过名将三国驱动保护

fengjikou · 发表于 2015-2-9 23:03:01

#include<ntddk.h>
#include<windef.h>
typedef struct _SERVICE_DESCRIPTOR_TABLE
{
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberTableBase;
unsigned char *ParamTableBase;
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;
typedef NTSTATUS (*REALZWOPENPROCESS)
(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId);
typedef NTSTATUS (*READVIRTUALMEMORY)(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL);
typedef NTSTATUS (*WRITEVIRTUALMEMORY)(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
IN PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL
);
REALZWOPENPROCESS RealZwOpenProcess;
READVIRTUALMEMORY RealNtReadVirtualMemory;
WRITEVIRTUALMEMORY RealNtWriteVirtualMemory;
//***************************************************************************
VOID Hook();
VOID Unhook();
VOID OnUnload(IN PDRIVER_OBJECT DriverObject);
NTSTATUS rc;
//NTSTATUS rc1;
//NTSTATUS rc2;
DWORD bix,tiao;
//////////////////////////////////////
ULONG JmpAddress;//跳转到NtOpenProcess里的地址
ULONG JmpAddress1;
ULONG JmpAddress2;
ULONG OldServiceAddress;//原来NtOpenProcess的服务地址
ULONG OldServiceAddress1;
ULONG OldServiceAddress2;
//////////////////////////////////////
__declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId)
{
//RealZwOpenProcess=(REALZWOPENPROCESS)OldServiceAddress;
//rc = (NTSTATUS)(REALZWOPENPROCESS)RealZwOpenProcess( ProcessHandle, DesiredAccess, ObjectAttributes, ClientId );
__asm{
push 0C4h
push 804daab0h //共十个字节
mov eax,80538d00h
call eax
jmp [JmpAddress]
}
}
__declspec(naked) NTSTATUS __stdcall MyNtReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL)
{
//RealNtReadVirtualMemory=(READVIRTUALMEMORY)OldServiceAddress1;
//rc1 = (NTSTATUS)(READVIRTUALMEMORY)RealNtReadVirtualMemory( ProcessHandle, BaseAddress, Buffer, BufferLength,ReturnLength );
__asm{
push 1Ch
push 804da4e0h //共十个字节
mov eax,80538d00h
call eax
jmp [JmpAddress1]
}
}
__declspec(naked) NTSTATUS __stdcall MyNtWriteVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG BufferLength,
OUT PULONG ReturnLength OPTIONAL)
{
//RealNtWriteVirtualMemory=(WRITEVIRTUALMEMORY)OldServiceAddress2;
//rc2=(NTSTATUS)(WRITEVIRTUALMEMORY)RealNtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, BufferLength,ReturnLength);
__asm{
push 1Ch
push 804da4f8h //共十个字节
mov eax,80538d00h
call eax
jmp [JmpAddress2]
}
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
DriverObject->DriverUnload = OnUnload;
DbgPrint("Unhooker load");
Hook();
return STATUS_SUCCESS;
}
/////////////////////////////////////////////////////
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Unhooker unload!");
Unhook();
}
/////////////////////////////////////////////////////
VOID Hook()
{
ULONG Address;
ULONG Address1;
ULONG Address2;
Address=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;
Address1=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0ba*4;
Address2=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;
DbgPrint("Address:0x%08X",Address);
DbgPrint("Address1:0x%08X",Address1);
DbgPrint("Address2:0x%08X",Address2);
OldServiceAddress=*(ULONG*)Address;
OldServiceAddress1=*(ULONG*)Address1;
OldServiceAddress2=*(ULONG*)Address2;
RealZwOpenProcess=(REALZWOPENPROCESS)OldServiceAddress;
DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);
DbgPrint("OldServiceAddress1:0x%08X",OldServiceAddress1);
DbgPrint("OldServiceAddress2:0x%08X",OldServiceAddress2);
JmpAddress=OldServiceAddress+15;
JmpAddress1=OldServiceAddress1+12;
JmpAddress2=OldServiceAddress2+12;
//JmpAddress=2153521239;
DbgPrint("JmpAddress:0x%08X",JmpAddress);
DbgPrint("JmpAddress1:0x%08X",JmpAddress1);
DbgPrint("JmpAddress2:0x%08X",JmpAddress2);
__asm{//去掉内存保护
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
*((ULONG*)Address) = (ULONG)MyNtOpenProcess;//HOOK SSDT
*((ULONG*)Address1) = (ULONG)MyNtReadVirtualMemory;
*((ULONG*)Address2) = (ULONG)MyNtWriteVirtualMemory;
__asm{//恢复内存保护
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}
VOID Unhook()
{
ULONG Address;
ULONG Address1;
ULONG Address2;
Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//查找SSDT
Address1=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0ba*4;
Address2=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;
__asm{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
*((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT
*((ULONG*)Address1) = (ULONG)OldServiceAddress1;
*((ULONG*)Address2) = (ULONG)OldServiceAddress2;
__asm{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
DbgPrint("Unhook");
}

复制代码

联系我时，请说是在挂海论坛上看到的，谢谢！

chlnr159 · 发表于 2015-7-3 01:35:23

逐字逐句地看完这个帖子以后，我的心久久不能平静

		自动登录	找回密码
密码			立即注册

玩游戏来117游戏网(H5不下载也能玩手游传奇，吃鸡，竞技都有)	不懂社区·好资源不错过·各位资源站大佬欢迎来采集搬运	寻找会做《单机》游戏修改器的开发作者长期合作，价格不是问题！联系QQ：1874088565
IOS签名/udid证书出售/送证书加群1040456405	██【我要租此广告位】██	.
.	.	.

[讨论交流] 过名将三国驱动保护

免责声明：

浏览过的版块