安全进阶9其他12hook shadow ssdt网上很多文章都的实现但是没有ShadowSSDT

标题:【】HookShadow作者:2008-06-链接: 网上很多文章都有关于SSDTShadowSSDT《shadowssdt笔记byzhuwg》，我这里的程序也很多参考了他的文章，在这里谢谢了。我这里给出一个hookshadowssdt动和3码。这里主要是hook了NtUserFindWindowEx，NtUserBuildHwndList，NtUserQueryWindow，NtUserGetForegroundWindow，NtUserWindowFromPoint通过FindWindow，EnumWindow，WindowFromPoint，GetForegroundWindow对于GetWindowText朋友在驱动层实现了对该函数的保护，是否能一起交流呢。看吧，通信方面，随便使用了METHOD_NEITHER的应该很容易改为BUFFERED在这里谢谢给了很多帮助的各位牛人，特别是NetRoc，很细心的帮我测试。。#include#include#include<windef.h>#include<stdio.h>#include<string.h>#includeVOIDUnloadDriver(INPDRIVER_OBJECT HideProcess_Create(INPDEVICE_OBJECT DeviceObject,IN HideProcess_Close(INPDEVICE_OBJECTDeviceObject,INPIRPIrp); HideProcess_IoControl(INPDEVICE_OBJECTDeviceObject,INPIRP PVOIDGetInfoTable(ULONGATableType);HANDLEGetCsrPid();VOIDNTSTATUS(INULONGulProcId,OUTCESS Nativetypedef HWNDhwndParent, HWNDhwndChild, PUNICODE_STRINGpstrClassNameOPTIONAL, PUNICODE_STRINGpstrWindowName DWORDtypedefNTSTATUS HDESKhdesk, HWNDhwndNext, ULONGfEnumChildren, DWORDidThread, UINT HWND ULONGtypedefUINT_PTRINULONG INULONG typedefULONGtypedefHWND(*NTUSERWINDOWFROMPOINT)(LONG,NTSTATUSINULONG INPVOID INULONG OUTPULONG NTSTATUS

DesiredAccessOPTIONAL,

NTSTATUS

NTSTATUS IN OUTPEPROCESS NTSTATUSKeAttachProcess(PEPROCESSpPeb);NTSTATUSKeDetachProcess();NTSTATUSINHWND INHWND INPUNICODE_STRINGpstrClassNameOPTIONAL,INPUNICODE_STRINGpstrWindowNameOPTIONAL,INDWORD NTSTATUSINHDESK INHWND INULONG INDWORD IN OUT OUTULONG*UINT_PTRIN IN ULONGHWNDMyNtUserWindowFromPoint(LONG LONGdeclspec(dllimport)_stdcallKeAddSystemServiceTable(PVOID,PVOID,PVOID,PVOID, declspec(dllimport) ServiceDescriptorTableEntryKeServiceDescriunsignedlongOldCr0;UNICODE_STRINGDeviceNameString;UNICODE_STRINGLinkDeviceNameString; NTUSERGETFOREGROUNDWINDOWg_OriginalNtUserGetForegroundWindow; PEPROCESS HANDLE ToProtect ULONGNtUserFindWindowEx_callnumber= erFindWindowEx NtUserGetForegroundWindow_callnumber= ULONGNtUserQueryWindow_callnumber= ULONGNtUserBuildHwndList_callnumber= ULONGNtUserWindowFromPoint_callnumber=0;ULONGLastForegroundWindow;unsignedint{unsignedinti;unsignedchar*p;unsignedintp (unsignedchar*)for(i 0; 4096; {{}

dwordatbyte *(unsigned{return}{if(memcmp((PVOID)dwordatbyte,&KeServiceDescriptorTable,16) ==0){

if((PVOID)dwordatbyte {} }}}return}ULONG{KeServiceDescriptorTableShadow=(PServiceDescriptorTableEntry)getAddressOfShadowTable();if(KeServiceDescriptorTableShadow {DbgPrint("hooker.sys:Couldntfind

}{

returnDbgPrint("hooker.sys:Shadowtablehas DbgPrint("hooker.sys:Shadowtableentries:%d",Kreturn}}VOIDInitCallNumber(){ULONGmajorVersion,PsGetVersion(&majorVersion,&minorVersion,NULL,NULL);if( majorVersion==5 minorVersion== {DbgPrint("comint32:Runningon Windows2003");NtUserFindWindowEx_callnumber= NtUserGetForegroundWindow_callnumber= NtUserBuildHwndList_callnumber=0x137;NtUserQueryWindow_callnumber= NtUserWindowFromPoint_callnumber=0x24C;} if majorVersion== minorVersion {DbgPrint("comint32:Runningon WindowsXP");NtUserFindWindowEx_callnumber= NtUserGetForegroundWindow_callnumber= NtUserBuildHwndList_callnumber=0x138;NtUserQueryWindow_callnumber= NtUserWindowFromPoint_callnumber=0x250;} if majorVersion== minorVersion {DbgPrint("comint32:Runningon Windows2000");NtUserFindWindowEx_callnumber= NtUserGetForegroundWindow_callnumber= NtUserBuildHwndList_callnumber=0x12E;NtUserQueryWindow_callnumber= NtUserWindowFromPoint_callnumber=0x238;}}PVOIDGetInfoTable(ULONG{ULONGmSize PVOIDmPtr NTSTATUSSt;{mPtr= ExAllocatePool(PagedPool,mSize);memset(mPtr,0, if{ =ZwQuerySystemInformation(ATableType,mPtr,Size,} returnif =={ mSize= mSize* } while == (St== STATUS_SUCCESS)return return}HANDLE{HANDLEProcess,hObject;HANDLECsrId =(HANDLE)0;OBJECT_ATTRIBUTESobj;_IDcid;UCHARBuff[0x100];POBJECT_NAME_INFORMATIONObjName= PSYSTEM_HANDLE_INFORMATION_EXHandles;ULONGHandles (!Handles)return (r r Handles->NumberOfHandles;{if(Handles->Information[r].ObjectTypeNumber== 21)//Portobject{InitializeObjectAttributes(&obj,NULL,OBJ_KERNEL_HANDLE,NULL,NULL);

cid.UniqueProcess=(HANDLE)Handles->Information[r].Procid.UniqueThread=0; (NT_SUCCESS(NtOpenProcess(&Process,PROCESS_DUP_HANDLE,&obj,&cid))){ (NT_SUCCESS(ZwDuplicateObject(Process,(HANDLE)Handles->Information[r].Handle,NtCurrentProcess(),&hObject,0,0,{if(NT_SUCCESS(ZwQueryObject(hObject,ObjectNameInformation,ObjName,0x100,NULL))){ (ObjName->Name.Buffer&&!wcsncmp(L"\\Windows\\ApiPort",ObjName->Name.Buffer,20)){

CsrId (HANDLE)Handles-}}}}}} returnCsrId;}BOOLEANSleep(ULONG{NTSTATUSLARGE_INTEGERDelayTime= st=KeDelayExecutionThread(KernelMode,FALSE,&DelayTime);return(NT_SUCCESS(st));}NTSTATUSDriverEntry PDRIVER_OBJECTDriverObject,IN_STRING{NTSTATUS RtlInitUnicodeString(&DeviceNameString, IN32_DEV_NAME);RtlInitUnicodeString(&LinkDeviceNameString,HIDE_PROCESS_DEV_NAME);KdPrint(("DriverEntry status

deviceObjectif(!NT_SUCCESS(status{KdPrint(("DriverEntry:Errorcreatingcontroldeviceobject,status=%08x\n",status return}

status (PUNICODE_STRING)&LinkDeviceNameStr(PUNICODE_STRING)&DeviceNameString {returnstatus;}shadowDriverObject->MajorFunction[IRP_MJ_CREATE] ;DriverObject->MajorFunction[IRP_MJ_CLOSE]= DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] DriverObject-status= ((ULONG)GetCsrPid(),&crsEP (!NT_SUCCESS( { ()error\n");returnstatus;}{if((KeServiceDescriptorTableShadow!=NULL) (NtUserFindWindowEx_callnumber!=0)&&(NtUserGetForegroundWindow_callnumber!=0)\ (NtUserBuildHwndList_callnumber!=0)&& Window_callnumber!=0)\ { g_OriginalNtUserWindowFromPoint=(NTUSERWINDOWFROM}to

{ //dissable EAX,CR0 CR0registerinANDEAX, NOT10000H//disableWP CR0, //write }if((KeServiceDescriptorTableShadow!=NULL) indowEx_callnumber!=0)&& (NtUserBuildHwndList_callnumber!=0) {eTableBase[NtUserFindWindowEx_callnumber])= ServiceTableBase[NtUserQueryWindow_callnumber]=MyNtUserQueryWineTableBase[NtUserBuildHwndList_callnumber]= adow[1].ServiceTableBase[NtUserGetForegroundWindow_callnumber] [1].ServiceTableBase[NtUserWindowFromPoint_callnumber]=MyNtUserWi}to

{ EAX,CR0 CR0registerin EAX,10000H //enableWP CR0, //write //enablet}}{}return }NTSTATUSHideProcess_Create(INPDEVICE_OBJECTDeviceObject,IN IRPIrp){Irp->IoStatus.Status= Irp->IoStatus.Information=0;pleteRequest(Irp,returnIrp-}NTSTATUSHideProcess_Close(INPDEVICE_OBJECTDeviceObject,INPIRPIrp){Irp->IoStatus.Status= Irp->IoStatus.Information=0;pleteRequest(Irp,returnIrp-}NTSTATUSHideProcess_IoControl(INPDEVICE_OBJECTDeviceObject,IN { status DWORDirpStack outputLength= inputLength=irpStack-controlCode irpStack-DbgPrint("INCONTROL\r\n");{ ToProtect= DbgPrint("IO_PROTECT:%d",Proce }Irp->IoStatus.Status= Irp->IoStatus.Information=0;pleteRequest(Irp,return}VOIDUnloadDriver(INPDRIVER_OBJECT{UNICODE_STRINGuniWin32NameString;UNICODE_STRINGLinkNameString;PDEVICE_OBJECTdeviceObject;NTSTATUSstatus= ((ULONG)GetCsrPid(),&crsEP (!NT_SUCCESS( { ()error\n");return;}//////////////////////UnHook{

{ //dissable EAX, CR0registerto

AND NOT //disableWP CR0, //write }if((KeServiceDescriptorTableShadow!=NULL)&& indowEx_callnumber!=0)&& (NtUserBuildHwndList_callnumber!=0)&& {eTableBase[NtUserFindWindowEx_callnumber])=g_OriginalNtUserFindWiableBase[NtUserQueryWindow_callnumber]=g_OriginalNtUserQuereTableBase[NtUserBuildHwndList_callnumber]=g_OriginalNtUserBuilServiceTableBase[NtUserGetForegroundWindow_callnumber]=g_OriceTableBase[NtUserWindowFromPoint_callnumber]=g_OriginalNtUserWi}to

{ EAX, CR0register EAX, //enableWP CR0, //write //enablet}}{}deviceObject=DriverObject->DeviceObject;if deviceObject!= {IoDeleteDevice(deviceObject}}NTSTATUSINHWND INHWND INPUNICOD