硬件断点 DrxHook
硬件断点的实现需要依赖于调试寄存器
DR0~DR7 调试寄存器
DR0~DR3-----调试地址寄存器
DR4~DR5-----保留
DR6 -----调试状态寄存器 指示哪个调试寄存器被命中
DR7 -----调试控制寄存器
关于Dr7寄存器每个标志位的解释：
总结如下
DR7调试控制寄存器：
R/W0~R/W3：与DR0~DR3相对应，用来指定监控地址的访问类型，表示意义如下：
00：仅当执行对应的地址时中断
01：仅当写入对应的地址时中断
10：基本不用
11：读取对应的地址时中断，读取指令的指令除外
LEN0~LEN3：与DR0~DR3相对应，用来指定监控地址的长度，意义如下：
00：一个字节长
01：两个字节长
10：未定义或者代表8字节，具体视CPU而定
11：四个字节长
L0~L3：与DR0~DR3相对应，意思表示仅对当前
接下来看看两个Windows提供的两个API函数，GetThreadContext和SetThreadContext来获取或者时设置线程的上下文，什么是线程的上下文，就是线程运行时的各种寄存器的信息，比如调试寄存器，浮点寄存器，控制寄存器等等，在应用层是不能直接操作Drx寄存器的值，但可以调用这两个api来读写线程的上下文，来达到设置硬件断点的目的，如果想对某个进程设置硬件断点，就需要对它的每个线程都调用SetThreadContext()函数，设置Drx寄存器的值。
BOOL WINAPI GetThreadContext(
__in HANDLE hThread,
__inout LPCONTEXT lpContext
);
BOOL WINAPI SetThreadContext(
__in HANDLE hThread,
__in const CONTEXT *lpContext
);
在SSDT表中对应的NtGetContextThread和NtSetContextThread
NTSTATUS
NtGetContextThread(
__in HANDLE ThreadHandle,
__inout PCONTEXT ThreadContext
)
NTSTATUS
NtSetContextThread(
__in HANDLE ThreadHandle,
__in PCONTEXT ThreadContext
)
这两个函数都是调用了PsSet/GetContextThread函数
NTSTATUS
PsSetContextThread(
__in PETHREAD Thread,
__in PCONTEXT ThreadContext,
__in KPROCESSOR_MODE Mode
) NTSTATUS
PsGetContextThread(
__in PETHREAD Thread,
__inout PCONTEXT ThreadContext,
__in KPROCESSOR_MODE Mode
)
我们可以对PsGet/SetContextTread函数Hook来达到对设置硬件断点的一个过滤，对于目标进程获取或者设置线程的Context进行处理。
oid __stdcall FilterSetGetContextThread(
PETHREAD Thread,
PCONTEXT Context,
KPROCESSOR_MODE AccessMode)
{
__try{
if (AccessMode == UserMode)
{
//wrk 参数校验
ProbeForReadSmallStructure(Context,sizeof(CONTEXT),PROBE_ALIGNMENT(CONTEXT));
}else{
*Context = *Context;
} if (strstr(GetProcessNameByThread(Thread),"test.exe")!=NULL)
{
if (strstr((char*)PsGetCurrentProcess()+0x16c,"ollydbg") != NULL)
{
return;
}
//如果是要获得调试寄存器的值，将Flags 的获得调试寄存器清零， if (Context->ContextFlags | CONTEXT_DEBUG_REGISTERS)
{
Context->ContextFlags = ~CONTEXT_DEBUG_REGISTERS;
}
} }__except(EXCEPTION_EXECUTE_HANDLER){
return;
}
}
typedef NTSTATUS (*PSGETCONTEXTTHREAD)(
PETHREAD Thread,
PCONTEXT Context,
KPROCESSOR_MODE AccessMode); typedef NTSTATUS (*PSSETCONTEXTTHREAD)(
PETHREAD Thread,
PCONTEXT Context,
KPROCESSOR_MODE AccessMode); //global
PSGETCONTEXTTHREAD PsGetContextThread;
PSSETCONTEXTTHREAD PsSetContextThread; ULONG g_JmpGetContextThread;
UCHAR g_cGetContextCode[];
BOOLEAN g_bHookGetContextSuccess;
ULONG g_JmpSetContextThread;
UCHAR g_cSetContextCode[];
BOOLEAN g_bHookSetContextSuccess; char* GetProcessNameByThread(PETHREAD Thread)
{
ULONG ProcessObj;
if (MmIsAddressValid(Thread))
{
ProcessObj = *(ULONG*)((ULONG)Thread + 0x150);
return (char*)(ProcessObj+0x16C);
}
return ;
} void PageProtectOn()
{
__asm{//恢复内存保护
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
} void PageProtectOff()
{
__asm{//去掉内存保护
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
} BOOLEAN Jmp_HookFunction(
IN ULONG Destination,
IN ULONG Source,
IN UCHAR *Ori_Code
)
{
ULONG Jmp_Offest;
UCHAR Jmp_Code[] = {0xE9}; KSPIN_LOCK lock;
KIRQL irql; if (Destination==||Source==)
{
DbgPrint("Params error!");
return FALSE;
}
RtlCopyMemory(Ori_Code,(PVOID)Destination,);
Jmp_Offest = Source - Destination-;
*(ULONG*)&Jmp_Code[] = Jmp_Offest; KeInitializeSpinLock (&lock );
KeAcquireSpinLock(&lock,&irql); PageProtectOff();
RtlCopyMemory((PVOID)Destination,Jmp_Code,);
PageProtectOn(); KeReleaseSpinLock (&lock,irql); return TRUE;
} VOID Res_HookFunction(
IN ULONG Destination,
IN UCHAR *Ori_Code,
IN ULONG Length
)
{
KSPIN_LOCK lock;
KIRQL irql; if (Destination==||Ori_Code==){ return; } KeInitializeSpinLock (&lock );
KeAcquireSpinLock(&lock,&irql); PageProtectOff();
RtlCopyMemory((PVOID)Destination,Ori_Code,Length);
PageProtectOn(); KeReleaseSpinLock (&lock,irql);
} FORCEINLINE
VOID
ProbeForReadSmallStructure (
IN PVOID Address,
IN SIZE_T Size,
IN ULONG Alignment
) //wrk源码
{
ASSERT((Alignment == ) || (Alignment == ) ||
(Alignment == ) || (Alignment == ) ||
(Alignment == )); if ((Size == ) || (Size >= 0x10000)) { ASSERT(); ProbeForRead(Address, Size, Alignment); } else {
if (((ULONG_PTR)Address & (Alignment - )) != ) {
ExRaiseDatatypeMisalignment();
} if ((PUCHAR)Address >= (UCHAR * const)MM_USER_PROBE_ADDRESS) {
Address = (UCHAR * const)MM_USER_PROBE_ADDRESS;
} _ReadWriteBarrier();
*(volatile UCHAR *)Address;
}
} void __stdcall FilterSetGetContextThread(
PETHREAD Thread,
PCONTEXT Context,
KPROCESSOR_MODE AccessMode)
{
__try{
if (AccessMode == UserMode)
{
//wrk 参数校验
ProbeForReadSmallStructure(Context,sizeof(CONTEXT),PROBE_ALIGNMENT(CONTEXT));
}else{
*Context = *Context;
} if (strstr(GetProcessNameByThread(Thread),"test.exe")!=NULL)
{
if (strstr((char*)PsGetCurrentProcess()+0x16c,"ollydbg") != NULL)
{
return;
}
//如果是要获得调试寄存器的值，将Flags 的获得调试寄存器清零， if (Context->ContextFlags | CONTEXT_DEBUG_REGISTERS)
{
Context->ContextFlags = ~CONTEXT_DEBUG_REGISTERS;
}
} }__except(EXCEPTION_EXECUTE_HANDLER){
return;
}
} void __declspec(naked) NewGetContextThread()
{
__asm{
mov edi,edi
push ebp
mov ebp,esp push [ebp+0x10]
push [ebp+0xc]
push [ebp+0x8]
call FilterSetGetContextThread mov esp,ebp
pop ebp mov edi,edi
push ebp
mov ebp,esp
jmp g_JmpGetContextThread
}
} void __declspec(naked) NewSetContextThread()
{
__asm{
mov edi,edi
push ebp
mov ebp,esp push [ebp+0x10]
push [ebp+0xc]
push [ebp+0x8]
call FilterSetGetContextThread mov esp,ebp
pop ebp mov edi,edi
push ebp
mov ebp,esp
jmp g_JmpSetContextThread
}
} void HookSetGetContextThread()
{
g_JmpGetContextThread = (ULONG)PsGetContextThread + 0x5;
g_bHookGetContextSuccess = Jmp_HookFunction((ULONG)PsGetContextThread,(ULONG)NewGetContextThread,g_cGetContextCode); g_JmpSetContextThread = (ULONG)PsSetContextThread + 0x5;
g_bHookSetContextSuccess = Jmp_HookFunction((ULONG)PsSetContextThread,(ULONG)NewSetContextThread,g_cSetContextCode);
} void UnHookSetGetContextThread()
{
if (g_bHookGetContextSuccess)
{
Res_HookFunction((ULONG)PsGetContextThread,g_cGetContextCode,);
} if (g_bHookSetContextSuccess)
{
Res_HookFunction((ULONG)PsSetContextThread,g_cSetContextCode,);
}
} void DriverUnLoad(PDRIVER_OBJECT pDriverObject)
{
UnHookSetGetContextThread();
} NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING usRegistPath)
{
UNICODE_STRING usFuncName1,usFuncName2; RtlInitUnicodeString(&usFuncName1,L"PsGetContextThread");
RtlInitUnicodeString(&usFuncName2,L"PsSetContextThread"); PsGetContextThread = (PSGETCONTEXTTHREAD)MmGetSystemRoutineAddress(&usFuncName1);
PsSetContextThread = (PSSETCONTEXTTHREAD)MmGetSystemRoutineAddress(&usFuncName2); HookSetGetContextThread(); pDriverObject->DriverUnload = DriverUnLoad;
return STATUS_SUCCESS;
}
在ring0可以直接改变Drx寄存器的值，设置硬件断点来达到对某个函数的hook,这里以NtOpenProcess为例。我们知道内核层产生的异常都会由RtlDispatchException函数进行分发处理，所以我们首先要InlineHook RtlDispatchException函数，在对异常进行分发时先对异常进行过滤，如果异常地址是我们设置的硬件断点“监控”的地址，则改变EIP，达到对目标函数“hook”的目的。
先InlineHook RtlDispatchException ,RtlDispatchException未导出，在KiDispatchException中被调用，KiDispatchException也未导出，采用的方法是暴力搜索整个内核文件Ntoskrnl.exe来匹配特征码
VOID HookRtlDispatchException()
{ PLDR_DATA_TABLE_ENTRY Ldr = NULL;
//构建RtlDispatchException 的特征码
// nt!KiDispatchException+0x160:
// 83eff040 53 push ebx
// 83eff041 ff750c push dword ptr [ebp+0Ch]
// 83eff044 ff7510 push dword ptr [ebp+10h]
// 83eff047 ff15bc49fb83 call dword ptr [nt!KiDebugRoutine (83fb49bc)]
// 83eff04d 84c0 test al,al
// 83eff04f 0f859d000000 jne nt!KiDispatchException+0x211 (83eff0f2)
// 83eff055 57 push edi
// 83eff056 53 push ebx
// 83eff057 e8 a372ffff call nt!RtlDispatchException (83ef62ff) // kd> u 83ef62ff
// nt!RtlDispatchException:
// 83ef62ff 8bff mov edi,edi
// 83ef6301 55 push ebp
// 83ef6302 8bec mov ebp,esp // 83ef6304 83e4f8 and esp,0FFFFFFF8h
// 83ef6307 83ec6c sub esp,6Ch
// 83ef630a 53 push ebx
// 83ef630b 56 push esi
// 83ef630c 57 push edi SIGNATURE_INFO SignCode[] = {{0x84,},{0xc0,},{0x57,},{0x53,},{0xE8,}};
#ifndef _DEBUG
__asm int
#endif g_bHookSuccess = FALSE;
Ldr = SearchDriver(g_LocalDriverObj,L"ntoskrnl.exe");
if (!Ldr) return;
g_RtlDispatchExeceptionAddress = SearchAddressForSignFromPE((ULONG_PTR)(Ldr->DllBase),Ldr->SizeOfImage,SignCode);
if (!MmIsAddressValid((PVOID)g_RtlDispatchExeceptionAddress)) return;
//利用偏移转成绝对地址 +5 过e8 a372ffff 这五个字节
g_RtlDispatchExeceptionAddress = g_RtlDispatchExeceptionAddress+ + *(ULONG_PTR*)(g_RtlDispatchExeceptionAddress+);
//过被占的前5个字节，继续执行的代码
DbgPrint("RtlDispatchExceptionAddresss:%x",g_RtlDispatchExeceptionAddress);
g_JmpOrigDispatchException = g_RtlDispatchExeceptionAddress + ;
g_bHookSuccess = Jmp_HookFunction(g_RtlDispatchExeceptionAddress,(ULONG_PTR)NewRtlDispatchException,g_cDisExceptionCode);
}
然后将要“监控”的目标地址写入Dr0寄存器，当目标地址被执行的时候，触发异常，执行RtlDispatchException函数，
VOID SetMonitor(PVOID Address)
{ __asm
{
mov eax , Address
mov DR0 , eax
mov eax , 0x02 //全局的，仅当执行时产生异常
mov DR7 , eax
}
} VOID CancelMonitor(PVOID Address)
{ __asm
{
xor eax , eax
mov DR0 , eax
mov DR7 , eax
}
}
RtlDispatchException的过滤函数，在这里改变Eip的值，异常处理完毕以后，开始执行NewNtOpenProcess
ULONG_PTR _stdcall
FilterRtlDispatchException (
IN PEXCEPTION_RECORD ExceptionRecord,
IN PCONTEXT ContextRecord
)
{ //DbgPrint("Address:%x -- ExceptionCode:%x\r\n",ExceptionRecord->ExceptionAddress,ExceptionRecord->ExceptionCode);
//如果是NtOpenProcess处的异常
if (ExceptionRecord->ExceptionAddress == (PVOID)KeServiceDescriptorTable.ServiceTableBase[])
{
KdPrint(("<Except addresss>:%X <seh callBack>:%X -- <Except code>:%X",
ContextRecord->Eip,ExceptionRecord->ExceptionAddress,ExceptionRecord->ExceptionCode));
//将执行的下一条指令置为NewNtOpenProcess() 函数的地址，CPU接着去执行NewNtOpenProcess
ContextRecord->Eip = (ULONG_PTR)NewNtOpenProcess;
//返回TRUE,异常不再进行派发
return ;
}
return ;
}
NewNtOpenProcess只是简单地调用FilterNtOpenProcess进行简单的调用，打印一些基本的信息。
void __declspec(naked) NewNtOpenProcess()
{ __asm
{
pushad
pushfd call FilterNtOpenProcess popfd
popad mov edi , edi
push esp
mov ebp , esp
//跳过NtOpenProcess的前五个字节，
//避免再次触发异常
jmp g_JmpOrigNtOpenProcess
}
}
完整的工程代码
#ifndef CXX_DRXHOOK_H
#define CXX_DRXHOOK_H #include <ntifs.h>
#include <devioctl.h>
#endif typedef struct _SYSTEM_SERVICE_TABLE32 {
ULONG_PTR* ServiceTableBase;
ULONG_PTR* ServiceCounterTableBase;
ULONG32 NumberOfServices;
ULONG_PTR* ParamTableBase;
} SYSTEM_SERVICE_TABLE32, *PSYSTEM_SERVICE_TABLE32; typedef struct _SYSTEM_SERVICE_TABLE64{
ULONG_PTR* ServiceTableBase;
ULONG_PTR* ServiceCounterTableBase;
ULONG64 NumberOfServices;
ULONG_PTR* ParamTableBase;
} SYSTEM_SERVICE_TABLE64, *PSYSTEM_SERVICE_TABLE64; #ifndef _WIN64
#define _SYSTEM_SERVICE_TABLE _SYSTEM_SERVICE_TABLE64
#define SYSTEM_SERVICE_TABLE SYSTEM_SERVICE_TABLE64
#define PSYSTEM_SERVICE_TABLE PSYSTEM_SERVICE_TABLE64
#else
#define _SYSTEM_SERVICE_TABLE _SYSTEM_SERVICE_TABLE32
#define SYSTEM_SERVICE_TABLE SYSTEM_SERVICE_TABLE32
#define PSYSTEM_SERVICE_TABLE PSYSTEM_SERVICE_TABLE32
#endif __declspec(dllimport) SYSTEM_SERVICE_TABLE KeServiceDescriptorTable; //结构声明
typedef struct _SIGNATURE_INFO{
UCHAR cSingature;
int Offset;
}SIGNATURE_INFO,*PSIGNATURE_INFO; typedef struct _LDR_DATA_TABLE_ENTRY // 24 elements, 0x78 bytes (sizeof)
{
/*0x000*/ struct _LIST_ENTRY InLoadOrderLinks; // 2 elements, 0x8 bytes (sizeof)
/*0x008*/ PVOID ExceptionTable;
/*0x00C*/ ULONG ExceptionTableSize;
/*0x010*/ struct _LIST_ENTRY InInitializationOrderLinks; // 2 elements, 0x8 bytes (sizeof)
/*0x018*/ VOID* DllBase;
/*0x01C*/ VOID* EntryPoint;
/*0x020*/ ULONG32 SizeOfImage;
/*0x024*/ struct _UNICODE_STRING FullDllName; // 3 elements, 0x8 bytes (sizeof)
/*0x02C*/ struct _UNICODE_STRING BaseDllName; // 3 elements, 0x8 bytes (sizeof)
/*0x034*/ ULONG32 Flags;
/*0x038*/ UINT16 LoadCount;
/*0x03A*/ UINT16 TlsIndex;
union // 2 elements, 0x8 bytes (sizeof)
{
/*0x03C*/ struct _LIST_ENTRY HashLinks; // 2 elements, 0x8 bytes (sizeof)
struct // 2 elements, 0x8 bytes (sizeof)
{
/*0x03C*/ VOID* SectionPointer;
/*0x040*/ ULONG32 CheckSum;
};
};
union // 2 elements, 0x4 bytes (sizeof)
{
/*0x044*/ ULONG32 TimeDateStamp;
/*0x044*/ VOID* LoadedImports;
};
/*0x048*/ VOID* EntryPointActivationContext;
/*0x04C*/ VOID* PatchInformation;
/*0x050*/ struct _LIST_ENTRY ForwarderLinks; // 2 elements, 0x8 bytes (sizeof)
/*0x058*/ struct _LIST_ENTRY ServiceTagLinks; // 2 elements, 0x8 bytes (sizeof)
/*0x060*/ struct _LIST_ENTRY StaticLinks; // 2 elements, 0x8 bytes (sizeof)
/*0x068*/ VOID* ContextInformation;
/*0x06C*/ ULONG32 OriginalBase;
/*0x070*/ union _LARGE_INTEGER LoadTime; // 4 elements, 0x8 bytes (sizeof)
}LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; ULONG_PTR _stdcall
FilterRtlDispatchException (
IN PEXCEPTION_RECORD ExceptionRecord,
IN PCONTEXT ContextRecord
);
VOID HookRtlDispatchException();
VOID UnloadDriver(PDRIVER_OBJECT DriverObject);
PLDR_DATA_TABLE_ENTRY SearchDriver(PDRIVER_OBJECT pDriverObject,wchar_t *strDriverName);
BOOLEAN Jmp_HookFunction(IN ULONG Destination,IN ULONG Source,IN UCHAR *Ori_Code);
VOID ResumeHookFunction(IN ULONG Destination,IN UCHAR *Ori_Code,IN ULONG Length);
ULONG_PTR SearchAddressForSignFromPE(ULONG_PTR uStartBase,
ULONG_PTR uSearchLength,
SIGNATURE_INFO SignatureInfo[]);
VOID WPOFF();
NTSTATUS _stdcall FilterNtOpenProcess ();
VOID WPON();
VOID SetMonitor(PVOID Address);
VOID CancelMonitor(PVOID Address); #ifndef CXX_DRXHOOK_H
# include "DrxHook.h"
#endif #include <ntimage.h> KIRQL Irql;
PDRIVER_OBJECT g_LocalDriverObj;
BOOLEAN g_bHookSuccess;
ULONG_PTR g_RtlDispatchExeceptionAddress;
ULONG_PTR g_JmpOrigDispatchException;
UCHAR g_cDisExceptionCode[]; ULONG_PTR g_JmpOrigNtOpenProcess; void __declspec(naked) NewNtOpenProcess()
{ __asm
{
pushad
pushfd call FilterNtOpenProcess popfd
popad mov edi , edi
push esp
mov ebp , esp
//跳过NtOpenProcess的前五个字节，
//避免再次触发异常
jmp g_JmpOrigNtOpenProcess
}
} void __declspec(naked) NewRtlDispatchException()
{
__asm
{
mov edi,edi
push ebp
mov ebp , esp
pushad //保存所有寄存器
pushfd //保存标志寄存器
push [ebp+0xc]
push [ebp+0x8]
call FilterRtlDispatchException
//检测返回值是否为0
test eax , eax
jz __SafeExit // 若eax为0 跳转__SafeExit
popfd
popad
mov esp , ebp
pop ebp
// 将KiDispatchException中对于RtlDispatchException的返回值进行校验，
// 如果为0 则对异常进行重新派发，为1则不再做处理
mov eax ,0x01
retn 0x8 //平衡堆栈，两个参数8字节 __SafeExit: popfd
popad
mov esp , ebp
pop ebp //先执行RtlDispatchException原来的5个字节的内容
mov edi , edi
push ebp
mov ebp , esp
jmp g_JmpOrigDispatchException
}
} NTSTATUS _stdcall FilterNtOpenProcess ()
{
DbgPrint("FilterNtOpenProcess---%s\r\n",(ULONG_PTR)PsGetCurrentProcess()+0x16c);
return STATUS_SUCCESS;
} ULONG_PTR _stdcall
FilterRtlDispatchException (
IN PEXCEPTION_RECORD ExceptionRecord,
IN PCONTEXT ContextRecord
)
{ //DbgPrint("Address:%x -- ExceptionCode:%x\r\n",ExceptionRecord->ExceptionAddress,ExceptionRecord->ExceptionCode);
//如果是NtOpenProcess处的异常
if (ExceptionRecord->ExceptionAddress == (PVOID)KeServiceDescriptorTable.ServiceTableBase[])
{
KdPrint(("<Except addresss>:%X <seh callBack>:%X -- <Except code>:%X",
ContextRecord->Eip,ExceptionRecord->ExceptionAddress,ExceptionRecord->ExceptionCode)); //将执行的下一条指令置为NewNtOpenProcess() 函数的地址，CPU接着去执行NewNtOpenProcess
ContextRecord->Eip = (ULONG_PTR)NewNtOpenProcess;
//返回TRUE,异常不再进行派发
return ;
}
return ;
}
VOID SetMonitor(PVOID Address)
{ __asm
{
mov eax , Address
mov DR0 , eax
mov eax , 0x02 //全局的，仅当执行时产生异常
mov DR7 , eax
}
} VOID CancelMonitor(PVOID Address)
{ __asm
{
xor eax , eax
mov DR0 , eax
mov DR7 , eax
}
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryString)
{
NTSTATUS Status = STATUS_SUCCESS;
g_LocalDriverObj = pDriverObject;
HookRtlDispatchException();
g_JmpOrigNtOpenProcess = (ULONG_PTR)(KeServiceDescriptorTable.ServiceTableBase[] + 0x5);
//为了方便，这里写死了，NtOpenProcess Win7 x86
SetMonitor((PVOID)KeServiceDescriptorTable.ServiceTableBase[]);
return Status;
} VOID HookRtlDispatchException()
{ PLDR_DATA_TABLE_ENTRY Ldr = NULL;
//构建RtlDispatchException 的特征码
// nt!KiDispatchException+0x160:
// 83eff040 53 push ebx
// 83eff041 ff750c push dword ptr [ebp+0Ch]
// 83eff044 ff7510 push dword ptr [ebp+10h]
// 83eff047 ff15bc49fb83 call dword ptr [nt!KiDebugRoutine (83fb49bc)]
// 83eff04d 84c0 test al,al
// 83eff04f 0f859d000000 jne nt!KiDispatchException+0x211 (83eff0f2)
// 83eff055 57 push edi
// 83eff056 53 push ebx
// 83eff057 e8 a372ffff call nt!RtlDispatchException (83ef62ff) // kd> u 83ef62ff
// nt!RtlDispatchException:
// 83ef62ff 8bff mov edi,edi
// 83ef6301 55 push ebp
// 83ef6302 8bec mov ebp,esp // 83ef6304 83e4f8 and esp,0FFFFFFF8h
// 83ef6307 83ec6c sub esp,6Ch
// 83ef630a 53 push ebx
// 83ef630b 56 push esi
// 83ef630c 57 push edi SIGNATURE_INFO SignCode[] = {{0x84,},{0xc0,},{0x57,},{0x53,},{0xE8,}};
#ifndef _DEBUG
__asm int
#endif g_bHookSuccess = FALSE;
Ldr = SearchDriver(g_LocalDriverObj,L"ntoskrnl.exe");
if (!Ldr) return;
g_RtlDispatchExeceptionAddress = SearchAddressForSignFromPE((ULONG_PTR)(Ldr->DllBase),Ldr->SizeOfImage,SignCode);
if (!MmIsAddressValid((PVOID)g_RtlDispatchExeceptionAddress)) return;
//利用偏移转成绝对地址 +5 过e8 a372ffff 这五个字节
g_RtlDispatchExeceptionAddress = g_RtlDispatchExeceptionAddress+ + *(ULONG_PTR*)(g_RtlDispatchExeceptionAddress+);
//过被占的前5个字节，继续执行的代码
DbgPrint("RtlDispatchExceptionAddresss:%x",g_RtlDispatchExeceptionAddress);
g_JmpOrigDispatchException = g_RtlDispatchExeceptionAddress + ;
g_bHookSuccess = Jmp_HookFunction(g_RtlDispatchExeceptionAddress,(ULONG_PTR)NewRtlDispatchException,g_cDisExceptionCode);
} //搜索整个PE文件的
ULONG_PTR SearchAddressForSignFromPE(ULONG_PTR uStartBase,ULONG_PTR uSearchLength,SIGNATURE_INFO SignatureInfo[])
{
UCHAR *p;
ULONG_PTR u_index1,u_index2; //ULONG uIndex;
PIMAGE_DOS_HEADER pimage_dos_header;
PIMAGE_NT_HEADERS pimage_nt_header;
PIMAGE_SECTION_HEADER pimage_section_header; if(!MmIsAddressValid((PVOID)uStartBase))
{ return ; } pimage_dos_header = (PIMAGE_DOS_HEADER)uStartBase;
pimage_nt_header = (PIMAGE_NT_HEADERS)((ULONG)uStartBase+pimage_dos_header->e_lfanew);
pimage_section_header = (PIMAGE_SECTION_HEADER)((ULONG)pimage_nt_header+sizeof(IMAGE_NT_HEADERS)); for (u_index1 = ;u_index1<pimage_nt_header->FileHeader.NumberOfSections;u_index1++)
{
//#define IMAGE_SCN_MEM_EXECUTE 0x20000000 // Section is executable.
//#define IMAGE_SCN_MEM_READ 0x40000000 // Section is readable.
//#define IMAGE_SCN_MEM_WRITE 0x80000000 // Section is writeable.
//0x60000000 = IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
if (pimage_section_header[u_index1].Characteristics&0x60000000)
{
p = (UCHAR*)uStartBase + pimage_section_header[u_index1].VirtualAddress;
for (u_index2 = ;u_index2<pimage_section_header[u_index1].Misc.VirtualSize;u_index2++)
{
if (!MmIsAddressValid((p-SignatureInfo[].Offset))||
!MmIsAddressValid((p-SignatureInfo[].Offset)))
{
p++;
continue;
}
__try{
if (*(p-SignatureInfo[].Offset)==SignatureInfo[].cSingature&&
*(p-SignatureInfo[].Offset)==SignatureInfo[].cSingature&&
*(p-SignatureInfo[].Offset)==SignatureInfo[].cSingature&&
*(p-SignatureInfo[].Offset)==SignatureInfo[].cSingature&&
*(p-SignatureInfo[].Offset)==SignatureInfo[].cSingature)
{
return (ULONG_PTR)p;
} }__except(EXCEPTION_EXECUTE_HANDLER){
DbgPrint("Search error!");
}
p++;
}
}
} return ;
} BOOLEAN Jmp_HookFunction(
IN ULONG Destination,
IN ULONG Source,
IN UCHAR *Ori_Code
)
{
ULONG jmp_offset;
UCHAR jmp_code[] = {0xE9}; KSPIN_LOCK lock;
KIRQL irql; if (Destination==||Source==)
{
DbgPrint("Params error!");
return FALSE;
} RtlCopyMemory(Ori_Code,(PVOID)Destination,);
jmp_offset = Source - (Destination+); *(ULONG*)&jmp_code[] = jmp_offset; //放入偏移 KeInitializeSpinLock (&lock );
KeAcquireSpinLock(&lock,&irql); WPOFF();
RtlCopyMemory((PVOID)Destination,jmp_code,);
WPON(); KeReleaseSpinLock (&lock,irql); return TRUE;
} VOID WPOFF()
{
ULONG_PTR cr0 = ;
Irql = KeRaiseIrqlToDpcLevel();
cr0 =__readcr0();
cr0 &= 0xfffffffffffeffff;
__writecr0(cr0); } VOID WPON()
{ ULONG_PTR cr0=__readcr0();
cr0 |= 0x10000;
__writecr0(cr0);
KeLowerIrql(Irql);
} //简单的通过链表获得内核模块的基本信息
PLDR_DATA_TABLE_ENTRY SearchDriver(PDRIVER_OBJECT pDriverObject,wchar_t *strDriverName)
{
LDR_DATA_TABLE_ENTRY *pdata_table_entry,*ptemp_data_table_entry;
PLIST_ENTRY plist;
UNICODE_STRING str_module_name; RtlInitUnicodeString(&str_module_name,strDriverName);
pdata_table_entry = (LDR_DATA_TABLE_ENTRY*)pDriverObject->DriverSection;
if (!pdata_table_entry)
{
return ;
}
plist = pdata_table_entry->InLoadOrderLinks.Flink; while(plist!= &pdata_table_entry->InLoadOrderLinks)
{
ptemp_data_table_entry = (LDR_DATA_TABLE_ENTRY *)plist; //DbgPrint("%wZ",&pTempDataTableEntry->BaseDllName);
if (==RtlCompareUnicodeString(&ptemp_data_table_entry->BaseDllName,&str_module_name,FALSE))
{
return ptemp_data_table_entry;
} plist = plist->Flink;
} return ;
} VOID UnloadDriver(PDRIVER_OBJECT DriverObject)
{
if (g_bHookSuccess)
{
ResumeHookFunction(g_RtlDispatchExeceptionAddress,g_cDisExceptionCode,0x5);
} } VOID ResumeHookFunction(
IN ULONG Destination,
IN UCHAR *Ori_Code,
IN ULONG Length
)
{
KSPIN_LOCK lock;
KIRQL irql; if (Destination==||Ori_Code==) return; KeInitializeSpinLock (&lock );
KeAcquireSpinLock(&lock,&irql); WPOFF();
RtlCopyMemory((PVOID)Destination,Ori_Code,Length);
WPON(); KeReleaseSpinLock (&lock,irql);
}
jpg改rar