SSDT Hook

一、效果图

二、分析

这里对NtCreateProcessEx做拦截，用WinDbg来定位该函数在SSDT中的记录地址：

: kd> dd KeServiceDescriptorTable
8055d700    0000011c 805058c4
8055d710
8055d720
8055d730
8055d740    bf80c0b6
8055d750  f8399a80 f82ffb60 820f06b0 806f70c0
8055d760  071d8498  0b14f8a6
8055d770   01cf525a
: kd> dd  + 0x30 *
  805d2136  805ac3ae
  805c49b6 805d1fd4  805fa0e6
  805a60f4 80643f58 806440a8
   806170d6 80577c2c 80624c16
  805f5958 80624de6 8057a24a
  805befc4 805edd88 806170e4 80624fc6
  806170c8  805b4c9e 805edf34
  8061660c 80577cf8 805b7806 8062549a
: kd> u 805d2136
nt!NtCreateProcessEx:
805d2136 6a0c            push    0Ch
805d2138 68e0b84d80      push    offset nt!ObWatchHandles+0x684 (804db8e0)
805d213d e83eaaf6ff      call    nt!_SEH_prolog (8053cb80)
805d2142 64a124010000    mov     eax,dword ptr fs:[00000124h]
805d2148 33d2            xor     edx,edx
805d214a     cmp     byte ptr [eax+140h],dl
805d2150             je      nt!NtCreateProcessEx+0x51 (805d2187)
805d2152 8955fc          mov     dword ptr [ebp-],edx

三、源代码

#include <ntddk.h>

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
    PULONG    ServiceTableBase;
    PULONG    ServiceCounterTableBase;
    ULONG    NumberOfServices;
    PUCHAR    ParamTableBase;
}SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TALBLE;

extern PSERVICE_DESCRIPTOR_TALBLE KeServiceDescriptorTable;

typedef NTSTATUS (*NTCREATEPROCESSEX)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, ULONG, HANDLE, HANDLE, HANDLE, ULONG);

//保存NtCreateProcessEx函数的地址
NTCREATEPROCESSEX ulNtCreateProcessEx = ;
//在指针数组中NtCreateProcessEx的地址
ULONG ulNtCreateProcessExAddr = ;

VOID UN_PROTECT()
{
    _asm
    {
        push    eax
        mov        eax,0FFFEFFFFh
        mov        CR0,eax
        pop        eax
    }
}

VOID RE_PROTECT()
{
    _asm
    {
        push    eax
        mov        eax,CR0
        or        eax,0FFFEFFFFh
        mov        CR0,eax
        pop        eax
    }
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
    UN_PROTECT();

    //替换NtCreateProcessEx的地址为MyNtCreateProcessEx
    *(PULONG)ulNtCreateProcessExAddr = (ULONG)ulNtCreateProcessEx;

    RE_PROTECT();
}

NTSTATUS MyNtCreateProcessEx
(
    __out        PHANDLE                ProcessHandle,
    __in        ACCESS_MASK            DesiredAccess,
    __in_opt    POBJECT_ATTRIBUTES    ObjectAttributes,
    __in        HANDLE                ParentProcess,
    __in        ULONG                Flags,
    __in_opt    HANDLE                SectionHandle,
    __in_opt    HANDLE                DebugPort,
    __in_opt    HANDLE                ExceptionPort,
    __in        ULONG                JobMemberLevel
)
{
    NTSTATUS Status = STATUS_SUCCESS;
    KdPrint(("Enter MyNtCreateProcessEx! \r\n"));

    Status = ulNtCreateProcessEx(ProcessHandle,
        DesiredAccess, ObjectAttributes, ParentProcess,
        Flags, SectionHandle, DebugPort, ExceptionPort, JobMemberLevel);

    return Status;
}

VOID HookCreateProcess()
{
    ULONG ulSsdt = ;

    //获取SSDT
    ulSsdt = (ULONG)KeServiceDescriptorTable->ServiceTableBase;

    //获取NtCreateProcessEx地址的指针
    ulNtCreateProcessExAddr = ulSsdt + 0x30 * ;

    //备份NtCreateProcessEx的原始地址
    ulNtCreateProcessEx = (NTCREATEPROCESSEX)*(PULONG)ulNtCreateProcessExAddr;

    UN_PROTECT();

    //替换NtCreateProcessEx的地址为MyNtCreateProcessEx
    *(PULONG)ulNtCreateProcessExAddr = (ULONG)MyNtCreateProcessEx;

    RE_PROTECT();
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
    NTSTATUS Status = STATUS_SUCCESS;
    pDriverObject->DriverUnload = DriverUnload;

    HookCreateProcess();

    return Status;
}