-
-
[求助]win7，32位 hook ssdt 的奇怪问题
-
发表于:
2014-3-18 17:47
8633
-
[求助]win7，32位 hook ssdt 的奇怪问题
BOOL HookSSDT()
{
DWORD dwMajorVer = 0;
DWORD dwMinorVer = 0;
PMDL pMdlSystemCall = NULL;
DWORD * MappedSystemCallTable = 0;
int veroffset = 0x35; //默认xp的NtCreateThread偏移
PsGetVersion(&dwMajorVer,&dwMinorVer,NULL,NULL);
if (dwMajorVer != 5 || dwMinorVer !=1)//(dwMajorVer = 5,dwMinorVer = 1,xp)
{
veroffset = 0x57; //win7的偏移量NtCreateThread为0x57
}
pMdlSystemCall = IoAllocateMdl(
KeServiceDescriptorTable->ntoskrnl.ServiceTable,
KeServiceDescriptorTable->ntoskrnl.CounterTable*4,
0,
0,
NULL
);
MmBuildMdlForNonPagedPool(pMdlSystemCall);
MappedSystemCallTable=(DWORD *)MmMapLockedPages(pMdlSystemCall, KernelMode);
RealNtCreateThread = (NT_CREATE_THREAD)InterlockedExchange(
(volatile LONG *)&(MappedSystemCallTable[veroffset]),(ULONG)HookedNtCreateThread); //[0x35]
IoFreeMdl(pMdlSystemCall);
return TRUE;
}
xp下的服务号由以下得出:
windbg 下看出
0:000> u NtCreateThread
ntdll!ZwCreateThread:
7c92d1ae b835000000 mov eax,35h
7c92d1b3 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d1b8 ff12 call dword ptr [edx]
7c92d1ba c22000 ret 20h
7c92d1bd 90 nop
ntdll!ZwCreateTimer:
7c92d1be b836000000 mov eax,36h
7c92d1c3 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
7c92d1c8 ff12 call dword ptr [edx]
win7下的服务号由以下得出:
0:000> u NtCreateThread
ntdll!NtCreateThread:
779a4b60 b857000000 mov eax,57h
779a4b65 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
779a4b6a ff12 call dword ptr [edx]
779a4b6c c22000 ret 20h
779a4b6f 90 nop
ntdll!ZwCreateThreadEx:
779a4b70 b858000000 mov eax,58h
779a4b75 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
779a4b7a ff12 call dword ptr [edx]
0:000> u ZwCreateThreadEx
ntdll!ZwCreateThreadEx:
779a4b70 b858000000 mov eax,58h
779a4b75 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
779a4b7a ff12 call dword ptr [edx]
779a4b7c c22c00 ret 2Ch
779a4b7f 90 nop
ntdll!NtCreateTimer:
779a4b80 b859000000 mov eax,59h
779a4b85 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
779a4b8a ff12 call dword ptr [edx]
以上函数在xp上可以正常运行,但在win7上PCHunter32看到内核钩子SSDT的NtCreateThread的确实也被Hook了，但是就是没执行我的hook函数,百思不得其解啊！!
如果我把服务号换成0x58,则能执行，但会蓝屏。。。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
