NTSTATUS hk_NtUserShowSystemCursor(Reqest* req)
{
if (req == NULL || req->signature == NULL) {
LOG_INFO("return originFunc 1\n");
return oNtUserShowSystemCursor();
}
if (req->signature == 0xAB505) {
LOG_INFO("into communicate\n");
req->succeed = false;
switch (req->type)
{
case 001:
GetMoudleInfo * moudleInput = (GetMoudleInfo*)req->data;
PEPROCESS process;
KAPC_STATE ApcState;
if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)moudleInput->pid, &process)) && (PsGetProcessExitStatus(process) == STATUS_PENDING)) {
UNICODE_STRING unicodeStr = { 0 };
ANSI_STRING ansiStr;
RtlInitAnsiString(&ansiStr, moudleInput->moudleName);
RtlAnsiStringToUnicodeString(&unicodeStr, &ansiStr, TRUE);
BOOLEAN IsWow64 = (PsGetProcessWow64Process(process) != NULL) ? TRUE : FALSE;
if (MmIsAddressValid(process)) {
KeStackAttachProcess((PRKPROCESS)process, &ApcState);
ULONG moduleSize = 0;
PVOID addr = GetUserModuleInfo(process, &unicodeStr, IsWow64, &moduleSize);
LOG_INFO("moduleSize: %d\n", moduleSize);
LOG_INFO("moduleAddr: %p\n", addr);
KeUnstackDetachProcess(&ApcState);
//必须在KeUnstackDetachProcess()之后 或者KeStackAttachProcess()之前读/写参数指针 不然会蓝屏
moudleInput->moudleBaseAddress = addr;
moudleInput->moudleSize = moduleSize;
req->succeed = true;
LOG_INFO("set\n");
}
RtlFreeUnicodeString(&unicodeStr);
ObDereferenceObject(process);
}
break;
}
}
else {
LOG_INFO("return originFunc 2\n");
return oNtUserShowSystemCursor();
}
}
