.386
.model flat, stdcall
option casemap:none

include ntstatus.inc
include ntddk.inc
include ntoskrnl.inc
include w2kundoc.inc
includelib ntoskrnl.lib
include \RadASM\Masm\Macro\Strings.asm

.data
realaddr dd 0
CR0Reg dd 0
Messaga1 db "OpenProcess",0
Messaga2 db "Driver loaded", 0

.code
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING
local pDeviceObject:PVOID

pushad
invoke DbgPrint, addr Messaga2
mov edi, KeServiceDescriptorTable
mov edi, [edi]
mov eax, [edi+(06ah*4)] ;edi+07ah*4 - NtOpenProcess
mov realaddr, eax       ;看了网上资料说是200的服务号是6a，就改了

cli
mov eax, CR0
mov CR0Reg, eax
and eax, -1
mov cr0, eax
mov [edi+(06ah*4)], dword ptr offset hookproc
mov eax, CR0Reg
mov CR0, eax
sti

mov eax, pDriverObject
assume eax:PTR DRIVER_OBJECT
mov [eax].DriverUnload, offset DriverUnload
assume eax:nothing

popad
mov eax, STATUS_SUCCESS
ret
DriverEntry endp
;:::::::::::::::::::::::::::::::::::::::::::::::::::::
DriverUnload proc pDriverObject:PDRIVER_OBJECT
pushad
mov edi, KeServiceDescriptorTable
mov edi, [edi]
;得到地址
mov eax, CR0
mov CR0Reg, eax
and eax, -1
mov cr0, eax
;这里应该是允许修改代码
mov eax, dword ptr realaddr
mov [edi+(06ah*4)], eax

mov eax, CR0Reg
mov CR0, eax
sti
popad
ret
DriverUnload endp
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
hookproc proc                          ;这里始终来不了，本来自己的是xp
invoke DbgPrint, addr Messaga1         ;想想可能是服务号不同吧
jmp dword ptr realaddr         ;改了6a放到2000vm里面了，还是没看到输出
; ret
hookproc endp
;::::::::::::::::::::::::::::::::::::::::::::::::::::::::
end DriverEntry

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课