#include "MyKeyHook.h"
///////////////////////////////////////////////////
// IDT structures
///////////////////////////////////////////////////
#pragma pack(1)
// entry in the IDT, this is sometimes called
// an "interrupt gate"
typedef struct
{
unsigned short LowOffset;
unsigned short selector;
unsigned char unused_lo;
unsigned char segment_type:4; //0x0E is an interrupt gate
unsigned char system_segment_flag:1;
unsigned char DPL:2; // descriptor privilege level
unsigned char P:1; /* present */
unsigned short HiOffset;
} IDTENTRY;
/* sidt returns idt in this format */
typedef struct
{
unsigned short IDTLimit;
unsigned short LowIDTbase;
unsigned short HiIDTbase;
} IDTINFO;
#pragma pack()
unsigned long old_ISR_pointer;
unsigned char keystroke_buffer[MAX_CHARS];
int kb_array_ptr=0;
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
IDTINFO idt_info;
IDTENTRY* idt_entries;
// char _t[255];
// load idt_info
__asm sidt idt_info
idt_entries = (IDTENTRY*) MAKELONG(idt_info.LowIDTbase,idt_info.HiIDTbase);
DbgPrint("UnHooking Interrupt...");
// restore the original interrupt handler
__asm cli
idt_entries[kb_int].LowOffset = (unsigned short) old_ISR_pointer;
idt_entries[kb_int].HiOffset = (unsigned short)((unsigned long)old_ISR_pointer >> 16);
__asm sti
DbgPrint("UnHooking Interrupt complete.");
DbgPrint("Keystroke Buffer is: ");
DbgPrint("%s", keystroke_buffer);
}
#pragma data_seg()
LARGE_INTEGER gl_CurrentTime;
#pragma data_seg()
LARGE_INTEGER result;
KIRQL irql,irql2;
void __stdcall print_timecount()
{
result=KeQueryPerformanceCounter(&gl_CurrentTime);
DbgPrint("my___________________________________Hook%16u %16u\n",result.HighPart,result.LowPart); //经测试，在有其它线程运行时，由于此处发生蓝屏，为什么？？？？？？？？？
//如果没有其它线程运行，则此IDT HOOK正常运行
}
__declspec(naked) my_interrupt_hook()
{
__asm
{
cli
pushad // save all general purpose registers
pushfd // save the flags register
}
__asm call print_timecount
__asm
{
popfd // restore the flags
popad // restore the general registers
sti
jmp old_ISR_pointer // goto the original ISR
}
}
#pragma INITCODE
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
IDTINFO idt_info;
IDTENTRY* idt_entries;
// char _t[255];
theDriverObject->DriverUnload = OnUnload;
kb_int= 0x93;//为本机键盘中断号
DbgPrint("kb_int = 0x%02X\n", kb_int);
// load idt_info
__asm sidt idt_info
idt_entries = (IDTENTRY*) MAKELONG(idt_info.LowIDTbase,idt_info.HiIDTbase);
DbgPrint("Hooking Interrupt...");
old_ISR_pointer = MAKELONG(idt_entries[kb_int].LowOffset,idt_entries[kb_int].HiOffset);
// remember we disable interrupts while we patch the table
__asm cli
idt_entries[kb_int].LowOffset = (unsigned short)my_interrupt_hook;
idt_entries[kb_int].HiOffset = (unsigned short)((unsigned long)my_interrupt_hook >> 16);
__asm sti
DbgPrint("Hooking Interrupt complete: Old = 0x%08X, New = 0x%08X\n", old_ISR_pointer, my_interrupt_hook);
_asm int 0x93;
return STATUS_SUCCESS;
}
[课程]FART 脱壳王！加量不加价！FART作者讲授！
