Resume InlineHookSSDT

在InlineHook中修改了zwOpenProcess函数的中的指令

与Resume HookSSDT同理 找出一个正确的值覆盖上去就行、

突发奇想  有没有可能上去一个驱动或者程序  直接卸载掉InlineHook 岂不是很爽

直接映射WCHAR    wzFileFullPath[] = L"\\SystemRoot\\System32\\ntdll.dll";

 BOOLEAN
     MappingPEFileInRing0Space(WCHAR* wzFileFullPath,OUT PVOID* MappingBaseAddress,PSIZE_T MappingViewSize)
 {
     UNICODE_STRING    uniFileFullPath;
     OBJECT_ATTRIBUTES oa;
     NTSTATUS          Status;
     IO_STATUS_BLOCK   Iosb;

     HANDLE   hFile = NULL;
     HANDLE   hSection = NULL;

     if (!wzFileFullPath || !MappingBaseAddress){
         return FALSE;
     }

     RtlInitUnicodeString(&uniFileFullPath, wzFileFullPath);
     InitializeObjectAttributes(&oa,
         &uniFileFullPath,
         OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
         NULL,
         NULL
         );

     //获得文件句柄
     Status = IoCreateFile(&hFile,
         GENERIC_READ | SYNCHRONIZE,
         &oa,   //文件绝对路径
         &Iosb,
         NULL,
         FILE_ATTRIBUTE_NORMAL,
         FILE_SHARE_READ,
         FILE_OPEN,
         FILE_SYNCHRONOUS_IO_NONALERT,
         NULL,
         ,
         CreateFileTypeNone,
         NULL,
         IO_NO_PARAMETER_CHECKING
         );
     if (!NT_SUCCESS(Status))
     {

         return FALSE;
     }

     oa.ObjectName = NULL;
     Status = ZwCreateSection(&hSection,
         SECTION_QUERY | SECTION_MAP_READ,
         &oa,
         NULL,
         PAGE_WRITECOPY,
         SEC_IMAGE,  //??  指示内存对齐
         hFile
         );
     ZwClose(hFile);
     if (!NT_SUCCESS(Status))
     {

         return FALSE;
     }
     Status = ZwMapViewOfSection(hSection,
         NtCurrentProcess(),    //映射到当前进程的内存空间中
         MappingBaseAddress,
         ,
         ,
         ,
         MappingViewSize,
         ViewUnmap,
         ,
         PAGE_WRITECOPY
         );
     ZwClose(hSection);
     if (!NT_SUCCESS(Status))
     {
         return FALSE;
     }

     return TRUE;
 }

映射到ring0层

首先 先获取到ntoskrnl模块信息

 BOOLEAN GetSystemMoudleInformationBySystemModuleNameInWin7_X64(char* szFindSystemModuleName,ULONG64* ulMoudleBaseAddress,ULONG32* ulModuleSize)
 {
     int       i = ;
     NTSTATUS  Status = STATUS_SUCCESS;
     PVOID     Information = NULL;
     ULONG     ulNeeds = ;

     Status = ZwQuerySystemInformation(SystemModuleInformation,NULL,,&ulNeeds);

     if (Status!=STATUS_INFO_LENGTH_MISMATCH)
     {
         return FALSE;
     }
     Information = ExAllocatePool(PagedPool,ulNeeds);   //PagedPool(数据段 置换到磁盘)  NonPagedPool(代码段 不置换到磁盘)

     if (Information==NULL)
     {
         return FALSE;
     }
     Status = ZwQuerySystemInformation(SystemModuleInformation,Information,ulNeeds,&ulNeeds);

     if (!NT_SUCCESS(Status))
     {
         ExFreePool(Information);
         return FALSE;
     }

     for (i=;i<((PSYSTEM_MODULE_INFORMATION)Information)->NumberOfModules;i++)
     {

         if (strstr(((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].ImageName,
             szFindSystemModuleName)!=NULL)  //Ntoskernel.exe
         {
             *ulMoudleBaseAddress  =  ((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].Base;
             *ulModuleSize = ((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].Size;

             if (Information!=NULL)
             {
                 ExFreePool(Information);
                 Information = NULL;
             }
             return TRUE;

         }

     }

     if (Information!=NULL)
     {
         ExFreePool(Information);
         Information = NULL;
     }

     return FALSE;
 }

win7

 BOOLEAN GetSystemMoudleInformationBySystemModuleNameInWinXP_X86(char* szFindSystemModuleName,ULONG32* ulMoudleBaseAddress,ULONG32* ulModuleSize)
 {
     int       i = ;
     NTSTATUS  Status = STATUS_SUCCESS;
     PVOID     Information = NULL;
     ULONG     ulNeeds = ;

     Status = ZwQuerySystemInformation(SystemModuleInformation,NULL,,&ulNeeds);

     if (Status!=STATUS_INFO_LENGTH_MISMATCH)
     {
         return FALSE;
     }
     Information = ExAllocatePool(PagedPool,ulNeeds);   //PagedPool(数据段 置换到磁盘)  NonPagedPool(代码段 不置换到磁盘)

     if (Information==NULL)
     {
         return FALSE;
     }
     Status = ZwQuerySystemInformation(SystemModuleInformation,Information,ulNeeds,&ulNeeds);

     if (!NT_SUCCESS(Status))
     {
         ExFreePool(Information);
         return FALSE;
     }

     for (i=;i<((PSYSTEM_MODULE_INFORMATION)Information)->NumberOfModules;i++)
     {

         if (strstr(((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].ImageName,
             szFindSystemModuleName)!=NULL)  //Ntoskernel.exe
         {
             *ulMoudleBaseAddress  =  ((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].Base;
             *ulModuleSize = ((PSYSTEM_MODULE_INFORMATION)Information)->Modules[i].Size;

             if (Information!=NULL)
             {
                 ExFreePool(Information);
                 Information = NULL;
             }
             return TRUE;

         }

     }

     if (Information!=NULL)
     {
         ExFreePool(Information);
         Information = NULL;
     }

     return FALSE;
 }

winxp

获取到SSDTAddress

 BOOLEAN GetSSDTAddressInWin7_X64(ULONG64* SSDTAddress)
 {

     PUCHAR StartSearchAddress = (PUCHAR)__readmsr(0xC0000082);   //fffff800`03ecf640
     PUCHAR EndSearchAddress = StartSearchAddress + 0x500;
     PUCHAR i = NULL;
     UCHAR   v1=,v2=,v3=;
     INT64   iOffset = ;    //002320c7
     ULONG64 VariableAddress = ;
     *SSDTAddress = NULL;
     for(i=StartSearchAddress;i<EndSearchAddress;i++)
     {
         if( MmIsAddressValid(i) && MmIsAddressValid(i+) && MmIsAddressValid(i+) )
         {
             v1=*i;
             v2=*(i+);
             v3=*(i+);
             if(v1==0x4c && v2==0x8d && v3==0x15 )
             {
                 memcpy(&iOffset,i+,);
                 *SSDTAddress = iOffset + (ULONG64)i + ;

                 break;
             }
         }
     }

     if (*SSDTAddress==NULL)
     {
         return FALSE;
     }
     return TRUE;
 }

win7

 BOOLEAN GetSSDTAddressInWinXP_X86(ULONG32* SSDTAddress)
 {
     //从NtosKernel.exe 模块中的导出表获得该导出变量  KeServiceDescriptorTable

     /*
     kd> dd KeServiceDescriptorTable
     80563520  804e58a0 00000000 0000011c 805120bc
     */
     *SSDTAddress = NULL;
     *SSDTAddress = (ULONG32)GetExportVariableAddressFormNtosExportTableByVariableName(L"KeServiceDescriptorTable");

     if (*SSDTAddress!=NULL)
     {
         return TRUE;
     }

     return FALSE;
 }

 PVOID
     GetExportVariableAddressFormNtosExportTableByVariableName(WCHAR *wzVariableName)
 {
     UNICODE_STRING uniVariableName;
     PVOID VariableAddress = NULL;

     if (wzVariableName && wcslen(wzVariableName) > )
     {
         RtlInitUnicodeString(&uniVariableName, wzVariableName);  

         //从Ntos模块的导出表中获得一个导出变量的地址
         VariableAddress = MmGetSystemRoutineAddress(&uniVariableName);
     }

     return VariableAddress;
 }

WinXP

在通过函数名获取到函数索引

 BOOLEAN GetSSDTFunctionIndexFromNtdllExportTableByFunctionNameInWinXP_X86(CHAR* szFindFunctionName,
     ULONG32* SSDTFunctionIndex)
 {

     ULONG32     ulOffset_SSDTFunctionIndex = ;

     //从Ntdll模块的导出表中获得7c92d5e0
     //使用内存映射将Ntdll模块映射到System进程的内存空间进行查找(Ntdll.dll模块的导出表中进行搜索)
     ULONG   i;
     BOOLEAN  bOk = FALSE;
     WCHAR    wzFileFullPath[] = L"\\SystemRoot\\System32\\ntdll.dll";
     SIZE_T  MappingViewSize   = ;
     PVOID    MappingBaseAddress = NULL;
     PIMAGE_NT_HEADERS  NtHeader = NULL;
     PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL;
     ULONG32*  AddressOfFunctions    = NULL;
     ULONG32*  AddressOfNames        = NULL;
     USHORT* AddressOfNameOrdinals = NULL;
     CHAR*   szFunctionName        = NULL;
     ULONG32 ulFunctionOrdinal     = ;
     ULONG32 ulFunctionAddress     = ;

     *SSDTFunctionIndex = -;

     //将Ntdll.dll 当前的空间中
     bOk = MappingPEFileInRing0Space(wzFileFullPath,&MappingBaseAddress, &MappingViewSize);
     if (bOk==FALSE)
     {
         return FALSE;
     }
     else
     {
         __try{
             NtHeader = RtlImageNtHeader(MappingBaseAddress);
             if (NtHeader && NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)
             {
                 ExportDirectory =(IMAGE_EXPORT_DIRECTORY*)((ULONG32)MappingBaseAddress + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

                 AddressOfFunctions = (ULONG32*)((ULONG32)MappingBaseAddress + ExportDirectory->AddressOfFunctions);
                 AddressOfNames = (ULONG32*)((ULONG32)MappingBaseAddress + ExportDirectory->AddressOfNames);
                 AddressOfNameOrdinals = (USHORT*)((ULONG32)MappingBaseAddress + ExportDirectory->AddressOfNameOrdinals);
                 for(i = ; i < ExportDirectory->NumberOfNames; i++)
                 {
                     szFunctionName = (char*)((ULONG32)MappingBaseAddress + AddressOfNames[i]);   //获得函数名称
                     if (_stricmp(szFunctionName, szFindFunctionName) == )
                     {
                         ulFunctionOrdinal = AddressOfNameOrdinals[i];
                         ulFunctionAddress = (ULONG32)((ULONG32)MappingBaseAddress + AddressOfFunctions[ulFunctionOrdinal]);

                         *SSDTFunctionIndex = *(ULONG32*)(ulFunctionAddress+ulOffset_SSDTFunctionIndex);
                         break;
                     }
                 }
             }
         }__except(EXCEPTION_EXECUTE_HANDLER)
         {
             ;
         }
     }

     ZwUnmapViewOfSection(NtCurrentProcess(), MappingBaseAddress);

     if (*SSDTFunctionIndex==-)
     {
         return FALSE;
     }

     return TRUE;
 }

WinXP

 BOOLEAN GetSSDTFunctionIndexFromNtdllExportTableByFunctionNameInWin7_X64(CHAR* szFindFunctionName,ULONG32* SSDTFunctionIndex)
 {

     ULONG32     ulOffset_SSDTFunctionIndex = ;

     ULONG   i;
     BOOLEAN  bOk = FALSE;
     WCHAR    wzFileFullPath[] = L"\\SystemRoot\\System32\\ntdll.dll";
     SIZE_T   MappingViewSize   = ;
     PVOID    MappingBaseAddress = NULL;
     PIMAGE_NT_HEADERS  NtHeader = NULL;
     PIMAGE_EXPORT_DIRECTORY ExportDirectory = NULL;
     ULONG32*  AddressOfFunctions    = NULL;
     ULONG32*  AddressOfNames        = NULL;
     USHORT*   AddressOfNameOrdinals = NULL;
     CHAR*     szFunctionName        = NULL;
     ULONG32   ulFunctionOrdinal     = ;
     ULONG64   ulFunctionAddress     = ;

     *SSDTFunctionIndex = -;

     //将Ntdll.dll 当前的空间中
     bOk = MappingPEFileInRing0Space(wzFileFullPath,&MappingBaseAddress, &MappingViewSize);
     if (bOk==FALSE)
     {
         return FALSE;
     }
     else
     {
         __try{
             NtHeader = RtlImageNtHeader(MappingBaseAddress);
             if (NtHeader && NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)
             {
                 ExportDirectory =(IMAGE_EXPORT_DIRECTORY*)((ULONG64)MappingBaseAddress + NtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

                 AddressOfFunctions = (ULONG32*)((ULONG64)MappingBaseAddress + ExportDirectory->AddressOfFunctions);
                 AddressOfNames = (ULONG32*)((ULONG64)MappingBaseAddress + ExportDirectory->AddressOfNames);
                 AddressOfNameOrdinals = (USHORT*)((ULONG64)MappingBaseAddress + ExportDirectory->AddressOfNameOrdinals);
                 for(i = ; i < ExportDirectory->NumberOfNames; i++)
                 {
                     szFunctionName = (char*)((ULONG64)MappingBaseAddress + AddressOfNames[i]);   //获得函数名称
                     if (_stricmp(szFunctionName, szFindFunctionName) == )
                     {
                         ulFunctionOrdinal = AddressOfNameOrdinals[i];
                         ulFunctionAddress = (ULONG64)((ULONG64)MappingBaseAddress + AddressOfFunctions[ulFunctionOrdinal]);

                         *SSDTFunctionIndex = *(ULONG32*)(ulFunctionAddress+ulOffset_SSDTFunctionIndex);
                         break;
                     }
                 }
             }
         }__except(EXCEPTION_EXECUTE_HANDLER)
         {
             ;
         }
     }

     ZwUnmapViewOfSection(NtCurrentProcess(), MappingBaseAddress);

     if (*SSDTFunctionIndex==-)
     {
         return FALSE;
     }

     return TRUE;
 }

win7

得到索引后 就能得到函数的地址

找到函数的地址 然后在映射的内存中取出争取的地址  回复回去

http://www.cnblogs.com/yifi/p/4968944.html