    _asm mov cr0, eax
    _asm cli
}

static
void
_ResetCR0()
{
    _asm sti
    _asm mov eax, gsOldCR0
    _asm mov cr0, eax
}

static
NTSTATUS
NewZwDeviceIoControlFile(
    IN HANDLE FileHandle,
    IN HANDLE Event,
    IN PIO_APC_ROUTINE ApcRoutine,
    IN PVOID ApcContext,
    OUT PIO_STATUS_BLOCK IoStatusBlock,
    IN ULONG IoControlCode,
    IN PVOID InputBuffer,
    IN ULONG InputBufferLength,
    OUT PVOID OutputBuffer,
    IN ULONG OutputBufferLength
    )
{
    NTSTATUS Status = OldZwDeviceIoControlFile(
        FileHandle,
        Event,
        ApcRoutine,
        ApcContext,
        IoStatusBlock,
        IoControlCode,
        InputBuffer,
        InputBufferLength,
        OutputBuffer,
        OutputBufferLength
        );

    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    if (IOCTL_AFD_RECV == IoControlCode)
    {
        KdPrint(("IOCTL_AFD_RECV Size:%d %d\n",
            IoStatusBlock->Information,
            OutputBufferLength
            ));
    }
    else if (IOCTL_AFD_RECV_DATAGRAM == IoControlCode)
    {
        KdPrint(("IOCTL_AFD_RECV_DATAGRAM Size:%d %d\n", IoStatusBlock->Information, OutputBufferLength));
    }

    return Status;
}

NTSTATUS
DriverEntry(
    __in PDRIVER_OBJECT DriverObject,
    __in PUNICODE_STRING RegistryPath
    )
{
    _SetCR0();
    OldZwDeviceIoControlFile = (PZwDeviceIoControlFile)(SYSTEMSERVICE(ZwDeviceIoControlFile));
    (PZwDeviceIoControlFile)(SYSTEMSERVICE(ZwDeviceIoControlFile)) = NewZwDeviceIoControlFile;
    _ResetCR0();

    return STATUS_SUCCESS;
}
2013-8-7 15:22
0
游客
登录 | 注册 方可回帖
返回
//