请看代码：
/*******************************************************
*获取IDT表放入全局表中
***********************************************************/
void GetIDTAddr()
{
unsigned long count;
IDT_INFO idt_info;
IDT_ENTRY *idt_entries;
__asm sidt idt_info
//取得idt_info中的函数地址
idt_entries = (IDT_ENTRY*)MAKELONG(idt_info.IdtLow,idt_info.IdtHigh);
for(count=0;count<256;count++)
{
//DbgPrint("ROOTKIT: OnUnload called\n");
char _t[255];
IDT_ENTRY *i=&idt_entries[count];
unsigned long addr=0;
addr=MAKELONG(i->LowOffset,i->HiOffset);
g_aIDT[count] = addr;
}
}
/**********************************************
*函数名称：CheckIDThook
*功能：检查IDT表是否改变
************************************************/
void CheckIDThook()
{
unsigned long count;
IDT_INFO idt_info;
IDT_ENTRY *idt_entries;
unsigned long ul_Fution;
__asm sidt idt_info
//取得idt_info中的函数地址
idt_entries = (IDT_ENTRY*)MAKELONG(idt_info.IdtLow,idt_info.IdtHigh);
DbgPrint("ROOTKIT: IDTINTERUPT called\n");
//g_aIDT =(int *) ExAllocatePool(PagedPool,256*4);
for(count=0;count<256;count++)
{
//DbgPrint("ROOTKIT: OnUnload called\n");
char _t[255];
IDT_ENTRY *i=&idt_entries[count];
unsigned long addr=0;
ul_Fution=MAKELONG(i->LowOffset,i->HiOffset);
if(g_aIDT[count] != ul_Fution)
{
if(g_aIDT[count] != 0)
{
_asm
{ push eax
CLI //dissable interrupt
MOV EAX, CR0 //move CR0 register into EAX
AND EAX, 0FFFEFFFFh //disable WP bit
MOV CR0, EAX //write register back
pop eax
}
addr = g_aIDT[count] - ul_Fution - 5;
//*( (char *)(&((unsigned char *)ul_Fution)[5]) )=0x5b;
*( (char *)(&((unsigned char *)ul_Fution)[0]) )=0xe9;
*( (unsigned long *)(&((unsigned char *)ul_Fution)[1]) ) = addr;
_asm
{
push eax
MOV EAX, CR0 //move CR0 register into EAX
OR eax,10000H //enable WP bit
MOV CR0, EAX //write register back
STI //enable interrupt
pop eax
}
DbgPrint("writed %08x sucessful!\n",ul_Fution);
}
}
}
}
用Dbgview.exe观察到输出的语句了，但是过了2-3秒后就蓝屏了，
错误PAGE_FAULT_IN_NONPAGED_AREA
这应该是内存读取的错误，但是我JMP回原来的处理函数，内存应该没有问题呀！
我不喜欢在虚拟机上测试，一直蓝一直蓝我都忙晕了
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
