能力值:
( LV2,RANK:10 )
|
-
-
2 楼
干鸡 关注火哥不迷茫 火哥带你上高速
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
好
|
能力值:
( LV2,RANK:10 )
|
-
-
4 楼
你这个是攻 来个守 BOOLEAN AddGdtItemCodeOrData(USHORT Selector,ULONG Base,ULONG attr) { char g_gdt[6] = {0}; //单核的 __asm { sgdt g_gdt; }
ULONG gdtBase = *(ULONG*)&g_gdt[2]; USHORT gdtLimit = *(USHORT*)&g_gdt[0] & 0xfff8; Selector = Selector & 0xfff8; if (Selector > gdtLimit) { KdPrint(("line %d AddGdtItemCodeOrData\r\n", __LINE__)); return FALSE; }
PLARGE_INTEGER pItem = (PLARGE_INTEGER)(gdtBase + Selector);
pItem->LowPart = ((Base & 0xffff) << 16) | 0xffff; pItem->HighPart = (Base & 0xff000000) | (attr << 8) | ((Base & 0xff0000) >> 16);
return TRUE; }
BOOLEAN AddGdtItemCate(USHORT Selector, USHORT GotoSelector,ULONG Offset, ULONG attr) { char g_gdt[6] = { 0 }; __asm { sgdt g_gdt; }
ULONG gdtBase = *(ULONG*)&g_gdt[2]; USHORT gdtLimit = *(USHORT*)&g_gdt[0] & 0xfff8; Selector = Selector & 0xfff8;
if (Selector > gdtLimit) { KdPrint(("line %d AddGdtItemCate\r\n", __LINE__)); return FALSE; }
PLARGE_INTEGER pItem = (PLARGE_INTEGER)(gdtBase + Selector);
pItem->LowPart = (Offset & 0xffff) | (GotoSelector << 16); pItem->HighPart = (Offset & 0xffff0000) | (attr & 0xffff);
return TRUE; }
ULONG GetIdtFuncById(ULONG idtId) { char g_idt[6] = { 0 };
__asm { sidt g_idt; }
ULONG idtBase = *(ULONG*)&g_idt[2]; USHORT idtLimit = *(USHORT*)&g_idt[0] & 0xfff8; idtId = idtId <= 0 ? 0 : idtId * 8;
if (idtId > idtLimit) { KdPrint(("line %d GetIdtFuncById\r\n", __LINE__)); return 0; }
PLARGE_INTEGER pItem = (PLARGE_INTEGER)(idtBase + idtId);
return (pItem->HighPart & 0xffff0000) | (pItem->LowPart & 0xffff); }
BOOLEAN UpDateIdtItemSelector(ULONG idtId,USHORT Selector,USHORT * OldSelector) { char g_idt[6] = { 0 }; //单核的
__asm { sidt g_idt; }
ULONG idtBase = *(ULONG*)&g_idt[2]; USHORT idtLimit = *(USHORT*)&g_idt[0] & 0xfff8; idtId = idtId <= 0 ? 0 : idtId * 8;
if (idtId > idtLimit) { KdPrint(("line %d GetIdtFuncById\r\n", __LINE__)); return FALSE; }
PLARGE_INTEGER pItem = (PLARGE_INTEGER)(idtBase + idtId); if (OldSelector != NULL) { *OldSelector = (pItem->LowPart & 0xffff0000) >> 16; }
pItem->LowPart = (pItem->LowPart & 0xffff) | (Selector << 16);
return TRUE; }
ULONG IdtFilter(ULONG idtId) { KdPrint(("int %d\r\n", idtId));
return GetIdtFuncById(idtId); }
char g_callCate[6] = {0,0,0,0,0x90,0};
void __declspec(naked) CallCateFunc() { __asm { pushfd; pushad; push fs; push 0x30; pop fs;
push [esp + 0x28]; call IdtFilter; mov [esp + 0x28], eax; pop fs; popad; popfd;
add esp, 4; jmp [esp - 4]; } }
void __declspec(naked) Int3Hook() { __asm { push 3; jmp fword ptr g_callCate } }
BOOLEAN HookIdt(ULONG idtId,ULONG newFunc,USHORT Selector,USHORT GateSelector,USHORT * OldSelector) { ULONG funcOffset =GetIdtFuncById(idtId); ULONG Base = newFunc - funcOffset; if (AddGdtItemCodeOrData(Selector, Base, 0xcf9b)) { //添加调用门 if (AddGdtItemCate(GateSelector, 0x8, (ULONG)CallCateFunc, 0xec00)) { return UpDateIdtItemSelector(idtId, Selector, OldSelector); } }
return FALSE; }
VOID DriverUpload(PDRIVER_OBJECT pDriver) { UpDateIdtItemSelector(3, 0x8, NULL); KdPrint(("DriverUpload fuck over\r\n")); }
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING pReg) { pDriver->DriverUnload = DriverUpload; KdPrint(("DriverEntry continue fuck\r\n")); if (!HookIdt(3, (ULONG)Int3Hook, 0x48, 0x90, NULL)) { KdPrint(("func !! Hook int 3 failed\r\n")); } return STATUS_SUCCESS; }
|
能力值:
( LV2,RANK:10 )
|
-
-
5 楼
lock cmpxchg8b 本来就是原子指令,前面不需要cli,也不需要提高中断等级
|
能力值:
( LV1,RANK:0 )
|
-
-
6 楼
lock可以不加 加也没事 加着玩的 锁缓存看心情
|
能力值:
( LV2,RANK:10 )
|
-
-
7 楼
干鸡
|