蹂躪D&F學習之一

uf KeAddSystemServiceTable

[

]

一個叫二石的人在元月，在樹下，吃月餅:

1.獲取NtCreateFile索引：

方法一，不能用xuetr，xuetr只能看被HOOK的。PowerTool也只能看被HOOK的，不知道是不是比xuetr深入，可以看TP保護。KD：

方法二，OD：

附加隨便一個進程。不需要運行，直接右擊--查詢--符號，進入下面的界面：

右擊--選擇反彙編窗口中跟隨輸入函數：

Ctrl+Shift+X，添加類嚮導：

刪除代碼段：

**********************************************************************************

ULONG GetSDDTAddr(ULONG uIndex)
{
	
}

typedef struct _SDT_ENTRY
{
	PVOID *ServiceTableBase;
	PULONG ServiceCounterTableBase; //Used only in checked build
	ULONG NumberOfServices;
	PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;

***********************************************************************************************************

<img src="https://img-blog.csdn.net/20150115135603025?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<pre name="code" class="cpp">//源文件
#include <ntddk.h>
#include "SSDTHOOK.h"
void UnloadDriver(PDRIVER_OBJECT pDriver);

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING str)
{
#if DBG
	_asm int 3
#endif
	//驅動 ->驅動卸載=卸載驅動
	pDriver->DriverUnload = UnloadDriver;
	//調試輸出
	DbgPrint("Loading MyDriver...\r");//有一個換行的空格
	ULONG uAddr = GetSDDTAddr(0x42);
	if (uAddr)
	{
		KdPrint(("NtCreateFile:0x%08x\r", uAddr));
	}
	return 1;
}

void UnloadDriver(PDRIVER_OBJECT pDriver)
{
	//調試輸出
	DbgPrint("unLoading MyDriver...\r");

}

<img src="https://img-blog.csdn.net/20150115135612946?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />

<pre name="code" class="cpp">//SSDTHOOK.cpp
#include "SSDTHOOK.h"

ULONG GetSDDTAddr(ULONG uIndex)
{
	ULONG uAddr = *(PULONG)((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
	return uAddr;
}

</pre><img src="https://img-blog.csdn.net/20150115135815109?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvRVhQRU5G/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" /><br /><pre name="code" class="cpp">//SSDTHOOK.h
#pragma once

#ifdef  __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef  __cplusplus
};// extern "C"
#endif


typedef struct _SDT_ENTRY
{
	PVOID *ServiceTableBase;
	PULONG ServiceCounterTableBase; //Used only in checked build
	ULONG NumberOfServices;
	PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;

EXTERN_C SDT_ENTRY *KeServiceDescriptorTable;

ULONG GetSDDTAddr(ULONG uIndex);

Alt+5打開debug的內存窗口。

FlashFXP

windows XP桌面路徑：C:\Documents and Settings\用戶名\桌面

//沒有VMTOOL 竟然可以共享剪貼板
Microsoft Windows XP [版本 5.1.2600]
(C) 版權所有 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig

Windows IP Configuration


Ethernet adapter 本地連接:

        Connection-specific DNS Suffix  . : localdomain
        IP Address. . . . . . . . . . . . : 192.168.232.129
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.232.2

C:\Documents and Settings\Administrator>

FileZilla（在查看裏，把消息日誌取消）可以比較目錄。

FlashFXP建立本地連接不行；安裝在系統盤。

//源文件
#include "mini_ddk.h"
#include "SSDTHOOK.h"




ULONG g_uOldNtCreateFileAddr = 0;
PFNNTCREATEFILE g_pfnNtCreateFile = NULL;

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING str)
{
//#if DBG
//	_asm int 3
//#endif
	//驅動 ->驅動卸載=卸載驅動
	pDriver->DriverUnload = UnloadDriver;
	//調試輸出
	DbgPrint("Loading MyDriver...\r");//有一個換行的空格
	ULONG uAddr = GetSDDTAddr(0x42);
	if (uAddr)
	{
		g_pfnNtCreateFile = (PFNNTCREATEFILE)uAddr;
		HookSSDTByMdl(0x42, (ULONG)rlNtCreateFile, &g_uOldNtCreateFileAddr);

		
		KdPrint(("NtCreateFile:0x%08x\r", uAddr));

	}
	return 1;
}

void UnloadDriver(PDRIVER_OBJECT pDriver)
{
	UnHookSSDTByMdl(0x42, g_uOldNtCreateFileAddr);
	//調試輸出
	DbgPrint("unLoading MyDriver...\r");
}

NTSTATUS rlNtCreateFile(
	_Out_     PHANDLE FileHandle,
	_In_      ACCESS_MASK DesiredAccess,
	_In_      POBJECT_ATTRIBUTES ObjectAttributes,
	_Out_     PIO_STATUS_BLOCK IoStatusBlock,
	_In_opt_  PLARGE_INTEGER AllocationSize,
	_In_      ULONG FileAttributes,
	_In_      ULONG ShareAccess,
	_In_      ULONG CreateDisposition,
	_In_      ULONG CreateOptions,
	_In_      PVOID EaBuffer,
	_In_      ULONG EaLength
	)
{
	if (ObjectAttributes  && ObjectAttributes->ObjectName)
	{
		if (wcsstr(ObjectAttributes->ObjectName->Buffer, L"1.txt") != 0)
		{
			KdPrint(("NtCreateFile %wZ\r"), ObjectAttributes->ObjectName);
			return STATUS_UNSUCCESSFUL;
		}

	}
	return g_pfnNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes,

		ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);

}

//SSDTHOOK.cpp
#include "SSDTHOOK.h"

ULONG GetSDDTAddr(ULONG uIndex)
{
	ULONG uAddr = *(PULONG)((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));
	return uAddr;
}

BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr)

{
	if (uNewAddr == 0 || puOldAddr == NULL)
	{
		return FALSE;
	}
	ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));

*puOldAddr = *(PULONG)uAddr;

	//DisableWP();
	*(PULONG)uAddr=uNewAddr;
	//EnableWP();
	return TRUE;
}

BOOLEAN unHookSSDT(ULONG uIndex, PULONG uOldAddr)
{
	if (uOldAddr == 0)
	{
		return FALSE;
	}

	ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex * sizeof(ULONG));

	//DisableWP();
	*(PULONG)uAddr = uOldAddr;
	//EnableWP();

	return TRUE;

}



void DisableWP()
{
	_asm
	{
		cli//不要切換到其他CPU
			push eax
			mov eax,cr0
			and eax,0xfffeffff
			mov cr0,eax
			pop eax


	}
}

void EnableWP()
{
	_asm
	{
		push eax
			mov eax,cr0
			or eax,0x10000
			mov cr0,eax
			pop eax
			sti
	}
}


BOOLEAN HookSSDTByMdl(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr)

{
	if (uNewAddr == 0 || puOldAddr == NULL)
	{
		return FALSE;
	}

	PMDL pSSDTMdl= MmCreateMdl(NULL, (*KeServiceDescriptorTable).ServiceTableBase, sizeof(ULONG)* (*KeServiceDescriptorTable).NumberOfServices);
if (pSSDTMdl == NULL)
	{
		return FALSE;

	}
	MmBuildMdlForNonPagedPool(pSSDTMdl);

	pSSDTMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;

	PVOID pServiceTableBase = MmMapLockedPages(pSSDTMdl, KernelMode);


	if (pServiceTableBase == NULL)
	{
		return FALSE;
	}

	ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex);

	*puOldAddr = *(PULONG)uAddr;
	
	*(PULONG)uAddr = uNewAddr;

	IoFreeMdl(pSSDTMdl);
	return TRUE;
}

BOOLEAN UnHookSSDTByMdl(ULONG uIndex, ULONG uOldAddr)

{
	if ( uOldAddr == NULL)
	{
		return FALSE;
	}

	PMDL pSSDTMdl = MmCreateMdl(NULL, (*KeServiceDescriptorTable).ServiceTableBase, sizeof(ULONG)* (*KeServiceDescriptorTable).NumberOfServices);
	if (pSSDTMdl == NULL)
	{
		return FALSE;

	}
	MmBuildMdlForNonPagedPool(pSSDTMdl);

	pSSDTMdl->MdlFlags |= MDL_MAPPED_TO_SYSTEM_VA;

	PVOID pServiceTableBase = MmMapLockedPages(pSSDTMdl, KernelMode);


	if (pServiceTableBase == NULL)
	{
		return FALSE;
	}

	ULONG uAddr = ((ULONG)(*KeServiceDescriptorTable).ServiceTableBase + uIndex);


	*(PULONG)uAddr = uOldAddr;

	IoFreeMdl(pSSDTMdl);
	return TRUE;
}

//SSDTHOOK.h
#pragma once

#ifdef  __cplusplus
extern "C" {
#endif
#include <ntddk.h>
#include <string.h>
#ifdef  __cplusplus
};// extern "C"
#endif


typedef struct _SDT_ENTRY
{
	PVOID *ServiceTableBase;
	PULONG ServiceCounterTableBase; //Used only in checked build
	ULONG NumberOfServices;
	PUCHAR ParamTableBase;
} SDT_ENTRY, *PSDT_ENTRY;

EXTERN_C SDT_ENTRY *KeServiceDescriptorTable;

ULONG GetSDDTAddr(ULONG uIndex);
//BOOLEAN HookSSDT(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr);
//BOOLEAN unHookSSDT(ULONG uIndex, PULONG uOldAddr);

//void DisableWP();
//void EnableWP();
BOOLEAN HookSSDTByMdl(ULONG uIndex, ULONG uNewAddr, PULONG puOldAddr);
BOOLEAN UnHookSSDTByMdl(ULONG uIndex, ULONG uOldAddr);

//mini_ddk.h
#include <ntddk.h>


void UnloadDriver(PDRIVER_OBJECT pDriver);
NTSTATUS rlNtCreateFile(
	_Out_     PHANDLE FileHandle,
	_In_      ACCESS_MASK DesiredAccess,
	_In_      POBJECT_ATTRIBUTES ObjectAttributes,
	_Out_     PIO_STATUS_BLOCK IoStatusBlock,
	_In_opt_  PLARGE_INTEGER AllocationSize,
	_In_      ULONG FileAttributes,
	_In_      ULONG ShareAccess,
	_In_      ULONG CreateDisposition,
	_In_      ULONG CreateOptions,
	_In_      PVOID EaBuffer,
	_In_      ULONG EaLength
	);
typedef NTSTATUS (*PFNNTCREATEFILE)(
	_Out_     PHANDLE FileHandle,
	_In_      ACCESS_MASK DesiredAccess,
	_In_      POBJECT_ATTRIBUTES ObjectAttributes,
	_Out_     PIO_STATUS_BLOCK IoStatusBlock,
	_In_opt_  PLARGE_INTEGER AllocationSize,
	_In_      ULONG FileAttributes,
	_In_      ULONG ShareAccess,
	_In_      ULONG CreateDisposition,
	_In_      ULONG CreateOptions,
	_In_      PVOID EaBuffer,
	_In_      ULONG EaLength
	);