经过几天的看书和网上的资料，今天终于鼓起勇气去写个想完成自己目的的代码。结果遗憾的是，蓝色恐怖围绕着我，我知道这是学习之路的最基本步伐。今天把它拿出来，希望朋友们帮助解决，不盛感激~~:eek:
#include<ntddk.h>
typedef struct _SERVICE_DESCRIPTOR_TABLE
{
PVOID ServiceTableBase;
PULONG ServiceCounterTableBase;
ULONG NumberOfService;
ULONG ParamTableBase;
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE; //由于KeServiceDescriptorTable只有一项,这里就简单点了
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;//KeServiceDescriptorTable为导出函数
/////////////////////////////////////
VOID Hook();
VOID Unhook();
VOID OnUnload(IN PDRIVER_OBJECT DriverObject);
//////////////////////////////////////
ULONG JmpAddress;//跳转到NtOpenProcess里的地址
ULONG OldServiceAddress;//原来NtOpenProcess的服务地址
//////////////////////////////////////
__declspec(naked) NTSTATUS __stdcall MyNtCreateSection(
PHANDLE SectionHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PLARGE_INTEGER SectionSize OPTIONAL,
ULONG Protect,
ULONG Attributes,
HANDLE FileHandle
)
{
DbgPrint("NtCreateSection() called");
__asm{
push 0C4h
push 804eb560h //共十个字节
jmp [JmpAddress]
}
}
///////////////////////////////////////////////////
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
DriverObject->DriverUnload = OnUnload;
DbgPrint("Unhooker load");
Hook();
return STATUS_SUCCESS;
}
/////////////////////////////////////////////////////
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Unhooker unload!");
Unhook();
}
/////////////////////////////////////////////////////
VOID Hook()
{
ULONG Address;
Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x32 * 4;//0x7A为NtOpenProcess服务ID
DbgPrint("Address:0x%08X",Address);
OldServiceAddress = *(ULONG*)Address;//保存原来NtOpenProcess的地址
DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);
DbgPrint("MyNtCreateSection:0x%08X",MyNtCreateSection);
JmpAddress = (ULONG)NtCreateSection + 10; //跳转到NtOpenProcess函数头＋10的地方，这样在其前面写的JMP都失效了
DbgPrint("JmpAddress:0x%08X",JmpAddress);
__asm{//去掉内存保护
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
*((ULONG*)Address) = (ULONG)MyNtCreateSection;//HOOK SSDT
__asm{//恢复内存保护
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}
//////////////////////////////////////////////////////
VOID Unhook()
{
ULONG Address;
Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x32 * 4;//查找SSDT
__asm{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
*((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT
__asm{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
DbgPrint("Unhook");
}
这段代码大家应该都比较了解的，我只是想改改上面的内容，实现HOOK SSDT 中的另一个函数而已。 改了8个地方：
1 MyNtCreateSection(
PHANDLE SectionHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PLARGE_INTEGER SectionSize OPTIONAL,
ULONG Protect,
ULONG Attributes,
HANDLE FileHandle
)
2 DbgPrint("NtCreateSection() called");
3 Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x32 * 4;
4 DbgPrint("MyNtCreateSection:0x%08X",MyNtCreateSection);
5 JmpAddress = (ULONG)NtCreateSection + 10;
6 *((ULONG*)Address) = (ULONG)MyNtCreateSection;
7 Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x32 * 4;
8 在头文件ntddk.h中添加了如下代码
NTSYSAPI
NTSTATUS
NTAPI
NtCreateSection(
OUT PHANDLE SectionHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PLARGE_INTEGER SectionSize OPTIONAL,
IN ULONG Protect,
IN ULONG Attributes,
IN HANDLE FileHandle
);
如果不添加的话，连sys都编译不出来。
上面改动之后到虚拟机上加载蓝屏 蓝屏 。请好心的朋友帮看看是哪里出了问题，或者怎么改。谢谢
[课程]FART 脱壳王！加量不加价！FART作者讲授！
