-
-
[原创]进程保护
-
发表于:
2009-5-9 09:00
16878
-
可能现在没什么人弄进程保护了...发一段代码...里面某些变量对不上意义...因为之前HOOK 别的函数...懒得改名了..将就
#include "ntddk.h"
#include "myh.h"
/*
//可能有MP后不起作用了
*/
UCHAR *
PsGetProcessImageFileName(
__in PEPROCESS Process
);
typedef VOID (FASTCALL *KIINSERTQUEUEAPC)(IN PKAPC Apc,IN KPRIORITY Increment);
KIINSERTQUEUEAPC g_OldKiInsertQueueApc;
ULONG g_OldObpAllocateObjectOffset;
ULONG* g_TargetMmExchangeValue;
BOOLEAN bIsHook=FALSE;
VOID FASTCALL Fake_KiInsertQueueApc(IN PKAPC Apc,IN KPRIORITY Increment)
{
ULONG pTargetThread;
ULONG pTargetProcess;
UCHAR *pTargetProcessName;
if(MmIsAddressValid((PULONG)((ULONG)Apc+0x008)))
pTargetThread=*((PULONG)((ULONG)Apc+0x008)); // +0x008 Thread : Ptr32 _KTHREAD
if(MmIsAddressValid((PULONG)((ULONG)pTargetThread + 0x044 )))
pTargetProcess =*((PULONG)((ULONG)pTargetThread + 0x044 )); //+0x034 ApcState : _KAPC_STATE
pTargetProcessName=PsGetProcessImageFileName((PEPROCESS)pTargetProcess);
if((_stricmp(pTargetProcessName,"notepad.exe")==0)&&(Increment==2))
//DbgPrint("hi---notepad.ex ");
return;
// return ;
// DbgPrint("hi--- ");
g_OldKiInsertQueueApc(Apc,Increment);
}
VOID MmExchangeValue(PULONG Target,ULONG Value)
{
KIRQL oldIrql;
oldIrql = KeRaiseIrqlToDpcLevel(); //注意自旋锁
__asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
InterlockedExchange(Target,Value);
__asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
KeLowerIrql(oldIrql);
}
BOOLEAN HookKiInsertQueueApc()
{
BYTE* FunctionAddress;
BYTE* CurrentAddress;
ULONG tempAddr, HookAddress,NewOffset;
PVOID KeInsertQueueApcAddr;
UNICODE_STRING Uni_ObCreateObject;
RtlInitUnicodeString(&Uni_ObCreateObject,L"KeInsertQueueApc");
KeInsertQueueApcAddr = MmGetSystemRoutineAddress(&Uni_ObCreateObject);
if(KeInsertQueueApcAddr == NULL)
return FALSE;
FunctionAddress=(BYTE*)KeInsertQueueApcAddr;
for(CurrentAddress=FunctionAddress;CurrentAddress<FunctionAddress+0x200; CurrentAddress++)
{
if(MmIsAddressValid((BYTE*)CurrentAddress))
if(*(BYTE*)CurrentAddress==0x28&&*(BYTE*)(CurrentAddress+1)==0xe8)
{
tempAddr = *(ULONG*)(CurrentAddress+2);
if(MmIsAddressValid((ULONG*)((BYTE*)(CurrentAddress+1)+1)))
{
if(tempAddr&0x10000000)
{
NewOffset = (ULONG)Fake_KiInsertQueueApc+0xFFFFFFFB-(ULONG)(CurrentAddress+1);
g_OldObpAllocateObjectOffset = *(ULONG*)((BYTE*)(CurrentAddress+2));
HookAddress=*(ULONG*)((BYTE*)(CurrentAddress+2))+(ULONG)(CurrentAddress+1)-0xFFFFFFFB;
g_TargetMmExchangeValue = (ULONG*)((BYTE*)(CurrentAddress+2));
//DbgPrint("hi--- %x",HookAddress);
MmExchangeValue((ULONG*)((BYTE*)(CurrentAddress+2)),NewOffset);
bIsHook =TRUE;
}
else
{
NewOffset = (ULONG)Fake_KiInsertQueueApc-(ULONG)(CurrentAddress+1)-5;
g_OldObpAllocateObjectOffset = *(ULONG*)((BYTE*)(CurrentAddress+2));
HookAddress=*(ULONG*)((BYTE*)(CurrentAddress+2))+(ULONG)(CurrentAddress+1)+5;
g_TargetMmExchangeValue = (ULONG*)((BYTE*)(CurrentAddress+2));
MmExchangeValue((ULONG*)((BYTE*)(CurrentAddress+2)),NewOffset);
bIsHook =TRUE;
}
g_OldKiInsertQueueApc = (KIINSERTQUEUEAPC)HookAddress;
//DbgPrint("hi--- %x", g_OldObpAllocateObject);
break;
}
}
}
return TRUE;
}
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
VOID Unload(PDRIVER_OBJECT DriverObject)
{
if(bIsHook ==TRUE)
MmExchangeValue(g_TargetMmExchangeValue,g_OldObpAllocateObjectOffset);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING str)
{
HookKiInsertQueueApc();
DriverObject->DriverUnload = Unload;
return STATUS_SUCCESS;
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
