Hooking KiFastSystemCall

最新推荐文章于 2024-10-16 11:08:37 发布

转载最新推荐文章于 2024-10-16 11:08:37 发布 · 2.9k 阅读

文章标签：

#hook #function #windows

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一个针对 KiFastSystemCall 的 hook 实现方法，通过覆盖特定 API 调用来实现内存保护级别的修改。该 hook 方法利用了 madCodeHook 库，并详细展示了如何拦截 ZwProtectVirtualMemory 函数调用。

program KiFastSystemCall;

uses
Windows, madCodeHook, SysUtils;

var
realKiFastSystemCall: procedure;
dwIndexPVM: DWORD;

function hookZwProtectVirtualMemory(hProcess: THandle; lpAddress: Pointer; dwSize, flNewProtect: DWORD; lpflOldProtect: Pointer): DWORD; stdcall;
var
Stack1, Stack2: DWORD;
begin
Result := 0;
MessageBoxA(0, PChar(IntToHex(DWORD(lpAddress), 8)), 'ZwProtectVirtualMemory', 0);
asm
pop eax
mov [Stack1], eax
pop eax
mov [Stack2], eax
mov eax, [dwIndexPVM]
call realKiFastSystemCall
mov [Result], eax
push [Stack2]
push [Stack1]
end;
end;

procedure hookKiFastSystemCall; assembler;
label
CallPVM;
begin
asm
cmp eax, [dwIndexPVM]
je @CallPVM
jmp realKiFastSystemCall
@CallPVM:
pop eax
jmp hookZwProtectVirtualMemory
end;
end;

begin
MessageBoxA(0, 'You need to call me once before you install the hook, otherwise I don''t initialize properly.', 'MessageBoxA Bug Fix', 0);
dwIndexPVM := PDWORD(DWORD(GetProcAddress(GetModuleHandle('ntdll.dll'), 'ZwProtectVirtualMemory'))+1)^;
HookAPI('ntdll.dll', 'KiFastSystemCall', @hookKiFastSystemCall, @realKiFastSystemCall);
end.