恢复游戏的InlineHook ZwOpenProcess

fengjikou

1. #include<ntddk.h>
   
2. #include<windef.h>
   
3. typedef struct _SERVICE_DESCRIPTOR_TABLE
   
4. {
   
5. PVOID ServiceTableBase;
   
6. PULONG ServiceCounterTableBase;
   
7. ULONG NumberTableBase;
   
8. ULONG ParamTableBase;
   
9. }SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;  
   
10. 
    
11. extern PSERVICE_DESCRIPTOR_TABLE    KeServiceDescriptorTable;
    
12. 
    
13. 
    
14. typedef NTSTATUS (*REALZWOPENPROCESS)
    
15.         (  
    
16. OUT PHANDLE ProcessHandle,
    
17. IN ACCESS_MASK AccessMask,
    
18. IN POBJECT_ATTRIBUTES ObjectAttributes,
    
19. IN PCLIENT_ID ClientId);  
    
20. 
    
21. REALZWOPENPROCESS    RealZwOpenProcess;
    
22. 
    
23. //***************************************************************************
    
24. VOID Hook();
    
25. VOID Unhook();
    
26. VOID OnUnload(IN PDRIVER_OBJECT DriverObject);
    
27. NTSTATUS rc;  
    
28. //////////////////////////////////////
    
29. ULONG JmpAddress;//跳转到NtOpenProcess里的地址
    
30. ULONG OldServiceAddress;//原来NtOpenProcess的服务地址
    
31. //////////////////////////////////////
    
32. __declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle,
    
33.                ACCESS_MASK DesiredAccess,
    
34.                POBJECT_ATTRIBUTES ObjectAttributes,
    
35.                PCLIENT_ID ClientId)  
    
36. {
    
37.   //DbgPrint("NtOpenProcess() called");
    
38.   //DbgPrint("RealZwOpenProcess:0x%08X",RealZwOpenProcess);
    
39.   rc = (NTSTATUS)(REALZWOPENPROCESS)RealZwOpenProcess( ProcessHandle, DesiredAccess, ObjectAttributes, ClientId );  
    
40. 
    
41.                
    
42.   __asm{
    
43.     push    0C4h
    
44.     push    804daab0h  //共十个字节
    
45.     jmp     [JmpAddress]      
    
46.   }
    
47. }
    
48. 
    
49. 
    
50. NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
    
51. {
    
52.   DriverObject->DriverUnload = OnUnload;
    
53.   DbgPrint("Unhooker load");
    
54.   Hook();
    
55.   return STATUS_SUCCESS;
    
56. }
    
57. /////////////////////////////////////////////////////
    
58. VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
    
59. {
    
60.   DbgPrint("Unhooker unload!");
    
61.   Unhook();
    
62. }
    
63. /////////////////////////////////////////////////////
    
64. 
    
65. VOID Hook()
    
66. {
    
67. ULONG Address;
    
68. Address=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;
    
69. DbgPrint("Address:0x%08X",Address);
    
70. OldServiceAddress=*(ULONG*)Address;
    
71. RealZwOpenProcess=(REALZWOPENPROCESS)OldServiceAddress;
    
72. DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);
    
73. DbgPrint("MyNtOpenProcess:0x%08X",MyNtOpenProcess);
    
74. JmpAddress=OldServiceAddress+10;
    
75. DbgPrint("JmpAddress:0x%08X",JmpAddress);
    
76. 
    
77. __asm{//去掉内存保护
    
78.     cli
    
79.          mov  eax,cr0
    
80.     and  eax,not 10000h
    
81.     mov  cr0,eax
    
82.      }
    
83.    
    
84.    
    
85. *((ULONG*)Address) = (ULONG)MyNtOpenProcess;//HOOK SSDT
    
86. 
    
87.   __asm{//恢复内存保护   
    
88.           mov  eax,cr0
    
89.     or   eax,10000h
    
90.     mov  cr0,eax
    
91.     sti
    
92.        }
    
93. 
    
94. }
    
95. 
    
96. 
    
97. VOID Unhook()
    
98. {
    
99.   ULONG  Address;
    
100.   Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//查找SSDT
     
101. 
     
102.   __asm{
     
103.     cli
     
104.           mov  eax,cr0
     
105.     and  eax,not 10000h
     
106.     mov  cr0,eax
     
107.   }
     
108. 
     
109. *((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT
     
110. 
     
111.   __asm{   
     
112.          mov  eax,cr0
     
113.     or   eax,10000h
     
114.     mov  cr0,eax
     
115.     sti
     
116.   }
     
117. 
     
118.   DbgPrint("Unhook");
     
119. }

复制代码

联系我时，请说是在 挂海论坛 上看到的，谢谢！