object hook实现禁止创建文件

原理不说了,大伙都懂得..

要解决的问题：

1. 怎么在windbg中看到_OBJECT_TYPE和_OBJECT_TYPE_INITIALIZER结构的内容。

2. 怎样得到pOldParseProcedure的地址

3. 怎样改写((POBJECT_TYPE)*IoDeviceObjectType)->TypeInfo.ParseProcedure=pNewProcedure

对于第一个问题:

nt!_OBJECT_HEADER

+0x000 PointerCount : Int4B

+0x004 HandleCount : Int4B

+0x004 NextToFree : Ptr32 Void

+0x008 Type : Ptr32 _OBJECT_TYPE

+0x00c NameInfoOffset : UChar

+0x00d HandleInfoOffset : UChar

+0x00e QuotaInfoOffset : UChar

+0x00f Flags : UChar

+0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION

+0x010 QuotaBlockCharged : Ptr32 Void

+0x014 SecurityDescriptor : Ptr32 Void

+0x018 Body : _QUAD

lkd> dt _OBJECT_TYPE

nt!_OBJECT_TYPE

+0x000 Mutex : _ERESOURCE

+0x038 TypeList : _LIST_ENTRY

+0x040 Name : _UNICODE_STRING

+0x048 DefaultObject : Ptr32 Void

+0x04c Index : Uint4B

+0x050 TotalNumberOfObjects : Uint4B

+0x054 TotalNumberOfHandles : Uint4B

+0x058 HighWaterNumberOfObjects : Uint4B

+0x05c HighWaterNumberOfHandles : Uint4B

+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER

+0x0ac Key : Uint4B

+0x0b0 ObjectLocks : [4] _ERESOURCE

lkd> dt _OBJECT_TYPE_INITIALIZER

nt!_OBJECT_TYPE_INITIALIZER

+0x000 Length : Uint2B

+0x002 UseDefaultObject : UChar

+0x003 CaseInsensitive : UChar

+0x004 InvalidAttributes : Uint4B

+0x008 GenericMapping : _GENERIC_MAPPING

+0x018 ValidAccessMask : Uint4B

+0x01c SecurityRequired : UChar

+0x01d MaintainHandleCount : UChar

+0x01e MaintainTypeList : UChar

+0x020 PoolType : _POOL_TYPE

+0x024 DefaultPagedPoolCharge : Uint4B

+0x028 DefaultNonPagedPoolCharge : Uint4B

+0x02c DumpProcedure : Ptr32 void

+0x030 OpenProcedure : Ptr32 long

+0x034 CloseProcedure : Ptr32 void

+0x038 DeleteProcedure : Ptr32 void

+0x03c ParseProcedure : Ptr32 long

+0x040 SecurityProcedure : Ptr32 long

+0x044 QueryNameProcedure : Ptr32 long

+0x048 OkayToCloseProcedure : Ptr32 unsigned char

对于第二个问题:

2. 怎样得到pOldParseProcedure的地址

1. 打开一个文件得到文件句柄 ZwOpenFile

2. 依据文件句柄得到文件 ObReferenceObjectByHandle得到pObject

3. pObject是_OBJECT_HEADER 结构中Body的数值,如今要得到_OBJECT_HEADER 的地址,用宏CONTAINING_RECORD((o),OBJECT_HEADER,Body)

4. POBJECT_HEADER结构的Type指向了一个OBJECT_TYPE( pType)

4. OldParseProcedure = pType->TypeInfo.ParseProcedure就是要的结果

整理一下结构间的关系:

#define OBJECT_TO_OBJECT_HEADER(o) CONTAINING_RECORD((o),OBJECT_HEADER,Body)
POBJECT_HEADER addrs=NULL;
POBJECT_TYPE pType= NULL;

addrs=OBJECT_TO_OBJECT_HEADER(pObject);//获取对象头

pType=addrs->Type;//获取对象类型结构 object-10h
OldParseProcedure = pType->TypeInfo.ParseProcedure;//获取服务函数原始地址OBJECT_TYPE+9C位置为打开

typedef struct _OBJECT_HEADER {

LONG PointerCount;

union {

LONG HandleCount;

PSINGLE_LIST_ENTRY SEntry;

};

POBJECT_TYPE Type;

UCHAR NameInfoOffset;

UCHAR HandleInfoOffset;

UCHAR QuotaInfoOffset;

UCHAR Flags;

union

{

POBJECT_CREATE_INFORMATION ObjectCreateInfo;

PVOID QuotaBlockCharged;

};

PSECURITY_DESCRIPTOR SecurityDescriptor;

QUAD Body;

} OBJECT_HEADER, *POBJECT_HEADER;

pType的值为0x821ebe70

lkd> dt _object_type 0x821ebe70

nt!_OBJECT_TYPE

+0x000 Mutex : _ERESOURCE

+0x038 TypeList : _LIST_ENTRY [ 0x821ebea8 - 0x821ebea8 ]

+0x040 Name : _UNICODE_STRING "File"

+0x048 DefaultObject : 0x0000005c

+0x04c Index : 0x1c

+0x050 TotalNumberOfObjects : 0xcd6

+0x054 TotalNumberOfHandles : 0x316

+0x058 HighWaterNumberOfObjects : 0xd6e

+0x05c HighWaterNumberOfHandles : 0x3ad

+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER

+0x0ac Key : 0x656c6946

+0x0b0 ObjectLocks : [4] _ERESOURCE

3. 怎样改写((POBJECT_TYPE)*IoDeviceObjectType)->TypeInfo.ParseProcedure=pNewProcedure

关闭写保护

HOOK

打开写保护

函数定义方法:

NTSTATUS (*oldParseProcedure)(IN PVOID ParseObject,

IN PVOID ObjectType,

IN OUT PACCESS_STATE AccessState,

IN KPROCESSOR_MODE AccessMode,

IN ULONG Attributes,

IN OUT PUNICODE_STRING CompleteName,

IN OUT PUNICODE_STRING RemainingName,

IN OUT PVOID Context OPTIONAL,

IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,

OUT PVOID *Object);

此时,就已经HOOK成功了

解决完上面的困难,真正的代码来了




//PVOID oldParseProcedure;
//typedef int (*FP_CALC)(int, int);
NTSTATUS (*oldParseProcedure)(IN PVOID ParseObject,
	IN PVOID ObjectType,
	IN OUT PACCESS_STATE AccessState,
	IN KPROCESSOR_MODE AccessMode,
	IN ULONG Attributes,
	IN OUT PUNICODE_STRING CompleteName,
	IN OUT PUNICODE_STRING RemainingName,
	IN OUT PVOID Context OPTIONAL,
	IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
	OUT PVOID *Object);

VOID MyObjectHook()
{
	UNICODE_STRING uFileName;
	OBJECT_ATTRIBUTES ob;
	NTSTATUS status;
	HANDLE hFile;
	IO_STATUS_BLOCK ioStaBlock;
	PVOID pObject;
	POBJECT_HEADER addr;
	POBJECT_TYPE pType;
	OBJECT_TYPE_INITIALIZER  obTypeInit;
	KIRQL irql;

	dprintf("enter myObjectHook...\n");
	DbgBreakPoint();

	RtlInitUnicodeString(&uFileName,L"\\Device\\HarddiskVolume1\\123.txt");//这个文件必需存在
	InitializeObjectAttributes(&ob,&uFileName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE ,NULL, NULL);
	status = ZwOpenFile(&hFile,GENERIC_ALL,&ob,&ioStaBlock,0,FILE_NON_DIRECTORY_FILE);
	if (!NT_SUCCESS(status))
	{
		dprintf("ZwOpenFile error..\n");
		return ;
	}
	status = ObReferenceObjectByHandle(hFile,GENERIC_ALL,NULL,KernelMode,&pObject,NULL);
	if (!NT_SUCCESS(status))
	{
		dprintf("ObReferenceObjectByHandle:Object is Null\n");
		return ;
	}
	dprintf("pObject is 0x%08X\n",pObject);

	addr = OBJECT_TO_OBJECT_HEADER(pObject);

	dprintf("addr is 0x%08X\n",addr);  //这里是pObject-0x18的位置

	pType = addr->Type;

	dprintf("pType is 0x%08X\n",pType);  

	//oldParseProcedure = (PVOID)(pType->TypeInfo.ParseProcedure);
	oldParseProcedure = pType->TypeInfo.ParseProcedure;
	dprintf("OldParseProcedure addrs is %08X\n",oldParseProcedure);

	//HOOK 一下下
	irql =  WPOFF();
	pType->TypeInfo.ParseProcedure = NewParseProcedure;//hook
	WPON(irql);
	//关闭句柄 
	ZwClose(hFile);
}


//OBJECT HOOK 函数
NTSTATUS NewParseProcedure(IN PVOID ParseObject,
	IN PVOID ObjectType,
	IN OUT PACCESS_STATE AccessState,
	IN KPROCESSOR_MODE AccessMode,
	IN ULONG Attributes,
	IN OUT PUNICODE_STRING CompleteName,
	IN OUT PUNICODE_STRING RemainingName,
	IN OUT PVOID Context OPTIONAL,
	IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
	OUT PVOID *Object)
{
	NTSTATUS status = STATUS_UNSUCCESSFUL;
	PVOID namePool;

	if (RemainingName->Buffer)
	{
		namePool = ExAllocatePool(NonPagedPool, RemainingName->Buffer+2);
		RtlZeroMemory(namePool, RemainingName->Buffer+2);
		if (namePool)
		{
			RtlCopyMemory(namePool, RemainingName->Buffer,RemainingName->Length);
			_wcsupr((wchar_t*)namePool);
			if (wcsstr(namePool, L"TEST.TXT"))
			{
				ExFreePool(namePool);
				return STATUS_ACCESS_DENIED;
			}
		}
	}

	return oldParseProcedure(ParseObject, 
							ObjectType,
							AccessState,
							AccessMode,
							Attributes,
							CompleteName,
							RemainingName,
							Context,
							SecurityQos,
							*Object);
}



//object hook
VOID MyObjectHook();
#define OBJECT_TO_OBJECT_HEADER(o)\
	CONTAINING_RECORD((o),OBJECT_HEADER,Body)
typedef struct _OBJECT_HEADER {
	LONG PointerCount;
	union {
		LONG HandleCount;
		PSINGLE_LIST_ENTRY SEntry;
	};
	POBJECT_TYPE Type;
	UCHAR NameInfoOffset;
	UCHAR HandleInfoOffset;
	UCHAR QuotaInfoOffset;
	UCHAR Flags;
	union
	{
		PVOID ObjectCreateInfo;
		PVOID QuotaBlockCharged;
	};
	PSECURITY_DESCRIPTOR SecurityDescriptor;
	QUAD Body;
} OBJECT_HEADER, *POBJECT_HEADER;

NTSTATUS NewParseProcedure(IN PVOID ParseObject,
	IN PVOID ObjectType,
	IN OUT PACCESS_STATE AccessState,
	IN KPROCESSOR_MODE AccessMode,
	IN ULONG Attributes,
	IN OUT PUNICODE_STRING CompleteName,
	IN OUT PUNICODE_STRING RemainingName,
	IN OUT PVOID Context OPTIONAL,
	IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
	OUT PVOID *Object);

object hook实现禁止创建文件的更多相关文章

一个简单的Object Hook的例子（win7 32bit）
Object Hook简单的来说就是Hook对象,这里拿看雪上的一个例子,因为是在win7 32位上的,有些地方做了些修改. _OBJECT_HEADER: kd> dt _OBJECT_HEA ...
HOOK NTFS 禁止格式化
if(bHooked == FALSE) { RtlInitUnicodeString (&HookDriverName, L"\\FileSystem\\Ntfs"); ...
Java File文件操作创建文件\目录，删除文件\目录
Java手册 java.io 类 File java.lang.Object java.io.File 所有已实现的接口: Serializable, Comparable<File> p ...
apache环境下禁止某文件夹内运行PHP脚本、禁止访问文件或目录执行权限的设置方法
apache环境下禁止某文件夹内运行PHP脚本.禁止访问文件或目录执行权限的设置方法首先我们来看两段对上传目录设置无权限的列子,配置如下: <Directory "要去掉PHP执 ...
【转】c# winform 创建文件，把值写入文件，读取文件里的值，修改文件的值，对文件的创建，写入，修改
创建文件和读取文件的值 #region 判断文件是否存在,不存在则创建,否则读取值显示到窗体 public FormMain() { InitializeComponent(); //ReadFile ...
python在windows系统上创建文件
正确方法为:open("test1.txt",'wb')或open("test1.txt",'w') 以下是网上的方法创建遇到的问题使用Python2.7在w ...
98）PHP，文件类型获取和创建文件夹
看手册 finfo这个类:This class provides an object oriented interface into the fileinfo functions. 这个$mime_ ...
centos彻底删除文件夹创建文件
centos彻底删除文件夹.文件命令(centos 新建.删除.移动.复制等命令: 1.新建文件夹 mkdir 文件名新建一个名为test的文件夹在home下 view source1 mkdir ...
linux下创建文件与目录时默认被赋予了什么样的权限?
当我们创建一个新的文件或目录的时候,他的默认权限是什么? umask--指定当前使用者在创建文件或目录的时候默认的权限值 [root@iZ288fgkcpkZ default]# umask [roo ...

随机推荐

python中的enumerate使用
enumerate函数用于遍历序列中的元素以及它们的下标,多用于在for循环中得到计数,enumerate参数为可遍历的变量,如字符串,列表等一般情况下对一个列表或数组既要遍历索引又要遍历元素时, ...
mysql错误Table ‘./mysql/proc’ is marked as crashed and should be repaired
今天服务器当机了,重启后就发现了如下错误: Table ‘./mysql/proc’ is marked as crashed and should be repaired 解决方法: repair ...
Burpsuite使用技巧
在bp任意窗口中,选中需要转码的字符串,按ctrl+b,则可以被转换成base64编码
Bot Framework测试
在开发完成Bot Framework后,在本机的模拟器都是成功的,但未知在发布后会出现什么样的问题,所以需要将本机发布的站点给到Bot 1.在Bot Framework注册一个Bot,打开Bot Fr ...
python redis使用方法
一.mac 下redis安装 1.brew安装redis brew install redis 2.启动redis服务器 brew services start redis 或者 redis-serv ...
51nod 1129 字符串最大值
首先我们可以想到的是,既然求的是前缀的长度,就意味着一定是从1开始的,那么我们可以直接用下标表示每一个前缀.但是可能存在几个前缀互相包含的情况,比如:abababa我们可以看见的是aba中包含着ab ...
(转)解析json xml
JSON数据 {"videos":[{"id":1,"image":"resources/images/minion_01.png ...
【最小割】【Dinic】【强联通分量缩点】bzoj1797 [Ahoi2009]Mincut 最小割
结论: 满足条件一:当一条边的起点和终点不在残量网络的一个强联通分量中.且满流. 满足条件二:当一条边的起点和终点分别在 S 和 T 的强联通分量中.且满流.. 网上题解很多的. #include ...
[JOISC2014]JOIOJI
题目大意: 给你一串仅包含'J''O''I'的字符串,问满足三种字符出现次数相等的最大字串是多少? 思路: 用map存一下出现次数前缀和两两之差出现的最早位置,每次看一下当前的两两之差最早的出现位置是 ...
Java高级架构师（一）第10节：Spring+Mybatis实现DAO
maven配置memcached.jar 由于目前java memcached client没有官方的maven repository可供使用,因此使用时需要手动将其安装到本地repository. ...

object hook实现禁止创建文件

object hook实现禁止创建文件的更多相关文章

随机推荐

热门专题