不说啥= = 语文不好 直接放码
.H
#include <ntddk.h>
typedef struct _SYSTEM_SERVICE_TABLE{
PVOID ServiceTableBase;
PVOID ServiceCounterTableBase;
SIZE_T NumberOfServices;
PVOID ParamTableBase;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;
typedef NTSTATUS(__fastcall * pfnEnumObjectTable)(PVOID64 HANDLETABLE, PVOID CALLback, ULONG64 unKonw);
typedef BOOLEAN(__fastcall *ENUMPROCESSCALLBACK)(ULONG64 EPROCESS);
typedef struct _SERVICE_DESCRIPTOR_TABLE{
SYSTEM_SERVICE_TABLE ntoskrnl; // ntoskrnl.exe (native api)
SYSTEM_SERVICE_TABLE win32k; // win32k.sys (gdi/user)
SYSTEM_SERVICE_TABLE Table3; // not used
SYSTEM_SERVICE_TABLE Table4; // not used
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;
typedef struct _KAPC_STATE
{
LIST_ENTRY ApcListHead[2];
PVOID Process;
BOOLEAN KernelApcInProgress;
BOOLEAN KernelApcPending;
BOOLEAN UserApcPending;
}KAPC_STATE, *PKAPC_STATE;
typedef struct _OBJECT_HANDLE_FLAG_INFORMATION{
BOOLEAN Inherit;
BOOLEAN ProtectFromClose;
}OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION;
NTKERNELAPI CHAR* PsGetProcessImageFileName(PEPROCESS Process);
NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process);
NTKERNELAPI NTSTATUS PsLookupThreadByThreadId(HANDLE Id, PETHREAD *Thread);
NTKERNELAPI PEPROCESS IoThreadToProcess(PETHREAD Thread);
NTKERNELAPI NTSTATUS ObSetHandleAttributes(HANDLE Handle, POBJECT_HANDLE_FLAG_INFORMATION HandleFlags, KPROCESSOR_MODE PreviousMode);
NTKERNELAPI VOID KeStackAttachProcess(PEPROCESS PROCESS, PKAPC_STATE ApcState);
NTKERNELAPI VOID KeUnstackDetachProcess(PKAPC_STATE ApcState);
typedef struct _HANDLE_TABLE_ENTRY{
union{
PVOID64 Object;
ULONG32 ObAttributes;
PVOID64 InfoTable;
ULONG64 Value;
};
union{
ULONG32 GrantedAccess;
struct{
UINT8 GrantedAccessIndex;
UINT8 CreatorBackTraceIndex;
};
ULONG32 NextFreeTableEntry;
};
}HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;
ULONGLONG GetKeServiceDescriptorTable64()
{
char KiSystemServiceStart_pattern[13] = "\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x25\xFF\x0F\x00\x00";
ULONGLONG CodeScanStart = (ULONGLONG)&_strnicmp;
ULONGLONG CodeScanEnd = (ULONGLONG)&KdDebuggerNotPresent;
UNICODE_STRING Symbol;
ULONGLONG i, tbl_address, b;
for (i = 0; i < CodeScanEnd - CodeScanStart; i++)
{
if (!memcmp((char*)(ULONGLONG)CodeScanStart + i, (char*)KiSystemServiceStart_pattern, 13))
{
for (b = 0; b < 50; b++)
{
tbl_address = ((ULONGLONG)CodeScanStart + i + b);
if (*(USHORT*)((ULONGLONG)tbl_address) == (USHORT)0x8d4c)
return ((LONGLONG)tbl_address + 7) + *(LONG*)(tbl_address + 3);
}
}
}
return 0;
}
ULONGLONG GetSSDTFuncCurAddr(ULONG id, PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable)
{
LONG dwtmp = 0;
PULONG ServiceTableBase = NULL;
ServiceTableBase = (PULONG)KeServiceDescriptorTable->ServiceTableBase;
dwtmp = ServiceTableBase[id];
dwtmp = dwtmp >> 4;
return dwtmp + (ULONGLONG)ServiceTableBase;
}
ULONG GetOffsetAddress(ULONGLONG FuncAddr, PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable)
{
LONG dwtmp = 0;
PULONG ServiceTableBase = NULL;
ServiceTableBase = (PULONG)KeServiceDescriptorTable->ServiceTableBase;
dwtmp = (LONG)(FuncAddr - (ULONGLONG)ServiceTableBase);
return dwtmp << 4;
}
SRC
#include <ntddk.h>
#include<struct.h>
pfnEnumObjectTable EnumObjectTable;
ULONG64 targetprocess;
ULONG64 targetDebugprocess;
ULONG64 Targethandle;
ULONG64 SreachFunctionAddress(ULONG64 uAddress, UCHAR *Signature)
{
ULONG64 index;
UCHAR *p;
ULONG64 uRetAddress;
if (uAddress == 0){ return 0; }
p = (UCHAR*)uAddress;
for (index = 0; index<0x3000; index++)
{
if (*p == Signature[0] &&
*(p + 1) == Signature[1] &&
*(p + 2) == Signature[2] &&
*(p + 3) == Signature[3] &&
*(p + 4) == Signature[4])
{
uRetAddress = p + 4;
uRetAddress = *(ULONG*)(uRetAddress + 1) + uRetAddress + 5;
return uRetAddress;
}
p++;
#if defined(_DEBUG)
DbgPrint("++ %p ", p);
#endif
}
return 0;
}
//用于搜索进程 编码仅限于win7X64
ULONG64 Search64Process(char *szProcessName, ULONG64 callBackFUNC)
{
ULONG64 pEprocess, LastProcess;
ULONG64 Current_Pid;
ULONG64 Start_Pid;
int index;
PLIST_ENTRY64 pList_Active_Process;
if (!MmIsAddressValid(szProcessName))
return 0;
index = 0;
pEprocess = (ULONG64)PsGetCurrentProcess();
Start_Pid = *(ULONG64*)(pEprocess + 0x180);
Current_Pid = Start_Pid;
while (TRUE)
{
LastProcess = pEprocess;
pList_Active_Process = (PLIST_ENTRY)(pEprocess + 0x188);
pEprocess = (ULONG64)pList_Active_Process->Flink;
pEprocess = pEprocess - 0x188;
Current_Pid = *(ULONG64*)(pEprocess + 0x180);
if (MmIsAddressValid(callBackFUNC) && callBackFUNC != 0){
((ENUMPROCESSCALLBACK)callBackFUNC)(LastProcess);
}
if ((Current_Pid == Start_Pid) && index>0)
{
return 0;
}
else if (strstr((char*)LastProcess + 0x2e0, szProcessName) != 0)
{
return LastProcess;
}
index++;
}
return 0;
}
VOID __fastcall ForceCloseHandle(PEPROCESS Process, ULONG64 HandleValue)
{
HANDLE h;
KAPC_STATE ks;
OBJECT_HANDLE_FLAG_INFORMATION ohfi;
if (Process == NULL)
return;
if (!MmIsAddressValid(Process))
return;
KeStackAttachProcess(Process, &ks);
h = (HANDLE)HandleValue;
ohfi.Inherit = 0;
ohfi.ProtectFromClose = 0;
ObSetHandleAttributes(h, &ohfi, KernelMode);
ZwClose(h);
KeUnstackDetachProcess(&ks);
}
BOOLEAN __fastcall enumObjectCallBack(PHANDLE_TABLE_ENTRY object, PHANDLE handle, ULONG64 Unkonw){
ULONG32 debugobject;
debugobject = (ULONG32)*(UINT8*)((ULONG64)(object->Object) + 0x18);
#if defined(_DEBUG)
DbgPrint("type :%d", debugobject);
#endif
if (debugobject == 0xb)
{
#if defined(_DEBUG)
DbgPrint("~ Targetprocess :%p ,ProcessName: %s", targetprocess, PsGetProcessImageFileName(targetprocess));
#endif
targetDebugprocess = targetprocess;
Targethandle = handle;
}
return FALSE;
}
ENUMPROCESSCALLBACK ex_ENUMPROCESSCALLBACK(ULONG64 EPROCESS){
ULONG64 temp64;
if (MmIsAddressValid(EPROCESS)){
targetprocess = EPROCESS;
temp64 = *(ULONG64*)((ULONG64)EPROCESS + 0x200);
if (MmIsAddressValid(temp64)){
EnumObjectTable(temp64, enumObjectCallBack, 1);
}
}
}
void DriverUnload(PDRIVER_OBJECT pDriverObject)
{
__asm{xor eax,eax}
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pReg)
{ UCHAR opcode[5] = { 0x89, 0x6c, 0x24, 0x30, 0xe8 };
NTSTATUS state = STATUS_SUCCESS;
UNICODE_STRING64 ObFindHandleForObjectsign;
PSYSTEM_SERVICE_TABLE systable;
ULONG64 temp64 = 0;
DbgPrint("Super game protect loading~\n");
pDriverObject->DriverUnload = DriverUnload;
RtlInitUnicodeString(&ObFindHandleForObjectsign, L"ObFindHandleForObject");//ObFindHandleForObject PAGE 0000000140319DB0 000000B4 00000048 00000028 R . . . . . .
temp64 = (ULONG64)MmGetSystemRoutineAddress(&ObFindHandleForObjectsign);
if (!MmIsAddressValid(temp64))
return state;
EnumObjectTable = (pfnEnumObjectTable)SreachFunctionAddress(temp64, opcode);
if (!MmIsAddressValid(EnumObjectTable))
return state;
DbgPrint("Super game protect start~\n");
Search64Process("xxxaaass.exe", ex_ENUMPROCESSCALLBACK);
ForceCloseHandle(targetDebugprocess, Targethandle);
systable=GetKeServiceDescriptorTable64();
DbgPrint("NTSuspendProcess address : %p\n", GetSSDTFuncCurAddr(378, systable));
return state;
}
enumprocesshandle ==debugobject xxxxx
下面是 KIUSER
__declspec(naked)void KiUserExceptionDispatcher(){
__asm{
cld
push[esp + 4]
push[esp]
call KiUserExceptionDispatcher_BT
}
}
DWORD dwoldKiuserExceptionDispatcher = NULL;
__declspec(naked)void KiUserExceptionDispatcher_asm(){
__asm{
cld
pushfd
push ecx
mov ecx, [esp + 0xc]
mov pc, ecx
pop ecx
popfd
pushfd
push ebx
mov ebx, [esp+0x8]
mov px, ebx
pop ebx
popfd
}
pc->Dr0 = 0;
pc->Dr1 = 0;
pc->Dr2 = 0;
pc->Dr3 = 0;
pc->Dr7 = 0;
__asm{
pushfd
pushad
}
__asm{
mov edx, dword ptr[px]
mov edx, dword ptr[edx+0xc]
mov ebx, dword ptr[dllsize]
add ebx, dword ptr[dllbase]
cmp dword ptr[dllbase],edx
ja xxxx
cmp ebx, edx
jb xxxx
popad
popfd
__asm jmp dword ptr[dwoldKiuserExceptionDispatcher]
}
__asm{
xxxx:
popad
popfd
cld
mov ecx, [esp + 4]
mov ebx, [esp]
mov px, ebx
push ecx
push ebx
call PfnCall97B
or al,al
jz loc_53
pop ebx
pop ecx
push 0
push ecx
call NtContinue
loc_53:
pop ebx
pop ecx
push 0
push ecx
push ebx
call NtRaiseException
add esp, 0FFFFFFECh
mov[esp],eax
mov[esp+4],1
mov[esp+8],ebx
mov[esp+10],0
push esp; ExceptionRecord
call dwRtlRaiseException
ret 8
lea ecx, [ecx+0]
}
}
[课程]Android-CTF解题方法汇总！
