Windows内核试验13_系统调用

ReadMem

HookBase

#include<stdio.h>
#include<stdlib.h>
#include<Windows.h>
DWORD Target[3] = { 0x8003f120,0x8003f1c0,0x8003f200 };
DWORD* ServiceTable = (DWORD*)0x8003f3c0;
void SystemCallEntry();
void ReadMem();
void AllocMem();
int i;
char* p;

void __declspec(naked) IdtEntry() {
	p = (char*)Target[0];
	for (i = 0; i < 128; i++) {
		*p = ((char*)SystemCallEntry)[i];
		p++;
	}
	
	p = (char*)Target[1];
	for (i = 0; i < 64; i++) {
		*p = ((char*)ReadMem)[i];
		p++;
	}
	p = (char*)Target[2];
	for (i = 0; i < 64; i++) {
		*p = ((char*)AllocMem)[i];
		p++;
	}
	ServiceTable[0] = 0x8003f1c0;
	ServiceTable[1] = 0x8003f200;

	__asm {
		mov eax,0x0008f120
		mov ds:[0x8003f508],eax
		mov eax,0x8003ee00
		mov ds : [0x8003f50C] , eax
	}


	__asm {
		iretd
	}

}

void __declspec(naked) SystemCallEntry() {
	__asm {
		push 0x30
		pop fs
		sti

		mov ebx,ss:[esp+0xC]
		mov ecx,ds:[ebx+4]
		mov ebx,0x8003f3c0
		mov edx,ds:[ebx+eax*4]
		call edx

		cli
		push 0x3b
		pop fs
		iretd
	}
}

void __declspec(naked) ReadMem() {
	__asm {
		mov eax,ds:[ecx]
		ret
	}
}
void __declspec(naked) AllocMem() {
	__asm {
		push ecx
		push 0
		mov eax,0x8053454C
		call eax
		ret
	}

}
void go() {
	__asm int 0x20
}
// eq 8003f500 0040ee00`00081040

void main() {
	if ((DWORD)IdtEntry != 0x401040) {
		printf("wrong address:%p", IdtEntry);
		exit(-1);
	}
	go();

}

InlineHook3

#include <iostream>
#include<Windows.h>

DWORD ReadMem(DWORD addr);
DWORD AllocMem(DWORD size);

DWORD __declspec(naked) ReadMem(DWORD addr) {
    __asm {
        mov eax,0
        int 0x21
        ret
    }
}



DWORD __declspec(naked) AllocMem() {
    __asm {
        mov eax, 1
        int 0x21
        ret
    }
}
// eq 8003f508 8003ee00`0008f120

int main()
{
    printf("%p\n", ReadMem(0x8003f3c8));
    printf("%p\n", AllocMem(16));
    system("pause");
}

AllocMem