4.2.1xx游戏驱动保护代码书写-49课

1、4.2.1 XX驱动保护代码书写-49课A、定位特征码函数FindCode_Address构建 B、定位NtOpenThreadC、定位NtOpenProsD、定位NtReadVirtualMemory E、定位NtWriteVirtualMemory F、CALL与JMP指令的区别G、构建相应的替换函数:39分OpenPro OpenThreads/NtOpenPros+0 x21E /SSDT 122/NtOpenThread+0 x214/SSDT 128RerosMemory sMemory/NtReadVirtualMemory+0/NtWriteVirtualMemory+0/SS

2、DT/SSDT186277WriteProRe mov jmprosMemoryeax,Proc eaxWriteProsMemorymov eax,Proc2 jmp eaxWriteProsMemory+7#pragma PAGECODE declspec(naked)VOID/恢复前2条指令 asmpush1ChMy_RerosMemory()#pragma PAGECODE declspec(naked)VOID_OpenPros() asmpush push mov add push/ jmpdword ptr ebp-38h dword ptr ebp-24h eax,ntopen

3、prcaddr eax,0bheax /CALL后返回的地址 非压栈参数ObOpenObjectByPoeraddr=笔记:上节课有个函数写错了,应该是 NtDebugActivePros.将 46 课的源代码过来,新建一个49.H 头文件.首先通过 NtReadVirtualMemory 函数,建立函数先恢复前面几个字节,然后再跳回sMemory 也写上恢复代码.再写nOpenPros 函数的恢复,但是到原函数.同理WritePro这个不能在头部直接恢复,是要在后面偏移 0X21E 处修改. n人不明白汇编又讲解call = push + jmp 的原理.最终代码如下:OpenThread

4、的方法也类似.怕有/nReadVirtualMemory:/805b528a 6a1cpush1Ch push/805b528c 68e8ae4d80 (804daee8)offset nt!MmClaimParameterAdjustDownTime+0 x90DWORD Real_NtReadVirtualMemory_7 =0 x805b5291; DWORD Real_NtWriteVirtualMemory_7=0 x805b5394;DWORD NtOpenPros_21E=0 x805cc61a; /myNtOpenProsDWORD NtOpenThread_214=805cc

5、89ch;/myNtOpenThreadDWORD NtOpenThread_214_B=805cc8a7h;DWORD NtOpenPros_21E_B=805cc625h; #pragma PAGECODE declspec(naked)VOID My_NtReadVirtualMemory()/恢复前 2 条指令 asmpush puhs1Ch 804daee8hjmpReal_NtReadVirtualMemory_7#pragma PAGECODE declspec(naked)VOID My_NtWriteVirtualMemory()/恢复前 2 条指令/nWriteVirtua

6、lMemory:/ 805b5394 6a1cpush1Ch push/ 805b5396 6800af4d80 (804daf00)offset nt!MmClaimParameterAdjustDownTime+0 xa8 asmpush puhs jmp1Ch 804daf00hReal_NtWriteVirtualMemory_7/ OpenPros/NtOpenPros+0 x21E s+0 x21e:/SSDT 122/ nOpenPro/ 805cc61a ff75c8/ 805cc61d ff75dcpush push callmovdword ptr ebp-38h /jmp

7、 My_NtOpenPrcoess dword ptr ebp-24h/ 805cc620 e84706f/ 805cc625 8bf8 #pragma PAGECODEnt!ObOpenObjectByPo edi,eaxer (805bcc6c) declspec(naked)VOID My_NtOpenPrcoess()/恢复前 2 条指令/nWriteVirtualMemory:/ 805b5394 6a1cpush push1Choffset nt!MmClaimParameterAdjustDownTime+0 xa8/ 805b5396 6800af4d80(804daf00)

8、asmpush push push jmp/jmpdword ptr ebp-38h dword ptr ebp-24hNtOpenPros_21E_B /DWORD NtOpenPros_21E_B=805cc625hObOpenObjectByPoer /*(805bcc6c)*/ ret c3 eipNtOpenPros_21E_B/ OpenThread/805cc89cff75cc/NtOpenThread+0 x214push/SSDT 128dwordptrebp-34h/jmpDWORDNtOpenThread_214=805cc89ch;/ 805cc8975e0pushdw

9、ord ptr ebp-20h nt!ObOpenObjectByPoedi,eax/ 805cc8a2 e8c503/ 805cc8a7 8bf8fcaller (805bcc6c)mov#pragma PAGECODE declspec(naked)VOID My_NtOpenThread()/恢复前 2 条指令/nWriteVirtualMemory:/ 805b5394 6a1cpush push1Choffset nt!MmClaimParameterAdjustDownTime+0 xa8/ 805b5396 (804daf00)6800af4d80 asmpush push pu

10、sh jmpdword ptr ebp-34h dword ptr ebp-20hNtOpenPros_214_B / DWORD NtOpenPros_214_B=805cc8a7hObOpenObjectByPoer /*(805bcc6c)*/jmpNtOpenPros_214_B#pragmaPAGECODE VOID HOOK()/ SSDT 186 =My_NtReadVirtualMemory/ SSDT 277 =My_NtWriteVirtualMemory/DWORD NtOpenPros_21E=0 x805cc61a; /myNtOpenPros/DWORD NtOpenThread_214=805cc89ch; asm/myNtOpenThread/ NtOpenPros 还原lea ebx,NtOpenPro mov ebx+0,E9hlea eax,m