使用自旋锁的各种HOOK

#include <ntddk.h>#define MEM_TAG 'TMEM'typedef struct _THREAD_BASIC_INFORMA TION{NTSTATUS ExitStatus;PVOID TebBaseAddress;CLIENT_ID ClientId;KAFFINITY AffinityMask;KPRIORITY Priority;KPRIORITY BasePriority;}THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMA TION; typedef BOOL (*NTUSERPOSTTHREADMESSAGE)(DWORD idThread,UINT Msg,WPARAM wParam,LPARAM lParam);typedef NTSTATUS (*NTOPENPROCESS)(OUT PHANDLE ProcessHandle,IN ACCESS_MASK AccessMask,IN POBJECT_A TTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId);typedef NTSTATUS (*NTOPENTHREAD)(OUT PHANDLE ThreadHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_A TTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId);typedef NTSTATUS (*NTDUPLICATEOBJECT)(IN HANDLE SourceProcessHandle,IN HANDLE SourceHandle,IN HANDLE TargetProcessHandle,OUT PHANDLE TargetHandle OPTIONAL,IN ACCESS_MASK DesiredAccess,IN ULONG Attributes,IN ULONG Options);NTKERNELAPI KeAddSystemServiceTable(PVOID, PVOID, PVOID, PVOID, PVOID); NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(IN HANDLE ProcessId,OUT PEPROCESS *Process);NTKERNELAPI NTSTATUS PsLookupThreadByThreadId(IN HANDLE ThreadId,OUT PETHREAD *Thread);NTKERNELAPI PEPROCESS IoThreadToProcess(IN PETHREAD Thread);NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(IN HANDLE ProcessHandle,IN ULONG ProcessInformationClass,OUT PVOID ProcessInformation,IN ULONG ProcessInformationLength,OUT PULONG ReturnLength OPTIONAL);NTSYSAPI NTSTATUS NTAPI ZwQueryInformationThread(IN HANDLE ThreadHandle,IN ULONG ThreadInformationClass,OUT PVOID ThreadInformation,IN ULONG ThreadInformationLength,OUT PULONG ReturnLength OPTIONAL);ULONG idPTM=476; //XP HARD CODEBYTE JmpCode[5]={0xE9,0x00,0x00,0x00,0x00};BYTE OrgCode[5]={0x8B,0x3F,0x8B,0x1C,0x87};BYTE PushRetCode[6]={0x68,0x00,0x00,0x00,0x00,0xc3};KIRQL f_oldirql;KSPIN_LOCK f_spinlock;NTOPENTHREAD OldNtOpenThread;NTOPENPROCESS OldNtOpenProcess;NTDUPLICATEOBJECT OldNtDuplicateObject;NTUSERPOSTTHREADMESSAGE OldNtUserPostThreadMessage;ULONG uKiFastCallEntryAddr=0;ULONG HookAddr=0;ULONG JMPRet=0;ULONG PushRetMem=0;ULONG ppid=0;PEPROCESS ppep=NULL;PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow;extern PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable;ULONG GetShadowTableAddress(){ULONG dwordatbyte,i;PUCHAR p = (PUCHAR) KeAddSystemServiceTable;for(i = 0; i < PAGE_SIZE; i++, p++)// 往下找一页指针递增1{__try{dwordatbyte = *(PULONG)p;}__except(EXCEPTION_EXECUTE_HANDLER){return FALSE;}if(MmIsAddressValid((PVOID)dwordatbyte)){if(memcmp((PVOID)dwordatbyte, KeServiceDescriptorTable, 16) == 0)//对比前16字节相同则找到{if((PVOID)dwordatbyte == KeServiceDescriptorTable)//排除自己{continue;}return dwordatbyte;}}}return FALSE;}ULONG GetSSDTCurAddr(IN ULONG Index,BOOL IsShadow){ULONG ServiceCount,BaseAddr;if (KeServiceDescriptorTableShadow!=NULL){ServiceCount=KeServiceDescriptorTableShadow[IsShadow?1:0].NumberOfServices;BaseAddr = (ULONG)KeServiceDescriptorTableShadow[IsShadow?1:0].ServiceTableBase;if (Index>=ServiceCount) return FALSE;return *(PULONG)(BaseAddr+Index * 4);}return FALSE;}NTSTATUS MyNtOpenThread(OUT PHANDLE ThreadHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId){PETHREAD tcmp;PEPROCESS pcmp;NTSTATUS st,ntotst;if(MmIsAddressValid(ClientId)==TRUE){st=PsLookupThreadByThreadId((HANDLE)ClientId->UniqueThread,&tcmp);if (!NT_SUCCESS(st)){ntotst=STATUS_ACCESS_DENIED;}else{pcmp=IoThreadToProcess(tcmp);if(pcmp==ppep)ntotst=STATUS_ACCESS_DENIED;elsentotst=OldNtOpenThread(ThreadHandle,DesiredAccess,ObjectAttributes,ClientId);}}else{ntotst=STATUS_ACCESS_DENIED;}return ntotst;}NTSTATUS MyNtOpenProcess(OUT PHANDLE ProcessHandle,IN ACCESS_MASK AccessMase,IN POBJECT_A TTRIBUTES ObjectAttributes,IN PCLIENT_ID ClientId){PEPROCESS pcmp;NTSTATUS st,ntopst;if(MmIsAddressValid(ClientId)==TRUE){st=PsLookupProcessByProcessId((HANDLE)ClientId->UniqueProcess,&pcmp);if (!NT_SUCCESS(st)){ntopst=STA TUS_ACCESS_DENIED;}else{if(pcmp==ppep)ntopst=STA TUS_ACCESS_DENIED;elsentopst=OldNtOpenProcess(ProcessHandle,AccessMase,ObjectAttributes,ClientId);}}else{ntopst=STA TUS_ACCESS_DENIED;}return ntopst;}NTSTATUS MyNtDuplicateObject(IN HANDLE SourceProcessHandle,IN HANDLE SourceHandle,IN HANDLE TargetProcessHandle,OUT PHANDLE TargetHandle OPTIONAL,IN ACCESS_MASK DesiredAccess,IN ULONG Attributes,IN ULONG Options){NTSTATUS ntStatus,Tmp;PROCESS_BASIC_INFORMATION PBI;THREAD_BASIC_INFORMATION TBI;ULONG NowPid;ntStatus=OldNtDuplicateObject(SourceProcessHandle,SourceHandle,TargetProcessHandle,T argetHandle,DesiredAccess,Attributes,Options);if (NT_SUCCESS(ntStatus) ){Tmp=ZwQueryInformationProcess(*TargetHandle,0,&PBI,sizeof(PBI),NULL);if (NT_SUCCESS(Tmp)){NowPid=PBI.UniqueProcessId;if (NowPid==ppid || NowPid==ppid+1 || NowPid==ppid+2 || NowPid==ppid+3){ZwClose(*TargetHandle);*TargetHandle=0;ntStatus= STATUS_UNSUCCESSFUL;}}Tmp=ZwQueryInformationThread(*TargetHandle,0,&TBI,sizeof(TBI),NULL);if (NT_SUCCESS(Tmp)){NowPid=(ULONG)TBI.ClientId.UniqueProcess;if (NowPid==ppid || NowPid==ppid+1 || NowPid==ppid+2 || NowPid==ppid+3){ZwClose(*TargetHandle);*TargetHandle=0;ntStatus= STATUS_UNSUCCESSFUL;}}}return ntStatus;}BOOL MyNtUserPostThreadMessage(DWORD idThread,UINT Msg,WPARAM wParam,LPARAM lParam){PEPROCESS pcmp=NULL;PETHREAD tcmp=NULL;NTSTATUS st=STATUS_UNSUCCESSFUL;BOOL rt=FALSE;st=PsLookupThreadByThreadId((HANDLE)idThread,&tcmp);if (NT_SUCCESS(st)){pcmp=IoThreadToProcess(tcmp);if(pcmp==ppep)rt=FALSE;elsert=OldNtUserPostThreadMessage(idThread,Msg,wParam,lParam);}else{rt=FALSE;}return rt;}//HOOK KiFastCallEntry过滤函数__declspec(naked)void FakeKiFastCallEntry(){_asm{pushfdpushadmov edi,dword ptr [edi]mov ebx,dword ptr [edi+eax*4]cmp OldNtOpenProcess,ebx; //比较是否为NtOpenProcessje Label1cmp OldNtDuplicateObject,ebx; //比较是否为NtDuplicateObjectje Label2cmp OldNtOpenThread,ebx; //比较是否为NtOpenThreadje Label3cmp OldNtUserPostThreadMessage,ebx; //比较是否为NtOpenThreadje Label4popadpopfdmov edi,dword ptr [edi]mov ebx,dword ptr [edi+eax*4]jmp [JMPRet];Label1:popadpopfdmov ebx,MyNtOpenProcess //修改NtOpenProcess为我们的代理函数jmp [JMPRet];Label2:popadpopfdmov ebx,MyNtDuplicateObject //修改NtDuplicateObject为我们的代理函数jmp [JMPRet];Label3:popadpopfdmov ebx,MyNtOpenThread //修改NtOpenThread为我们的代理函数jmp [JMPRet];Label4:popadpopfdmov ebx,MyNtUserPostThreadMessage //修改NtUserPostThreadMessage为我们的代理函数jmp [JMPRet];}}NTSTATUS LoadKiHooker(){NTSTATUS status = STATUS_UNSUCCESSFUL;KIRQL oldIrql;PMDL pMdl = NULL;UNICODE_STRING ustrFunctionName,ustrFunctionName2;//获得“阴影表”的地址KeServiceDescriptorTableShadow=(PSYSTEM_SERVICE_TABLE)GetShadowTableAddres s();if (!KeServiceDescriptorTableShadow){DbgPrint("Find SSSDT Error!");return STATUS_UNSUCCESSFUL;}//获取NtUserPostThreadMessage地址OldNtUserPostThreadMessage=(NTUSERPOSTTHREADMESSAGE)GetSSDTCurAddr(id PTM,TRUE);DbgPrint("NtUserPostThreadMessaged=0x%08X",OldNtUserPostThreadMessage);//获取NtOpenProcess地址RtlInitUnicodeString(&ustrFunctionName, L"NtOpenProcess");OldNtOpenProcess=(NTOPENPROCESS)MmGetSystemRoutineAddress( &ustrFunctionNa me);DbgPrint("NtOpenProcess=0x%08X",OldNtOpenProcess);//获取NtDuplicateObject地址RtlInitUnicodeString(&ustrFunctionName2, L"NtDuplicateObject");OldNtDuplicateObject=(NTDUPLICATEOBJECT)MmGetSystemRoutineAddress(&ustrFun ctionName2);DbgPrint("NtDuplicateObject=0x%08X",OldNtDuplicateObject);//获取NtOpenThread地址OldNtOpenThread=(NTOPENTHREAD)GetSSDTRealAddr(GetSysCallIndex("NtOpenThre ad"));DbgPrint("NtOpenThread=0x%08X",OldNtOpenThread);//系统调用管理器的地址保存在MSR寄存器里面,标识ID为0x176是SYSENTER_EIP_MSR寄存器,存放着KiFastCallEntry地址！所以在这里用rdmsr读取KiFastCallEntry地址；__asm{pushfdpushadmov ecx,0x176rdmsrmov uKiFastCallEntryAddr,eax //获取KiFastCallEntry地址xor ecx,ecxLabel1:cmp ecx,0x100je Label3mov edx,DWORD ptr [eax]cmp edx,0x1C8B3F8B //搜索特征码,获取要Hook的位置je Label2inc eaxinc ecxjmp Label1Label2:mov HookAddr,eaxLabel3:popadpopfd}if (HookAddr==0){return status;}//申请分配二级跳转内存PushRetMem=(ULONG)ExAllocatePoolWithTag(NonPagedPool,6,MEM_TAG);if ((PVOID)PushRetMem==NULL){return status;}DbgPrint("PushRetMem=0x%08X",PushRetMem);//一级跳转地址*(ULONG*)&JmpCode[1]=(ULONG)(PushRetMem)-(HookAddr+5);//二级跳转地址*(ULONG*)&PushRetCode[1]=(ULONG)FakeKiFastCallEntry;//HOOK返回地址JMPRet=HookAddr+5;//申请MDLpMdl = IoAllocateMdl((PBYTE)HookAddr, 5, FALSE, FALSE, NULL);if (pMdl){//锁定内存页面__try{MmProbeAndLockPages(pMdl, KernelMode, IoWriteAccess);}__except(EXCEPTION_EXECUTE_HANDLER){IoFreeMdl(pMdl);return status;}//申请并使用自旋锁KeInitializeSpinLock(&f_spinlock);KeAcquireSpinLock(&f_spinlock,&f_oldirql);//提升中断请求级oldIrql = KeRaiseIrqlToDpcLevel();//关闭中断_asm{CLIMOV EAX, CR0AND EAX, NOT 10000HMOV CR0, EAX}//进行HOOK操作RtlCopyMemory((PVOID)PushRetMem,PushRetCode,6);RtlCopyMemory((PVOID)HookAddr,JmpCode,5);//开启中断_asm{MOV EAX, CR0OR EAX, 10000HMOV CR0, EAXSTI}//恢复先前中断请求级KeLowerIrql(oldIrql);//释放自旋锁KeReleaseSpinLock(&f_spinlock, f_oldirql);DbgPrint("KiFastCallEntry=0x%08X",uKiFastCallEntryAddr);DbgPrint("HookAddr=0x%08X",HookAddr);status=STATUS_SUCCESS;}return status;}VOID UnloadKiHooker(){PMDL pMdl = NULL;KIRQL oldIrql;if (HookAddr!=0){pMdl = IoAllocateMdl((PBYTE)HookAddr, 5, FALSE, FALSE, NULL);if (pMdl){//锁定内存页面__try{MmProbeAndLockPages(pMdl, KernelMode, IoWriteAccess);}__except(EXCEPTION_EXECUTE_HANDLER){IoFreeMdl(pMdl);return;}//申请并使用自旋锁KeInitializeSpinLock(&f_spinlock);KeAcquireSpinLock(&f_spinlock,&f_oldirql);//提升中断请求级oldIrql = KeRaiseIrqlToDpcLevel();//关闭中断_asm{CLIMOV EAX, CR0AND EAX, NOT 10000HMOV CR0, EAX}//进行还原HOOK操作RtlCopyMemory((PVOID)HookAddr,OrgCode,5);_asm{MOV EAX, CR0OR EAX, 10000HMOV CR0, EAXSTI}//恢复先前中断请求级KeLowerIrql(oldIrql);//释放自旋锁KeReleaseSpinLock(&f_spinlock, f_oldirql);//释放内存ExFreePool((PVOID)PushRetMem);}}}。