HOOK NtCreateSection

本程序使用了hde32反汇编引擎，所以性能更加稳定!





#pragma once

#include <ntddk.h>





NTSYSAPI

NTSTATUS

NTAPI

NtCreateSection(OUT PHANDLE SectionHandle,

        IN ACCESS_MASK DesiredAccess,

        IN POBJECT_ATTRIBUTES ObjectAttributes,

        IN PLARGE_INTEGER SectionSize OPTIONAL,

        IN ULONG Protect,

        IN ULONG Attributes,

        IN HANDLE FileHandle);





NTSTATUS

DetourNtCreateSection(OUT PHANDLE SectionHandle,

            IN ACCESS_MASK DesiredAccess,

            IN POBJECT_ATTRIBUTES ObjectAttributes,

            IN PLARGE_INTEGER SectionSize OPTIONAL,

            IN ULONG Protect,

            IN ULONG Attributes,

            IN HANDLE FileHandle);





VOID

TrueCellUnload(IN PDRIVER_OBJECT DriverObject);





BOOLEAN

HookFunc(BOOLEAN IsHook);





NTSTATUS

DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath);





NTSTATUS

IoQueryFileDosDeviceName(IN PFILE_OBJECT  FileObject,

            OUT POBJECT_NAME_INFORMATION  *ObjectNameInformation );









#include "Ncs.h"

#include "hde32.h"





#pragma comment(lib, "hde32.lib")









UCHAR OriFuncHead[12]={0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90};//假设目标函数头部有12个字节

UCHAR NewFuncHead[5]={0xE9,0x00,0x00,0x00,0x00};//jmp [相对偏移] 的字节码——奇妙的地方

ULONG ulHeadLen=0;





NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath){

    KdPrint(("[TrueCell] Driver Entry!\r\n"));

    DriverObject->DriverUnload=TrueCellUnload;

    return HookFunc(TRUE)?STATUS_SUCCESS:STATUS_UNSUCCESSFUL;

}





VOID TrueCellUnload(IN PDRIVER_OBJECT DriverObject){

    HookFunc(FALSE);

    KdPrint(("[TrueCell] Driver Unload!\r\n"));

}









_declspec(naked) NTSTATUS

GoNtCreateSection(OUT PHANDLE SectionHandle,

    IN ACCESS_MASK DesiredAccess,

    IN POBJECT_ATTRIBUTES ObjectAttributes,

    IN PLARGE_INTEGER SectionSize OPTIONAL,

    IN ULONG Protect,

    IN ULONG Attributes,

    IN HANDLE FileHandle){//跳板

    _asm{

        nop;//    \   

        nop;//    |

        nop;//    |

        nop;//    |

        nop;//    |

        nop;//    |   

        nop;//    ＞开辟足够大的空间来容纳NtCreateSection开头的ulHeadlen个字节的机器码

        nop;//    |

        nop;//    |

        nop;//    |

        nop;//    |

        nop;//    /

        mov        eax,NtCreateSection;

        add     eax,ulHeadLen;

        jmp     eax

    }

}





NTSTATUS

DetourNtCreateSection(OUT PHANDLE SectionHandle,

            IN ACCESS_MASK DesiredAccess,

            IN POBJECT_ATTRIBUTES ObjectAttributes,

            IN PLARGE_INTEGER SectionSize OPTIONAL,

            IN ULONG Protect,

            IN ULONG Attributes,

            IN HANDLE FileHandle){//代理函数

    PFILE_OBJECT    FileObject;

    POBJECT_NAME_INFORMATION wcFilePath;

    //由Protect判断当前Section是否可执行：一般将要执行的DLL和EXE的都是Section可执行的

    if (Protect & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY) ){

        //获取FileHandle对应的FILE_OBJEC——其有我们感兴趣的成员和作用

        if (NT_SUCCESS(ObReferenceObjectByHandle(FileHandle,0,NULL,KernelMode,&FileObject,NULL))){//获取文件对象       

        //获取FileObject对应的文件全路径

            if (IoQueryFileDosDeviceName(FileObject,&wcFilePath)==STATUS_SUCCESS){//获取文件对象所对应的文件Dos设备名称,即是全路径

               

                DbgPrint("[TrueCell] %ws\r\n",wcFilePath->Name.Buffer);

                ExFreePool(wcFilePath);//IoQueryFileDosDeviceName获取的OBJECT_NAME_INFORMATION 需要手动释放

            }

            ObDereferenceObject(FileObject);//放弃对FileObject的引用

        }       

    }

    //“返回”到真正的“跳板”处,完成Hook过程

    return GoNtCreateSection(SectionHandle,DesiredAccess,ObjectAttributes,SectionSize,Protect,Attributes,FileHandle);   

}





BOOLEAN HookFunc(BOOLEAN IsHook){

    ULONG  Offset;

    KIRQL  Irql;   

    ULONG  CR0Value;

    hde32s hs;

    PUCHAR code_pos;





    if (IsHook==FALSE && ulHeadLen==0){

        return FALSE;

    }

    KdPrint(("[TrueCell] %s\r\n",IsHook?"Hook":"UnHook"));





    Irql=KeRaiseIrqlToDpcLevel();

    if (IsHook){

        Offset=(ULONG)DetourNtCreateSection-(ULONG)NtCreateSection-5;

        RtlCopyMemory(NewFuncHead+1,(PUCHAR)&Offset,4);       





        code_pos=(PUCHAR )NtCreateSection;

        while (ulHeadLen<5){//利用反汇编引擎HDE,解析目标函数位置头部能容纳Hook跳转指令所需空间的大小

            RtlZeroMemory(&hs,sizeof(hs));

            ulHeadLen+=hde32_disasm(code_pos,&hs);

            code_pos+=ulHeadLen;

        }

        RtlCopyMemory(OriFuncHead,(PUCHAR)NtCreateSection,ulHeadLen);

        RtlCopyMemory(GoNtCreateSection,(PUCHAR)NtCreateSection,ulHeadLen);//将目标函数位置头部的指令复制到踏板函数体内

    }   

    _asm{//关闭写保护

        cli;

        push eax;   

        mov eax,cr0;

        mov CR0Value,eax;

        and eax,0xfffeffff;

        mov cr0,eax;

        pop eax;

    }

    if (IsHook){

        RtlMoveMemory((PUCHAR)NtCreateSection,NewFuncHead,5);

    }else{

        RtlMoveMemory((PUCHAR)NtCreateSection,OriFuncHead,ulHeadLen);

    }

    _asm{//重启写保护

        push eax;

        mov eax,CR0Value;

        mov cr0,eax;

        pop eax;

        sti;

    }

    KeLowerIrql(Irql);





    return TRUE;

}