[源码] 过TP之创建CreateMyDbgkDebugObjectType

悬念 · 发表于 2014-5-24 12:58:36

ULONG DbgkDebugObjectTypeAddr = 0;
POBJECT_TYPE DbgkDebugObjectType = NULL, MyDbgkDebugObjectType = NULL;
OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
BOOLEAN bEditDbgkDebugObjectType = FALSE;BOOLEAN CreateMyDbgkDebugObjectType()
{
ULONG NtDebugActiveProcess;
UNICODE_STRING MyObjectTypeName; NtDebugActiveProcess = GetSSDTFunctionAddr(SysFuncIdx.NtDebugActiveProcess);
DbgkDebugObjectTypeAddr = *(PULONG)(NtDebugActiveProcess + 0x5a + 2);
KdPrint(("DbgkDebugObjectTypeAddr: 0x%8x\n", DbgkDebugObjectTypeAddr)); //8055a540
if (DbgkDebugObjectTypeAddr == 0)
{
KdPrint(("DbgkDebugObjectTypeAddr == 0!"));
return FALSE;
}
DbgkDebugObjectType = (POBJECT_TYPE)(*(PULONG)DbgkDebugObjectTypeAddr);
KdPrint(("DbgkDebugObjectType: 0x%8x\n", DbgkDebugObjectType)); //863bb040
KdPrint(("DbgkDebugObjectType->Name: %ws\n", DbgkDebugObjectType->Name.Buffer));
KdPrint(("TypeInfo.GenericMapping.GenericRead: 0x%08x\n", DbgkDebugObjectType->TypeInfo.GenericMapping.GenericRead)); //00020001
KdPrint(("TypeInfo.GenericMapping.GenericWrite: 0x%08x\n", DbgkDebugObjectType->TypeInfo.GenericMapping.GenericWrite)); //00020002
KdPrint(("TypeInfo.GenericMapping.GenericExecute: 0x%08x\n", DbgkDebugObjectType->TypeInfo.GenericMapping.GenericExecute)); //00120000
KdPrint(("TypeInfo.GenericMapping.GenericAll: 0x%08x\n", DbgkDebugObjectType->TypeInfo.GenericMapping.GenericAll)); //001f000f
KdPrint(("TypeInfo.ValIDAccessMask: 0x%08x\n", DbgkDebugObjectType->TypeInfo.ValidAccessMask)); //001f000f
if (wcscmp(DbgkDebugObjectType->Name.Buffer, L"MyDebugObject") == 0)
{
KdPrint(("已经修改为MyDebugObject.\n"));
return FALSE;
} RtlCopyMemory(&ObjectTypeInitializer, &DbgkDebugObjectType->TypeInfo, sizeof(ObjectTypeInitializer));
if (DbgkDebugObjectType->TypeInfo.ValidAccessMask == 0)
{
KdPrint(("DbgkDebugObjectType->TypeInfo.ValidAccessMask被清零,开始恢复.\n"));
ObjectTypeInitializer.GenericMapping.GenericRead = 0x00020001;
ObjectTypeInitializer.GenericMapping.GenericWrite = 0x00020002;
ObjectTypeInitializer.GenericMapping.GenericExecute = 0x00120000;
ObjectTypeInitializer.GenericMapping.GenericAll = 0x001f000f;
ObjectTypeInitializer.ValidAccessMask = 0x001f000f;
}
RtlInitUnicodeString(&MyObjectTypeName, L"MyDebugObject");
return (STATUS_SUCCESS == ObCreateObjectType(&MyObjectTypeName, &ObjectTypeInitializer, (PSECURITY_DESCRIPTOR)NULL, &MyDbgkDebugObjectType)); //0: kd> uf nt!NtDebugActiveProcess
//nt!NtDebugActiveProcess:
//80644cb2 8bff mov edi,edi
//80644cb4 55 push ebp
//80644cb5 8bec mov ebp,esp
//...
//nt!NtDebugActiveProcess+0x51:
//80644d03 6a00 push 0
//80644d05 8d4508 lea eax,[ebp+8]
//80644d08 50 push eax
//80644d09 ff75fc push dword ptr [ebp-4]
//80644d0c ff3540a55580 push dword ptr [nt!DbgkDebugObjectType (8055a540)]
//80644d12 6a02 push 2
//80644d14 ff750c push dword ptr [ebp+0Ch]
//80644d17 e8ee77f7ff call nt!ObReferenceObjectByHandle (805bc50a)
}VOID EditDbgkDebugObjectType()
{
if (bEditDbgkDebugObjectType)
return;
if (CreateMyDbgkDebugObjectType())
{
WPOFF();
*(PULONG)DbgkDebugObjectTypeAddr = (ULONG)MyDbgkDebugObjectType;
WPON();
bEditDbgkDebugObjectType = TRUE;
} //lkd> dd nt!DbgkDebugObjectType
//8055a540 863bb040 00000000 00000000 00000000 //加载tp前:
//0: kd> dd 863bb040+68
//863bb0a8 00020001 00020002 00120000 001f000f
//863bb0b8 001f000f 00000001 00000000 00000000 //加载tp后:
//0: kd> dd 863bb040+68
//863bb0a8 00000000 00000000 00000000 00000000
//863bb0b8 00000000 00000001 00000000 00000000
}VOID UnEditDbgkDebugObjectType()
{
if (!bEditDbgkDebugObjectType)
return;
WPOFF();
*(PULONG)DbgkDebugObjectTypeAddr = (ULONG)DbgkDebugObjectType;
WPON();
ObfDereferenceObject(MyDbgkDebugObjectType);
bEditDbgkDebugObjectType = FALSE;
}

复制代码

//原:
lkd> dt _object_type 863bb040
nt!_OBJECT_TYPE
+0x000 Mutex          : _ERESOURCE
+0x038 TypeList       : _LIST_ENTRY [ 0x863bb078 - 0x863bb078 ]
+0x040 Name          : _UNICODE_STRING "DebugObject"
+0x048 DefaultObject : (null)
+0x04c Index          : 8
+0x050 TotalNumberOfObjects : 0
+0x054 TotalNumberOfHandles : 0
+0x058 HighWaterNumberOfObjects : 0
+0x05c HighWaterNumberOfHandles : 0
+0x060 TypeInfo       : _OBJECT_TYPE_INITIALIZER
+0x0ac Key             : 0x75626544
+0x0b0 ObjectLocks    : [4] _ERESOURCE

//新:
lkd> dt _object_type 85adec38
nt!_OBJECT_TYPE
+0x000 Mutex          : _ERESOURCE
+0x038 TypeList       : _LIST_ENTRY [ 0x85adec70 - 0x85adec70 ]
+0x040 Name          : _UNICODE_STRING "MyDebugObject"
+0x048 DefaultObject : (null)
+0x04c Index          : 0x20
+0x050 TotalNumberOfObjects : 0
+0x054 TotalNumberOfHandles : 0
+0x058 HighWaterNumberOfObjects : 0
+0x05c HighWaterNumberOfHandles : 0
+0x060 TypeInfo       : _OBJECT_TYPE_INITIALIZER
+0x0ac Key             : 0x6544794d
+0x0b0 ObjectLocks    : [4] _ERESOURCE

联系我时，请说是在挂海论坛上看到的，谢谢！

古凝明 · 发表于 2014-7-1 17:19:05

看看，楼主您辛苦了。。。

lqylbh · 发表于 2014-7-13 00:45:35

强烈支持楼主ing……

ghost_z · 发表于 2014-8-4 17:17:39

帮你顶....

╰︶此籹ふ☆ · 发表于 2014-9-2 05:11:25

当然是要支持了！

栀子花开 · 发表于 2014-9-21 06:30:43

支持一下:lol

zhang_game · 发表于 2014-10-9 00:08:23

这不错！终于等到了！

Team莫寒 · 发表于 2014-12-21 07:32:17

看帖要回，回帖才健康，在踩踩，楼主辛苦了！

troya · 发表于 2014-12-26 00:29:57

LZ是天才，坚定完毕

hjwgjd · 发表于 2014-12-26 18:11:53

太生气了，无法HOLD啦 >_<......

		自动登录	找回密码
密码			立即注册

玩游戏来117游戏网(H5不下载也能玩手游传奇，吃鸡，竞技都有)	不懂社区·好资源不错过·各位资源站大佬欢迎来采集搬运	寻找会做《单机》游戏修改器的开发作者长期合作，价格不是问题！联系QQ：1874088565
IOS签名/udid证书出售/送证书加群1040456405	██【我要租此广告位】██	.
.	.	.

[讨论交流] [源码] 过TP之创建CreateMyDbgkDebugObjectType

免责声明：

浏览过的版块

最佳新人

活跃会员

开荒者

原创大师

推广达人

沙发王

侦察队队长

宣传达人

灌水之王

突出贡献

优秀版主

荣誉管理

论坛元老

在线王

源码大师

终身成就

杰出贡献

机器王

评分大师

回帖大师

CM制造者

CM杀手

艺术大师

签到达人

土豪

知识库