最近学了DPC这一对，把Win7 32位和64位都做了，查阅了大量的资料，并且进行了大量调试，理一下思路，为了后面更好的学习。
转载请注明出处:http://www.cnblogs.com/littlepear/p/6733145.html
1. 当我们需要定时的完成某项任务时，就需要注册一个DPC定时器了，在Ring3中, CTimer类中有一个SetTimer()函数，对应的驱动中的函数就是KeSetTimer()了。Timer和要执行回调函数结构的DPC都必须初始化， DPC需提供一个回调函数。然后会把KTimer插入到一个timer table的链表中，具体什么样的链表，我们移除的时候再看。
typedef struct MY_TIMER_
{
KDPC Dpc;
KTIMER Timer;
PKDEFERRED_ROUTINE func;
PVOID private_context;
}MY_TIMER, *PMY_TIMER; VOID MyTimerInit(PMY_TIMER Timer, PKDEFERRED_ROUTINE Func)
{
KeInitializeTimer(&(Timer->Timer)); //定时器的Timer和要执行的回调函数结构Dpc都必须先初始化
KeInitializeDpc(&(Timer->Dpc), Func, Timer);//第三个参数把Timer作为 DeferredContext传给回调函数，更好的封装
Timer->func = Func;
} BOOLEAN MyTimerSet(PMY_TIMER Timer, LONG Ms, PVOID context)
{
LARGE_INTEGER Interval;
Interval = RtlConvertLongToLargeInteger(- * Ms); //100ns每unit 1s 负数代表相对时间
Timer->private_context = context; //传一块上下背景文，便于利用
return KeSetTimer(&(Timer->Timer), Interval, &(Timer->Dpc));
// 定时器 延后执行的时间 要执行的回调函数结构
//return KeSetTimerEx(&(Timer->Timer), Interval,1000, &(Timer->Dpc));
}
为了更好的理解KeSetTimer函数，我查了下wrk，下面是wrk的源码。
BOOLEAN
KeSetTimer (
__inout PKTIMER Timer,
__in LARGE_INTEGER DueTime,
__in_opt PKDPC Dpc
) /*++ Routine Description: This function sets a timer to expire at a specified time. If the timer is
already set, then it is implicitly canceled before it is set to expire at
the specified time. Setting a timer causes its due time to be computed,
its state to be set to Not-Signaled, and the timer object itself to be
inserted in the timer list. Arguments: Timer - Supplies a pointer to a dispatcher object of type timer. DueTime - Supplies an absolute or relative time at which the timer
is to expire. Dpc - Supplies an optional pointer to a control object of type DPC. Return Value: A boolean value of TRUE is returned if the the specified timer was
currently set. Else a value of FALSE is returned. --*/ { //
// Set the timer with a period of zero.
// return KeSetTimerEx(Timer, DueTime, , Dpc);
} BOOLEAN
KeSetTimerEx (
__inout PKTIMER Timer,
__in LARGE_INTEGER DueTime,
__in LONG Period,
__in_opt PKDPC Dpc
) /*++ Routine Description: This function sets a timer to expire at a specified time. If the timer is
already set, then it is implicitly canceled before it is set to expire at
the specified time. Setting a timer causes its due time to be computed,
its state to be set to Not-Signaled, and the timer object itself to be
inserted in the timer list. Arguments: Timer - Supplies a pointer to a dispatcher object of type timer. DueTime - Supplies an absolute or relative time at which the timer
is to expire. Period - Supplies an optional period for the timer in milliseconds. Dpc - Supplies an optional pointer to a control object of type DPC. Return Value: A boolean value of TRUE is returned if the the specified timer was
currently set. Otherwise, a value of FALSE is returned. --*/ { ULONG Hand;
BOOLEAN Inserted;
KIRQL OldIrql;
BOOLEAN RequestInterrupt; ASSERT_TIMER(Timer); ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL); //
// Raise IRQL to dispatcher level and lock dispatcher database.
//
// Capture the timer inserted status and if the timer is currently
// set, then remove it from the timer list.
// KiLockDispatcherDatabase(&OldIrql);
Inserted = Timer->Header.Inserted;
if (Inserted != FALSE) {
KiRemoveTreeTimer(Timer);
} //
// Set the DPC address, set the period, and compute the timer due time.
// If the timer has already expired, then signal the timer. Otherwise,
// set the signal state to false and attempt to insert the timer in the
// timer table.
//
// N.B. The signal state must be cleared before it is inserted in the
// timer table in case the period is not zero.
// Timer->Dpc = Dpc;
Timer->Period = Period;
if (KiComputeDueTime(Timer, DueTime, &Hand) == FALSE) {
RequestInterrupt = KiSignalTimer(Timer);
KiUnlockDispatcherDatabaseFromSynchLevel();
if (RequestInterrupt == TRUE) {
KiRequestSoftwareInterrupt(DISPATCH_LEVEL);
} } else {
Timer->Header.SignalState = FALSE;
KiInsertOrSignalTimer(Timer, Hand);
} KiExitDispatcher(OldIrql); //
// Return boolean value that signifies whether the timer was set or
// not.
// return Inserted;
}
KeSetTimer
下面是我完整的DPCHookSSDT代码。
#include <ntifs.h> #define SEC_IMAGE 0x001000000 extern
PIMAGE_NT_HEADERS
NTAPI
RtlImageNtHeader(PVOID BaseAddress); extern
char* PsGetProcessImageFileName(PEPROCESS EProcess); typedef
NTSTATUS(*pfnNtOpenProcess)(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
); typedef struct MY_TIMER_
{
KDPC Dpc;
KTIMER Timer;
PKDEFERRED_ROUTINE func;
PVOID private_context;
}MY_TIMER, *PMY_TIMER; typedef struct _SYSTEM_SERVICE_DESCRIPTOR_TABLE_
{
PVOID ServiceTableBase; //SSDT(System Service Dispatch Table)服务表的基地址
PVOID ServiceCounterTableBase; //用于checked builds,包含SSDT中每个服务被调用的次数
PVOID NumberOfServices; //服务函数的个数，NumberOfService * 4就是整个地址表的大小 64位 0x191, 32位 0x11c
PVOID ParamTableBase; //SSPT(System Service Parameter Table)的基地址
}SYSTEM_SERVICE_DESCRIPTOR_TABLE, *PSYSTEM_SERVICE_DESCRIPTOR_TABLE; BOOLEAN GetSSDTAddressInWin7_x64(ULONG64* SSDTAddress);
BOOLEAN GetSSDTAddressInWin7_x86(ULONG32* SSDTAddress);
VOID DriverUnload(PDRIVER_OBJECT DriverObject);
BOOLEAN GetSSDTFunctionIndexFromExportTableOfNtdllByFunctionName(CHAR* szFuntionName, ULONG32* SSDTFunctionIndex);
PVOID
GetExportVariableAddressFromNtosKrnlExportTableByVariableName(WCHAR* wzVariableName);
BOOLEAN Ring0MappingPEFile(WCHAR* szFileFullPath, PVOID* MappingBaseAddress, ULONG_PTR* MappingViewSize);
ULONG32 CalcFunctionOffsetInSSDT(PVOID ServiceTableBase, PVOID FunctionAddress, ULONG32 ParamterCount);
VOID HookSSDTInWin7_x64(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, PVOID MyFunctionAddress,
PVOID OldFuntionAddress, ULONG32 OldFunctionParamterCount, UCHAR* OldFunctionCode, ULONG32 PatchCodeLength);
VOID HookSSDTInWin7_x86(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 MyFunctionAddress);
VOID InlineHook(ULONG64 OldFuntionAddress, ULONG64 MyFunctionAddress, UCHAR* OldFunctionCode, ULONG32 PatchCodeLength);
NTSTATUS MyOpenProcess(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
);
VOID WPOFF();
VOID WPON(); VOID UnHookSSDTInWin7_x64(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 OldFunctionOffset, PVOID OldFunctionAddress,
UCHAR* OldFunctionCode, ULONG32 PatchCodeLength);
VOID UnHookSSDTInWin7_x86(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 OldFunctionAddress);
VOID UnlineHook(PVOID OldFunctionAddress, CHAR* OldFunctionCode, ULONG32 PatchCodeLength); VOID MyTimerInit(PMY_TIMER Timer, PKDEFERRED_ROUTINE Func); BOOLEAN MyTimerSet(PMY_TIMER Timer, LONG Ms, PVOID context); VOID CustomDpc(
_In_ struct _KDPC *Dpc,
_In_opt_ PVOID DeferredContext,
_In_opt_ PVOID SystemArgument1,
_In_opt_ PVOID SystemArgument2
);
DPCHookSSDT.h
#include "NewDPCHookSSDT.h"
#include <ntimage.h>
#include <Ntstrsafe.h> //bp NewDPCHookSSDT!DriverEntry
ULONG32 __NtOpenProcessIndex = ;
PVOID __ServiceTableBase = NULL;
ULONG32 __OldNtOpenProcessOffset = ;
pfnNtOpenProcess __OldNtOpenProcessAddress = NULL; //这里无所谓，PVOID也可以
BOOLEAN __IsHook = FALSE;
UCHAR __OldCode[] = { }; MY_TIMER MyTimer; NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
NTSTATUS Status = STATUS_UNSUCCESSFUL;
char szFunctionName[] = "ZwOpenProcess";
ULONG_PTR SSDTAddress = ; //保存整个SSDT基地址 KeServiceDescriptorTable
ULONG32 TempOffset = ;
DriverObject->DriverUnload = DriverUnload; #ifdef _WIN64
if (GetSSDTAddressInWin7_x64(&SSDTAddress) == FALSE)
{
return Status;
}
#else
if (GetSSDTAddressInWin7_x86(&SSDTAddress) == FALSE)
{
return Status;
}
#endif DbgPrint("SSDT:%p\r\n", SSDTAddress); //0x23h
if (GetSSDTFunctionIndexFromExportTableOfNtdllByFunctionName(szFunctionName, &__NtOpenProcessIndex) == FALSE)
{
return Status;
} __ServiceTableBase = ((PSYSTEM_SERVICE_DESCRIPTOR_TABLE)SSDTAddress)->ServiceTableBase;
#ifdef _WIN64
__OldNtOpenProcessOffset = ((PULONG32)__ServiceTableBase)[__NtOpenProcessIndex];
TempOffset = __OldNtOpenProcessOffset >> ; //抹掉最右边的一位
__OldNtOpenProcessAddress = (PVOID)((ULONG64)__ServiceTableBase + TempOffset);
HookSSDTInWin7_x64(__ServiceTableBase, __NtOpenProcessIndex, MyOpenProcess, KeBugCheckEx, , __OldCode, );
#else
__OldNtOpenProcessAddress = (pfnNtOpenProcess)(((PULONG32)__ServiceTableBase)[__NtOpenProcessIndex]);
/*kd > u 0x84016ba1
nt!NtOpenProcess:
84016ba1 8bff mov edi, edi
84016ba3 55 push ebp
84016ba4 8bec mov ebp, esp
84016ba6 51 push ecx
84016ba7 51 push ecx
84016ba8 64a124010000 mov eax, dword ptr fs : [00000124h]
84016bae 8a803a010000 mov al, byte ptr[eax + 13Ah]
84016bb4 8b4d14 mov ecx, dword ptr[ebp + 14h]*/ //0x00145dc8 HookSSDTInWin7_x86(__ServiceTableBase, __NtOpenProcessIndex, (ULONG32)MyOpenProcess);//强制转换后，MyOpenProcess才可以传，真奇怪
#endif
MyTimerInit(&MyTimer, (PKDEFERRED_ROUTINE)CustomDpc);
MyTimerSet(&MyTimer, , NULL);
return STATUS_SUCCESS;
} VOID MyTimerInit(PMY_TIMER Timer, PKDEFERRED_ROUTINE Func)
{
KeInitializeTimer(&(Timer->Timer)); //定时器的Timer和要执行的回调函数结构Dpc都必须先初始化
KeInitializeDpc(&(Timer->Dpc), Func, Timer);//第三个参数把Timer作为 DeferredContext传给回调函数，更好的封装
Timer->func = Func;
} BOOLEAN MyTimerSet(PMY_TIMER Timer, LONG Ms, PVOID context)
{
LARGE_INTEGER Interval;
Interval = RtlConvertLongToLargeInteger(- * Ms); //100ns每unit 1s 负数代表相对时间
Timer->private_context = context; //传一块上下背景文，便于利用
return KeSetTimer(&(Timer->Timer), Interval, &(Timer->Dpc));
// 定时器 延后执行的时间 要执行的回调函数结构
//return KeSetTimerEx(&(Timer->Timer), Interval,1000, &(Timer->Dpc));
} VOID CustomDpc(
_In_ struct _KDPC *Dpc,
_In_opt_ PVOID DeferredContext,
_In_opt_ PVOID SystemArgument1,
_In_opt_ PVOID SystemArgument2
)
{
PMY_TIMER Timer = (PMY_TIMER)DeferredContext;
PVOID MyContext = Timer->private_context;
DbgPrint("CustomDpc()\r\n");
#ifdef _WIN64
HookSSDTInWin7_x64(__ServiceTableBase, __NtOpenProcessIndex, MyOpenProcess, KeBugCheckEx, , __OldCode, );
#else
HookSSDTInWin7_x86(__ServiceTableBase, __NtOpenProcessIndex, (ULONG32)MyOpenProcess);//强制转换后，MyOpenProcess才可以传，真奇怪
#endif // _WIN64
MyTimerSet(Timer, , MyContext);
//如果前面是KeSetTimerEx函数，这里就不用写MyTimerSet啦
} VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("ByeBye,Driver!\r\n"); KeCancelTimer(&(MyTimer.Timer)); if (__IsHook)
{
#ifdef _WIN64 UnHookSSDTInWin7_x64(__ServiceTableBase, __NtOpenProcessIndex, __OldNtOpenProcessOffset, KeBugCheckEx,
__OldCode, );
#else
UnHookSSDTInWin7_x86(__ServiceTableBase, __NtOpenProcessIndex, __OldNtOpenProcessAddress);
#endif
__IsHook = FALSE;
}
} BOOLEAN GetSSDTAddressInWin7_x64(ULONG64* SSDTAddress)
{
//rdmsr c0000082
CHAR* StartSearchAddress = (char*)__readmsr(0xc0000082);
CHAR* EndSearchAddress = StartSearchAddress + PAGE_SIZE; //4KB
CHAR* i = NULL;
UCHAR v1 = , v2 = , v3 = ;
//必须用UCHAR类型，因为Char的范围是 -128~127 0x80-0x7F
INT64 Offset = ;
*SSDTAddress = NULL;
for (i = StartSearchAddress; i < EndSearchAddress; i++)
{
if (MmIsAddressValid(i) && MmIsAddressValid(i + ) && MmIsAddressValid(i + ))
{
v1 = *i;
v2 = *(i + );
v3 = *(i + );
if (v1 == 0x4c && v2 == 0x8d && v3 == 0x15)
{
// 4c8d15238f4700
memcpy(&Offset, i+, );
*SSDTAddress = Offset + (ULONG64)i+;
break;
}
}
}
if (*SSDTAddress == NULL)
{
return FALSE;
}
return TRUE;
} BOOLEAN GetSSDTAddressInWin7_x86(ULONG32* SSDTAddress)
{
//32位下Ntoskrnl.exe有导出 KeServiceDescriptorTable，直接查找即可
*SSDTAddress = NULL;
*SSDTAddress = (ULONG32)GetExportVariableAddressFromNtosKrnlExportTableByVariableName(L"KeServiceDescriptorTable");
if (*SSDTAddress != NULL)
{
return TRUE;
}
return FALSE;
}
PVOID
GetExportVariableAddressFromNtosKrnlExportTableByVariableName(WCHAR* wzVariableName)
{
//通过导出变量名字从NtosKrnl中获得导出变量地址
UNICODE_STRING uniVariableName;
PVOID VariableAddress = NULL; if (wzVariableName&&wcslen(wzVariableName) > )
{
RtlUnicodeStringInit(&uniVariableName, wzVariableName);
//从Ntos模块的导出表中获得导出变量的地址
VariableAddress = MmGetSystemRoutineAddress(&uniVariableName);
}
return VariableAddress;
}
//从内存中读出
BOOLEAN GetSSDTFunctionIndexFromExportTableOfNtdllByFunctionName(CHAR* szFuntionName, ULONG32* SSDTFunctionIndex)
{
WCHAR szFileFullPath[] = L"\\SystemRoot\\System32\\ntdll.dll"; //C:\Windows\
ULONG_PTR MappingViewSize = ;
PVOID MappingBaseAddress = ;
BOOLEAN IsOk = FALSE;
PIMAGE_NT_HEADERS Image_Nt_Headers = NULL;
PIMAGE_EXPORT_DIRECTORY ImageExportDirectory = NULL; //导出表
//因为不识别DWORD,所以用UINT32
UINT32* AddressOfFunctions = NULL;
UINT32* AddressOfNames = NULL;
UINT16* AddressOfNameOrdinals = NULL;
int i = ;
char* v1 = NULL;
ULONG32 OrdinalOfFunction = ;
PVOID AddressOfFunction = ;
#ifdef _WIN64
/*
0:004> u zwopenprocess
ntdll!NtOpenProcess:
00000000`774ddc10 4c8bd1 mov r10,rcx
00000000`774ddc13 b823000000 mov eax,23h
00000000`774ddc18 0f05 syscall
00000000`774ddc1a c3 ret
00000000`774ddc1b 0f1f440000 nop dword ptr [rax+rax]
*/
ULONG32 Offset_SSDTFunctionIndex = ;
#else
/*
0:004> u zwopenprocess
ntdll!NtOpenProcess:
00000000`774ddc10 4c8bd1 mov r10,rcx
00000000`774ddc13 b823000000 mov eax,23h
00000000`774ddc18 0f05 syscall
00000000`774ddc1a c3 ret
00000000`774ddc1b 0f1f440000 nop dword ptr [rax+rax]
*/
ULONG32 Offset_SSDTFunctionIndex = ;
#endif *SSDTFunctionIndex = -;
IsOk = Ring0MappingPEFile(szFileFullPath, &MappingBaseAddress, &MappingViewSize);
if (IsOk == FALSE)
{
return FALSE;
}
else
{
__try {
Image_Nt_Headers = RtlImageNtHeader(MappingBaseAddress); //extern进来
if (Image_Nt_Headers&&Image_Nt_Headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress)
{
ImageExportDirectory = (PIMAGE_EXPORT_DIRECTORY)((char*)MappingBaseAddress
+ Image_Nt_Headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); AddressOfFunctions = (UINT32*)((char*)MappingBaseAddress + ImageExportDirectory->AddressOfFunctions);
//函数的地址(RVA)
AddressOfNames = (UINT32*)((char*)MappingBaseAddress + ImageExportDirectory->AddressOfNames);;
//函数名字的地址(RVA)
AddressOfNameOrdinals = (UINT16*)((char*)MappingBaseAddress + ImageExportDirectory->AddressOfNameOrdinals);
//有名字的序号的首地址(RVA)
for (i = ; i < ImageExportDirectory->NumberOfNames; i++)
{
v1 = (char*)((char*)MappingBaseAddress + AddressOfNames[i]); //可以这样写 ImageExportDirectory->AddressOfNames + i * 4
if (_stricmp(szFuntionName, v1) == )
{
OrdinalOfFunction = AddressOfNameOrdinals[i];
AddressOfFunction = (PVOID)((char*)MappingBaseAddress + AddressOfFunctions[OrdinalOfFunction]);//AddressOfFunctions[AddressOfNameOrdinals[i]]
*SSDTFunctionIndex = *(ULONG32*)((char*)AddressOfFunction + Offset_SSDTFunctionIndex);
break;
}
}
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{} }
ZwUnmapViewOfSection(NtCurrentProcess(), MappingBaseAddress);
if (*SSDTFunctionIndex == -)
{
return FALSE;
}
return TRUE;
}
//函数需要，所以传双字 二维指针
BOOLEAN Ring0MappingPEFile(WCHAR* szFileFullPath, PVOID* MappingBaseAddress, ULONG_PTR* MappingViewSize)
{
NTSTATUS Status;
UNICODE_STRING Temp;
OBJECT_ATTRIBUTES oa;
HANDLE hFile = NULL;
HANDLE hSection = NULL;
IO_STATUS_BLOCK IoStatusBlock; if (!szFileFullPath&&MmIsAddressValid(szFileFullPath))
{
return FALSE;
}
if (!MappingBaseAddress&&MmIsAddressValid(MappingBaseAddress))
{
return FALSE;
}
RtlUnicodeStringInit(&Temp, szFileFullPath);
InitializeObjectAttributes(&oa, //out
&Temp, //in ObjectName
OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,//被系统在和ObjectName比较匹配时不区分大小写||此句柄只能用于内核模式下
NULL, //与ObjectName参数匹配的根目录对象，如果ObjectName是对象的全路径则设置此参数为NULL
NULL //驱动程序可以使用NULL用于创建一个具有默认安全描述符的对象
);
//打开文件，获得文件句柄
Status = IoCreateFile(&hFile,
GENERIC_READ | SYNCHRONIZE, //可读|同步
&oa,
&IoStatusBlock, //返回I/O请求的完成情况
NULL,
FILE_ATTRIBUTE_NORMAL,
FILE_SHARE_READ,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
,
CreateFileTypeNone,
NULL,
IO_NO_PARAMETER_CHECKING
);
if (!NT_SUCCESS(Status))
{
return FALSE;
}
oa.ObjectName = NULL;
Status = ZwCreateSection(&hSection,
SECTION_QUERY | SECTION_MAP_READ,
&oa,
NULL,
PAGE_WRITECOPY,
SEC_IMAGE,//内存按1M对齐 0x1000 000
hFile
);
ZwClose(hFile);
if (!NT_SUCCESS(Status))
{
return FALSE;
}
Status = ZwMapViewOfSection(hSection,
NtCurrentProcess(),
MappingBaseAddress,
,
,
,
MappingViewSize,
ViewUnmap, //不能被映射到子进程中
,
PAGE_WRITECOPY
);
ZwClose(hSection);
if (!NT_SUCCESS(Status))
{
return FALSE;
}
return TRUE;
} ULONG32 CalcFunctionOffsetInSSDT(PVOID ServiceTableBase, PVOID FunctionAddress, ULONG32 ParamterCount)
{
//完全没必要像下面这样折腾，就是一个做个SSDT表中类似的地址，有时间自己写一个
ULONG32 Offset = ;
CHAR Temp = ;
CHAR Bits[] = { };
int i = ;
Offset = (ULONG32)((ULONG64)FunctionAddress - (ULONG64)ServiceTableBase);
Offset = Offset << ;
if (ParamterCount > )
{
ParamterCount = ParamterCount-; //NtReadFile 9个参数 和参数压栈有关
}
else
{
ParamterCount = ;
}
memcpy(&Temp, &Offset, ); // 1010 0010 <<4-----> 0010 0000 后面处理参数
#define SETBIT(x,y) x|=(1<<y) //将X的第Y位置1
#define CLRBIT(x,y) x&=~(1<<y) //将X的第Y位清0
#define GETBIT(x,y) (x & (1 << y)) //取X的第Y位，返回0或非0 for (i = ; i < ; i++)
{
Bits[i] = GETBIT(ParamterCount, i);
if (Bits[i])
{
SETBIT(Temp, i);
}
else
{
CLRBIT(Temp, i);
}
}
memcpy(&Offset, &Temp, );
return Offset;
} //write protect 第17位
VOID WPOFF()
{
_disable();
__writecr0(__readcr0() & (~(0x10000))); } VOID WPON()
{
__writecr0(__readcr0() ^ 0x10000);
_enable();
} VOID HookSSDTInWin7_x64(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, PVOID MyFunctionAddress,
PVOID OldFuntionAddress, ULONG32 OldFunctionParamterCount, UCHAR* OldFunctionCode, ULONG32 PatchCodeLength)
{
ULONG32 MyOffset = ;
WPOFF();
InlineHook(OldFuntionAddress, MyFunctionAddress, OldFunctionCode, PatchCodeLength);
WPON(); MyOffset = CalcFunctionOffsetInSSDT(ServiceTableBase, OldFuntionAddress, OldFunctionParamterCount);
WPOFF();
((PULONG32)ServiceTableBase)[SSDTFunctionIndex] = MyOffset;
WPON(); __IsHook = TRUE;
} VOID HookSSDTInWin7_x86(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 MyFunctionAddress)
{
WPOFF();
((PULONG32)ServiceTableBase)[SSDTFunctionIndex] = (ULONG32)MyFunctionAddress;
WPON(); __IsHook = TRUE;
} VOID InlineHook(ULONG64 OldFuntionAddress, ULONG64 MyFunctionAddress, UCHAR* OldFunctionCode, ULONG32 PatchCodeLength)
{
CHAR PatchCode[] = "\xFF\x25\x00\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"; //神坑啊，脑残啊，写成PatchCode 到memcpy才崩溃
ULONG64 Temp = MyFunctionAddress;
memcpy(OldFunctionCode, (PVOID)OldFuntionAddress, PatchCodeLength); //保存原来的函数指令
memcpy(PatchCode + , &Temp, );
memset((PVOID)OldFuntionAddress, 0x90, PatchCodeLength); //先全部打上NOP(计组)
memcpy((PVOID)OldFuntionAddress, PatchCode, );
} //SSDT HOOK的替换函数如何对访问进行过滤”比“如何实现SSDT HOOK”要复杂多了,详见ediary HookNtOpenProcess后的事情
NTSTATUS MyOpenProcess(
_Out_ PHANDLE ProcessHandle,
_In_ ACCESS_MASK DesiredAccess,
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
_In_opt_ PCLIENT_ID ClientId
)
{
//EnumProcessByForce.exe
//调用OpenProcess---->去NtDll导出表中寻找ntdll!NtOpenProcess或者ntdll!ZwOpenProcess 导出表有名称的索引---->切入内核-->跳板nt!ZwOpenProcess Ntoskernl.exe(NtOpenProcess mov eax,23h SSDT[23h])
// ---->KeCheckBugEx ---->Jmp MyOpenProcess
PEPROCESS EProcess = PsGetCurrentProcess(); //EnumProcessByForce.exe
if (EProcess != NULL && MmIsAddressValid(EProcess))
{
char *szProcessImageFileName = PsGetProcessImageFileName(EProcess);
if (strstr(szProcessImageFileName, "EnumProcess") != )
{
return STATUS_ACCESS_DENIED; //黑名单中返回
}
}
__OldNtOpenProcessAddress(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId); //白名单
//OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, i)
//return STATUS_SUCCESS; 死循环
//return STATUS_UNSUCCESSFUL; 阻塞 很有趣
} VOID UnHookSSDTInWin7_x64(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 OldFunctionOffset, PVOID OldFunctionAddress,
UCHAR* OldFunctionCode, ULONG32 PatchCodeLength)
{
WPOFF();
UnlineHook(OldFunctionAddress, OldFunctionCode, PatchCodeLength);
WPON(); WPOFF();
((PULONG32)ServiceTableBase)[SSDTFunctionIndex] = (ULONG32)OldFunctionOffset;
WPON();
} VOID UnlineHook(PVOID OldFunctionAddress, CHAR* OldFunctionCode, ULONG32 PatchCodeLength)
{
memcpy((PVOID)OldFunctionAddress, OldFunctionCode, PatchCodeLength);
} VOID UnHookSSDTInWin7_x86(PVOID ServiceTableBase, ULONG32 SSDTFunctionIndex, ULONG32 OldFunctionAddress)
{
WPOFF();
((PULONG32)ServiceTableBase)[SSDTFunctionIndex] = (ULONG32)OldFunctionAddress;
WPON();
}
DPCHookSSDT.c
2. 接下来就是RemoveDPC了，首先我们要找到DPC，关于Win7以前的版本可以参考这份博客，讲解的很详细，http://bbs.pediy.com/thread-148135.htm
win7下定时器链表被放在KPRCB结构中，64位下，在KPRCB+0x2200的位置：
相关结构：
所以大体流程就是:取KPRCB地址,+0x2200偏移得到_KTIMER_TABLE,+0x200偏移得到_KTIMER_TABLE.TimerEntries
最后遍历_KTIMER_TABLE.TimerEntries.Entry 。32位下类似，只是偏移不同。
那么现在关键是获得KPRCB地址,那怎么获得呢？
每一个CPU中都有一个KPRCB结构地址，它保存在KiProcessorBlock全局变量中。
而KiProcessorBlock在KdDebuggerData64这个结构中，KdDebuggerData64可以从KdVersionBlock中得到。方法如下：
KdVersionBlock在KPCR中位置如图所示，这里需要注意，对于多处理器的环境下，如果想正确获取KdVersionBlock的值，必须保证当前的线程运行在1号处理器上。
具体原因可查看这份博客：http://www.youranshare.com/push/code/win-c-cpp/439.html
然后查看KdVersionBlock结构，最下面的便是KdDebuggerData64结构。
从wrk上查看KdDebuggerData64结构体的定义，发现KiProcessorBlock在0x218h的偏移处。
DO NOT ADD OR REMOVE FIELDS FROM THE MIDDLE OF THIS STRUCTURE!!!
//
// If you remove a field, replace it with an "unused" placeholder.
// Do not reuse fields until there has been enough time for old debuggers
// and extensions to age out.
//
typedef struct _KDDEBUGGER_DATA64 { DBGKD_DEBUG_DATA_HEADER64 Header; //
// Base address of kernel image
// ULONG64 KernBase; //
// DbgBreakPointWithStatus is a function which takes an argument
// and hits a breakpoint. This field contains the address of the
// breakpoint instruction. When the debugger sees a breakpoint
// at this address, it may retrieve the argument from the first
// argument register, or on x86 the eax register.
// ULONG64 BreakpointWithStatus; // address of breakpoint //
// Address of the saved context record during a bugcheck
//
// N.B. This is an automatic in KeBugcheckEx's frame, and
// is only valid after a bugcheck.
// ULONG64 SavedContext; //
// help for walking stacks with user callbacks:
// //
// The address of the thread structure is provided in the
// WAIT_STATE_CHANGE packet. This is the offset from the base of
// the thread structure to the pointer to the kernel stack frame
// for the currently active usermode callback.
// USHORT ThCallbackStack; // offset in thread data //
// these values are offsets into that frame:
// USHORT NextCallback; // saved pointer to next callback frame
USHORT FramePointer; // saved frame pointer //
// pad to a quad boundary
//
USHORT PaeEnabled:; //
// Address of the kernel callout routine.
// ULONG64 KiCallUserMode; // kernel routine //
// Address of the usermode entry point for callbacks.
// ULONG64 KeUserCallbackDispatcher; // address in ntdll //
// Addresses of various kernel data structures and lists
// that are of interest to the kernel debugger.
// ULONG64 PsLoadedModuleList;
ULONG64 PsActiveProcessHead;
ULONG64 PspCidTable; ULONG64 ExpSystemResourcesList;
ULONG64 ExpPagedPoolDescriptor;
ULONG64 ExpNumberOfPagedPools; ULONG64 KeTimeIncrement;
ULONG64 KeBugCheckCallbackListHead;
ULONG64 KiBugcheckData; ULONG64 IopErrorLogListHead; ULONG64 ObpRootDirectoryObject;
ULONG64 ObpTypeObjectType; ULONG64 MmSystemCacheStart;
ULONG64 MmSystemCacheEnd;
ULONG64 MmSystemCacheWs; ULONG64 MmPfnDatabase;
ULONG64 MmSystemPtesStart;
ULONG64 MmSystemPtesEnd;
ULONG64 MmSubsectionBase;
ULONG64 MmNumberOfPagingFiles; ULONG64 MmLowestPhysicalPage;
ULONG64 MmHighestPhysicalPage;
ULONG64 MmNumberOfPhysicalPages; ULONG64 MmMaximumNonPagedPoolInBytes;
ULONG64 MmNonPagedSystemStart;
ULONG64 MmNonPagedPoolStart;
ULONG64 MmNonPagedPoolEnd; ULONG64 MmPagedPoolStart;
ULONG64 MmPagedPoolEnd;
ULONG64 MmPagedPoolInformation;
ULONG64 MmPageSize; ULONG64 MmSizeOfPagedPoolInBytes; ULONG64 MmTotalCommitLimit;
ULONG64 MmTotalCommittedPages;
ULONG64 MmSharedCommit;
ULONG64 MmDriverCommit;
ULONG64 MmProcessCommit;
ULONG64 MmPagedPoolCommit;
ULONG64 MmExtendedCommit; ULONG64 MmZeroedPageListHead;
ULONG64 MmFreePageListHead;
ULONG64 MmStandbyPageListHead;
ULONG64 MmModifiedPageListHead;
ULONG64 MmModifiedNoWritePageListHead;
ULONG64 MmAvailablePages;
ULONG64 MmResidentAvailablePages; ULONG64 PoolTrackTable;
ULONG64 NonPagedPoolDescriptor; ULONG64 MmHighestUserAddress;
ULONG64 MmSystemRangeStart;
ULONG64 MmUserProbeAddress; ULONG64 KdPrintCircularBuffer;
ULONG64 KdPrintCircularBufferEnd;
ULONG64 KdPrintWritePointer;
ULONG64 KdPrintRolloverCount; ULONG64 MmLoadedUserImageList; // NT 5.1 Addition ULONG64 NtBuildLab;
ULONG64 KiNormalSystemCall; // NT 5.0 QFE addition ULONG64 KiProcessorBlock;
ULONG64 MmUnloadedDrivers;
ULONG64 MmLastUnloadedDriver;
ULONG64 MmTriageActionTaken;
ULONG64 MmSpecialPoolTag;
ULONG64 KernelVerifier;
ULONG64 MmVerifierData;
ULONG64 MmAllocatedNonPagedPool;
ULONG64 MmPeakCommitment;
ULONG64 MmTotalCommitLimitMaximum;
ULONG64 CmNtCSDVersion; // NT 5.1 Addition ULONG64 MmPhysicalMemoryBlock;
ULONG64 MmSessionBase;
ULONG64 MmSessionSize;
ULONG64 MmSystemParentTablePage; // Server 2003 addition ULONG64 MmVirtualTranslationBase; USHORT OffsetKThreadNextProcessor;
USHORT OffsetKThreadTeb;
USHORT OffsetKThreadKernelStack;
USHORT OffsetKThreadInitialStack; USHORT OffsetKThreadApcProcess;
USHORT OffsetKThreadState;
USHORT OffsetKThreadBStore;
USHORT OffsetKThreadBStoreLimit; USHORT SizeEProcess;
USHORT OffsetEprocessPeb;
USHORT OffsetEprocessParentCID;
USHORT OffsetEprocessDirectoryTableBase; USHORT SizePrcb;
USHORT OffsetPrcbDpcRoutine;
USHORT OffsetPrcbCurrentThread;
USHORT OffsetPrcbMhz; USHORT OffsetPrcbCpuType;
USHORT OffsetPrcbVendorString;
USHORT OffsetPrcbProcStateContext;
USHORT OffsetPrcbNumber; USHORT SizeEThread; ULONG64 KdPrintCircularBufferPtr;
ULONG64 KdPrintBufferSize; ULONG64 KeLoaderBlock; USHORT SizePcr;
USHORT OffsetPcrSelfPcr;
USHORT OffsetPcrCurrentPrcb;
USHORT OffsetPcrContainedPrcb; USHORT OffsetPcrInitialBStore;
USHORT OffsetPcrBStoreLimit;
USHORT OffsetPcrInitialStack;
USHORT OffsetPcrStackLimit; USHORT OffsetPrcbPcrPage;
USHORT OffsetPrcbProcStateSpecialReg;
USHORT GdtR0Code;
USHORT GdtR0Data; USHORT GdtR0Pcr;
USHORT GdtR3Code;
USHORT GdtR3Data;
USHORT GdtR3Teb; USHORT GdtLdt;
USHORT GdtTss;
USHORT Gdt64R3CmCode;
USHORT Gdt64R3CmTeb; ULONG64 IopNumTriageDumpDataBlocks;
ULONG64 IopTriageDumpDataBlocks; } KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;
KdDebuggerData64
相应的代码：（通常在内核模式下段寄存器FS指向的是KPCR结构，用户模式下指向的是TEB结构）
而我调试64位的时候发现，KdVersionBlock都为null,那我们就不能用上面的方法去得KPRCB了，
不过我们却发现，在msr寄存器的0xC0000101处，存的是KPCR,我们直接_KPCR+偏移0x20就得到KPRCB了。
结构体中的Self是自己的地址，CurrentPrcb是KPRCB的地址。
最后回到正题，我们通过遍历KTIMER_TABLE.TimerEntries.Entry链表，利用CONTAINING_RECORD得到KTIMER结构，判断它的地址是否在我们sys模块地址范围内即可。最后KeCancelTimer掉它。
（第一个地址是KTIMER，第二个地址是sys的基地址，判断是否落入范围）
代码如下：
#include <ntifs.h> typedef struct _KTIMER_TABLE_ENTRY
{
ULONG_PTR Lock;
LIST_ENTRY Entry;
ULARGE_INTEGER Time;
} KTIMER_TABLE_ENTRY, *PKTIMER_TABLE_ENTRY; typedef struct _LDR_DATA_TABLE_ENTRY64
{
LIST_ENTRY64 InLoadOrderLinks;
LIST_ENTRY64 InMemoryOrderLinks;
LIST_ENTRY64 InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
PVOID SectionPointer;
ULONG CheckSum;
PVOID LoadedImports;
PVOID EntryPointActivationContext;
PVOID PatchInformation;
LIST_ENTRY64 ForwarderLinks;
LIST_ENTRY64 ServiceTagLinks;
LIST_ENTRY64 StaticLinks;
PVOID ContextInformation;
ULONG64 OriginalBase;
LARGE_INTEGER LoadTime;
} LDR_DATA_TABLE_ENTRY64, *PLDR_DATA_TABLE_ENTRY64; typedef struct _LDR_DATA_TABLE_ENTRY32
{
LIST_ENTRY32 InLoadOrderLinks;
LIST_ENTRY32 InMemoryOrderLinks;
LIST_ENTRY32 InInitializationOrderLinks;
ULONG DllBase;
ULONG EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING32 FullDllName;
UNICODE_STRING32 BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY32 HashLinks;
struct {
ULONG SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
ULONG LoadedImports;
};
};
} LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32; #ifdef _WIN64
#define LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY64
#define PLDR_DATA_TABLE_ENTRY PLDR_DATA_TABLE_ENTRY64
#else
#define LDR_DATA_TABLE_ENTRY LDR_DATA_TABLE_ENTRY32
#define PLDR_DATA_TABLE_ENTRY PLDR_DATA_TABLE_ENTRY32
#endif VOID DriverUnload(PDRIVER_OBJECT DriverObject); NTSTATUS GetKernelModuleInformationByKernelModuleName(PDRIVER_OBJECT DriverObject, WCHAR* wzKernelModuleName, PVOID* KernelModuleBase, ULONG_PTR* KernelModuleSize); PVOID
GetExportVariableAddressFromNtosKrnlExportTableByVariableName(WCHAR* wzVariableName); BOOLEAN GetKiWaitVariableAddress(PULONG64* KiWaitNever, PULONG64* KiWaitAlways); KDPC* TransTimerDPCEx(PKTIMER Timer, ULONG64 KiWaitNever, ULONG64 KiWaitAlways); PULONG GetKiProcessorBlock(); BOOLEAN GetDPCTimerInfoByModuleInfo(PVOID KernelModuleBase, ULONG_PTR KernelModuleSize, ULONG_PTR* Timer);
BOOLEAN RemoveDPCFromNtos(PVOID KernelModuleBase, ULONG_PTR KernelModuleSize);
RemoveDPC.h
#include "RemoveDPC.h"
#include <ntstrsafe.h>
//bp RemoveDPC!DriverEntry PVOID __KernelModuleBase = NULL;
ULONG_PTR __KernelModuleSize = ; NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegisterPath)
{
NTSTATUS Status = STATUS_SUCCESS;
PDEVICE_OBJECT DeviceObject = NULL;
DbgPrint("DriverSuccuss\r\n");
DriverObject->DriverUnload = DriverUnload; WCHAR wzKernelModuleName[] = L"NewDPCHookSSDT.sys";
if (GetKernelModuleInformationByKernelModuleName(DriverObject, wzKernelModuleName, &__KernelModuleBase, &__KernelModuleSize) == STATUS_UNSUCCESSFUL)
{
return STATUS_UNSUCCESSFUL;
}
RemoveDPCFromNtos(__KernelModuleBase, __KernelModuleSize);
return Status;
} NTSTATUS GetKernelModuleInformationByKernelModuleName(PDRIVER_OBJECT DriverObject,WCHAR* wzKernelModuleName,PVOID* KernelModuleBase,ULONG_PTR* KernelModuleSize)
{
PLDR_DATA_TABLE_ENTRY CurrentEntry = NULL;
PLDR_DATA_TABLE_ENTRY NextEntry = NULL;
if (DriverObject&&MmIsAddressValid(DriverObject))
{
CurrentEntry = (PLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;
NextEntry = (PLDR_DATA_TABLE_ENTRY)CurrentEntry->InLoadOrderLinks.Flink;
while (NextEntry != CurrentEntry)
{
if (NextEntry->BaseDllName.Length >= wcslen(wzKernelModuleName))
{
if (NextEntry->BaseDllName.Buffer
&&MmIsAddressValid((PVOID)NextEntry->BaseDllName.Buffer)
&& !_wcsnicmp(wzKernelModuleName, (WCHAR*)NextEntry->BaseDllName.Buffer, wcslen(wzKernelModuleName))) //这里掉坑了，wcsnicmp是比较函数，相等时返回0,
//再次掉坑，第三个参数表示比较的的字母的个数，如果是0，肯定相等
{
DbgPrint("%S\r\n", wzKernelModuleName);
DbgPrint("%S\r\n", (WCHAR*)NextEntry->BaseDllName.Buffer);
*KernelModuleBase = NextEntry->DllBase;
*KernelModuleSize = NextEntry->SizeOfImage;
return STATUS_SUCCESS;
}
}
NextEntry = (PLDR_DATA_TABLE_ENTRY)NextEntry->InLoadOrderLinks.Flink;
}
}
return STATUS_UNSUCCESSFUL;
} BOOLEAN RemoveDPCFromNtos(PVOID KernelModuleBase, ULONG_PTR KernelModuleSize)
{
ULONG_PTR Timer = NULL;
if (GetDPCTimerInfoByModuleInfo(KernelModuleBase, KernelModuleSize, &Timer) == FALSE)
{
return FALSE;
}
if (Timer && MmIsAddressValid(Timer))
{
if (KeCancelTimer(Timer))
{
return TRUE;
}
}
return FALSE;
} PULONG GetKiProcessorBlock()
{
ULONG* KiProcessorBlock = ; KeSetSystemAffinityThread(); //使当前线程运行在第一个处理器上 _asm
{
push eax
mov eax, FS:[0x34]; 得到KdVersionBlock的地址
add eax, 20h; 得到指向DebuggerDataList的地址
mov eax, [eax]; 得到DebuggerDataList的地址
mov eax, [eax]; 取出里面的内容，即KdDebuggerData64结构
mov eax, [eax + 218h]; 取出KiProcessBlock的地址
mov KiProcessorBlock, eax;放到变量里
pop eax
} KeRevertToUserAffinityThread(); return KiProcessorBlock; } BOOLEAN GetDPCTimerInfoByModuleInfo(PVOID KernelModuleBase, ULONG_PTR KernelModuleSize,ULONG_PTR* Timer)
{
ULONG32 NumberOfProcessors = KeNumberProcessors; //一般运行在第一个CPU上
ULONG_PTR KPRCB = ;
PUCHAR TimerEntries = NULL;
PULONG_PTR KiWaitNever = NULL;
PULONG_PTR KiWaitAlways = NULL;
PLIST_ENTRY CurrentEntry = NULL;
PLIST_ENTRY NextEntry = NULL;
PKTIMER MyTimer = NULL;
int i = ;
KIRQL OldIrql = KeRaiseIrqlToDpcLevel();
#ifdef _WIN64 KeSetSystemAffinityThread(); //使当前线程运行在第一个CPU上
KPRCB = (ULONG64)__readmsr(0xC0000101) + 0x20; //msr(0xC0000101)处位置存的是KPCR
KeRevertToUserAffinityThread();
TimerEntries = (PUCHAR)(*(ULONG64*)KPRCB + 0x2200 + 0x200);
if (GetKiWaitVariableAddress(&KiWaitNever, &KiWaitAlways) == FALSE)
{
return FALSE;
}
for (i = ; i < 0x100; i++)
{
CurrentEntry = (PLIST_ENTRY)(TimerEntries + sizeof(KTIMER_TABLE_ENTRY)*i + );
NextEntry = CurrentEntry->Blink;
if (MmIsAddressValid(CurrentEntry) && MmIsAddressValid(NextEntry))
{
while (NextEntry != CurrentEntry)
{
PKDPC RealDPC;
MyTimer = CONTAINING_RECORD(NextEntry, KTIMER, TimerListEntry); RealDPC = TransTimerDPCEx(MyTimer, *KiWaitNever, *KiWaitAlways);
if (MmIsAddressValid(MyTimer) && MmIsAddressValid(RealDPC) && MmIsAddressValid(RealDPC->DeferredRoutine))
{
if ((ULONG64)MyTimer >= (ULONG64)KernelModuleBase && (ULONG64)MyTimer <= (ULONG64)KernelModuleBase + KernelModuleSize)
{
*Timer = (ULONG64)MyTimer;
KeLowerIrql(OldIrql);
return TRUE;
}
}
NextEntry = NextEntry->Blink;
}
}
}
#else
PULONG KiProcessorBlock = NULL;
KiProcessorBlock = (PULONG)GetKiProcessorBlock();
TimerEntries = (PUCHAR)(*KiProcessorBlock + 0x1960 + 0x40);
for (i = ; i < 0x100; i++)
{
CurrentEntry = (PLIST_ENTRY)(TimerEntries + sizeof(KTIMER_TABLE_ENTRY)*i + );
NextEntry = CurrentEntry->Blink;
if (MmIsAddressValid(CurrentEntry) && MmIsAddressValid(NextEntry))
{
while (NextEntry != CurrentEntry)
{
MyTimer = CONTAINING_RECORD(NextEntry, KTIMER, TimerListEntry); if (MmIsAddressValid(MyTimer) && MmIsAddressValid(MyTimer->Dpc) && MmIsAddressValid(MyTimer->Dpc->DeferredRoutine))
{
if ((ULONG32)MyTimer >= (ULONG32)KernelModuleBase && (ULONG32)MyTimer <= (ULONG32)KernelModuleBase + KernelModuleSize)
{
*Timer = (ULONG32)MyTimer;
KeLowerIrql(OldIrql);
return TRUE;
}
}
NextEntry = NextEntry->Blink;
}
}
} #endif KeLowerIrql(OldIrql);
return FALSE;
} KDPC* TransTimerDPCEx(PKTIMER Timer, ULONG64 KiWaitNever, ULONG64 KiWaitAlways)
{
ULONG64 DPC = (ULONG64)Timer->Dpc; //Time
DPC ^= KiWaitNever;
DPC = _rotl64(DPC, (UCHAR)(KiWaitNever & 0xFF));
DPC ^= (ULONG64)Timer;
DPC = _byteswap_uint64(DPC);
DPC ^= KiWaitAlways;
return (KDPC*)DPC;
} BOOLEAN GetKiWaitVariableAddress(PULONG64* KiWaitNever, PULONG64* KiWaitAlways)
{
/*
kd> u kesettimer l 50
nt!KeSetTimer:
fffff800`03ef10a8 4883ec38 sub rsp,38h
fffff800`03ef10ac 4c89442420 mov qword ptr [rsp+20h],r8
fffff800`03ef10b1 4533c9 xor r9d,r9d
fffff800`03ef10b4 4533c0 xor r8d,r8d
fffff800`03ef10b7 e814000000 call nt!KiSetTimerEx (fffff800`03ef10d0)
fffff800`03ef10bc 4883c438 add rsp,38h
fffff800`03ef10c0 c3 ret
fffff800`03ef10c1 90 nop
fffff800`03ef10c2 90 nop
fffff800`03ef10c3 90 nop
fffff800`03ef10c4 90 nop
fffff800`03ef10c5 90 nop
fffff800`03ef10c6 90 nop
fffff800`03ef10c7 90 nop
nt!KxWaitForLockChainValid:
fffff800`03ef10c8 90 nop
fffff800`03ef10c9 90 nop
fffff800`03ef10ca 90 nop
fffff800`03ef10cb 90 nop
fffff800`03ef10cc 90 nop
fffff800`03ef10cd 90 nop
fffff800`03ef10ce 90 nop
fffff800`03ef10cf 90 nop
nt!KiSetTimerEx:
fffff800`03ef10d0 48895c2408 mov qword ptr [rsp+8],rbx
fffff800`03ef10d5 4889542410 mov qword ptr [rsp+10h],rdx
fffff800`03ef10da 55 push rbp
fffff800`03ef10db 56 push rsi
fffff800`03ef10dc 57 push rdi
fffff800`03ef10dd 4154 push r12
fffff800`03ef10df 4155 push r13
fffff800`03ef10e1 4156 push r14
fffff800`03ef10e3 4157 push r15
fffff800`03ef10e5 4883ec50 sub rsp,50h
fffff800`03ef10e9 488b0518502200 mov rax,qword ptr [nt!KiWaitNever (fffff800`04116108)]
fffff800`03ef10f0 488b1de9502200 mov rbx,qword ptr [nt!KiWaitAlways (fffff800`041161e0)]
*/
ULONG64 KeSetTimer = ;
PUCHAR StartSearchAddress = ;
PUCHAR EndSearchAddress = ;
ULONG64 iOffset = ;
PUCHAR i = NULL;
KeSetTimer = (ULONG64)GetExportVariableAddressFromNtosKrnlExportTableByVariableName(L"KeSetTimer"); StartSearchAddress = (PUCHAR)KeSetTimer;
EndSearchAddress = StartSearchAddress + 0x500; for (i = StartSearchAddress; i < EndSearchAddress; i++)
{
if (*i == 0x48 && *(i + ) == 0x8B && *(i + ) == 0x05)
{
memcpy(&iOffset, i + , );
*KiWaitNever = (PULONG64)(iOffset + (ULONG64)i + );
i = i + ;
memcpy(&iOffset, i + , );
*KiWaitAlways = (PULONG64)(iOffset + (ULONG64)i + );
return TRUE;
}
} return FALSE;
} PVOID
GetExportVariableAddressFromNtosKrnlExportTableByVariableName(WCHAR* wzVariableName)
{
//通过导出变量名字从NtosKrnl中获得导出变量地址
UNICODE_STRING uniVariableName;
PVOID VariableAddress = NULL; if (wzVariableName&&wcslen(wzVariableName) > )
{
RtlUnicodeStringInit(&uniVariableName, wzVariableName);
//从Ntos模块的导出表中获得导出变量的地址
VariableAddress = MmGetSystemRoutineAddress(&uniVariableName);
}
return VariableAddress;
} VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
DbgPrint("Unload Success\r\n");
}
RemoveDPC.c
That's all.