object hook实现禁止创建文件
原理不说了,大伙都懂得..
要解决的问题:
1. 怎么在windbg中看到_OBJECT_TYPE和_OBJECT_TYPE_INITIALIZER结构的内容。
2. 怎样得到pOldParseProcedure的地址
3. 怎样改写((POBJECT_TYPE)*IoDeviceObjectType)->TypeInfo.ParseProcedure=pNewProcedure
对于第一个问题:
nt!_OBJECT_HEADER
+0x000 PointerCount : Int4B
+0x004 HandleCount : Int4B
+0x004 NextToFree : Ptr32 Void
+0x008 Type : Ptr32 _OBJECT_TYPE
+0x00c NameInfoOffset : UChar
+0x00d HandleInfoOffset : UChar
+0x00e QuotaInfoOffset : UChar
+0x00f Flags : UChar
+0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION
+0x010 QuotaBlockCharged : Ptr32 Void
+0x014 SecurityDescriptor : Ptr32 Void
+0x018 Body : _QUAD
lkd> dt _OBJECT_TYPE
nt!_OBJECT_TYPE
+0x000 Mutex : _ERESOURCE
+0x038 TypeList : _LIST_ENTRY
+0x040 Name : _UNICODE_STRING
+0x048 DefaultObject : Ptr32 Void
+0x04c Index : Uint4B
+0x050 TotalNumberOfObjects : Uint4B
+0x054 TotalNumberOfHandles : Uint4B
+0x058 HighWaterNumberOfObjects : Uint4B
+0x05c HighWaterNumberOfHandles : Uint4B
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0ac Key : Uint4B
+0x0b0 ObjectLocks : [4] _ERESOURCE
lkd> dt _OBJECT_TYPE_INITIALIZER
nt!_OBJECT_TYPE_INITIALIZER
+0x000 Length : Uint2B
+0x002 UseDefaultObject : UChar
+0x003 CaseInsensitive : UChar
+0x004 InvalidAttributes : Uint4B
+0x008 GenericMapping : _GENERIC_MAPPING
+0x018 ValidAccessMask : Uint4B
+0x01c SecurityRequired : UChar
+0x01d MaintainHandleCount : UChar
+0x01e MaintainTypeList : UChar
+0x020 PoolType : _POOL_TYPE
+0x024 DefaultPagedPoolCharge : Uint4B
+0x028 DefaultNonPagedPoolCharge : Uint4B
+0x02c DumpProcedure : Ptr32 void
+0x030 OpenProcedure : Ptr32 long
+0x034 CloseProcedure : Ptr32 void
+0x038 DeleteProcedure : Ptr32 void
+0x03c ParseProcedure : Ptr32 long
+0x040 SecurityProcedure : Ptr32 long
+0x044 QueryNameProcedure : Ptr32 long
+0x048 OkayToCloseProcedure : Ptr32 unsigned char
对于第二个问题:
2. 怎样得到pOldParseProcedure的地址
1. 打开一个文件得到文件句柄 ZwOpenFile
2. 依据文件句柄得到文件 ObReferenceObjectByHandle得到pObject
3. pObject是_OBJECT_HEADER 结构中Body的数值,如今要得到_OBJECT_HEADER 的地址,用宏CONTAINING_RECORD((o),OBJECT_HEADER,Body)
4. POBJECT_HEADER结构的Type指向了一个OBJECT_TYPE( pType)
4. OldParseProcedure = pType->TypeInfo.ParseProcedure就是要的结果
整理一下结构间的关系:
- #define OBJECT_TO_OBJECT_HEADER(o) CONTAINING_RECORD((o),OBJECT_HEADER,Body)
- POBJECT_HEADER addrs=NULL;
- POBJECT_TYPE pType= NULL;
- addrs=OBJECT_TO_OBJECT_HEADER(pObject);//获取对象头
- pType=addrs->Type;//获取对象类型结构 object-10h
- OldParseProcedure = pType->TypeInfo.ParseProcedure;//获取服务函数原始地址OBJECT_TYPE+9C位置为打开
typedef struct _OBJECT_HEADER {
LONG PointerCount;
union {
LONG HandleCount;
PSINGLE_LIST_ENTRY SEntry;
};
POBJECT_TYPE Type;
UCHAR NameInfoOffset;
UCHAR HandleInfoOffset;
UCHAR QuotaInfoOffset;
UCHAR Flags;
union
{
POBJECT_CREATE_INFORMATION ObjectCreateInfo;
PVOID QuotaBlockCharged;
};
PSECURITY_DESCRIPTOR SecurityDescriptor;
QUAD Body;
} OBJECT_HEADER, *POBJECT_HEADER;
pType的值为0x821ebe70
lkd> dt _object_type 0x821ebe70
nt!_OBJECT_TYPE
+0x000 Mutex : _ERESOURCE
+0x038 TypeList : _LIST_ENTRY [ 0x821ebea8 - 0x821ebea8 ]
+0x040 Name : _UNICODE_STRING "File"
+0x048 DefaultObject : 0x0000005c
+0x04c Index : 0x1c
+0x050 TotalNumberOfObjects : 0xcd6
+0x054 TotalNumberOfHandles : 0x316
+0x058 HighWaterNumberOfObjects : 0xd6e
+0x05c HighWaterNumberOfHandles : 0x3ad
+0x060 TypeInfo : _OBJECT_TYPE_INITIALIZER
+0x0ac Key : 0x656c6946
+0x0b0 ObjectLocks : [4] _ERESOURCE
3. 怎样改写((POBJECT_TYPE)*IoDeviceObjectType)->TypeInfo.ParseProcedure=pNewProcedure
关闭写保护
HOOK
打开写保护
函数定义方法:
NTSTATUS (*oldParseProcedure)(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object);
此时,就已经HOOK成功了
解决完上面的困难,真正的代码来了
.c
//PVOID oldParseProcedure;
//typedef int (*FP_CALC)(int, int);
NTSTATUS (*oldParseProcedure)(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object);
VOID MyObjectHook()
{
UNICODE_STRING uFileName;
OBJECT_ATTRIBUTES ob;
NTSTATUS status;
HANDLE hFile;
IO_STATUS_BLOCK ioStaBlock;
PVOID pObject;
POBJECT_HEADER addr;
POBJECT_TYPE pType;
OBJECT_TYPE_INITIALIZER obTypeInit;
KIRQL irql;
dprintf("enter myObjectHook...\n");
DbgBreakPoint();
RtlInitUnicodeString(&uFileName,L"\\Device\\HarddiskVolume1\\123.txt");//这个文件必需存在
InitializeObjectAttributes(&ob,&uFileName,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE ,NULL, NULL);
status = ZwOpenFile(&hFile,GENERIC_ALL,&ob,&ioStaBlock,0,FILE_NON_DIRECTORY_FILE);
if (!NT_SUCCESS(status))
{
dprintf("ZwOpenFile error..\n");
return ;
}
status = ObReferenceObjectByHandle(hFile,GENERIC_ALL,NULL,KernelMode,&pObject,NULL);
if (!NT_SUCCESS(status))
{
dprintf("ObReferenceObjectByHandle:Object is Null\n");
return ;
}
dprintf("pObject is 0x%08X\n",pObject);
addr = OBJECT_TO_OBJECT_HEADER(pObject);
dprintf("addr is 0x%08X\n",addr); //这里是pObject-0x18的位置
pType = addr->Type;
dprintf("pType is 0x%08X\n",pType);
//oldParseProcedure = (PVOID)(pType->TypeInfo.ParseProcedure);
oldParseProcedure = pType->TypeInfo.ParseProcedure;
dprintf("OldParseProcedure addrs is %08X\n",oldParseProcedure);
//HOOK 一下下
irql = WPOFF();
pType->TypeInfo.ParseProcedure = NewParseProcedure;//hook
WPON(irql);
//关闭句柄
ZwClose(hFile);
}
//OBJECT HOOK 函数
NTSTATUS NewParseProcedure(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object)
{
NTSTATUS status = STATUS_UNSUCCESSFUL;
PVOID namePool;
if (RemainingName->Buffer)
{
namePool = ExAllocatePool(NonPagedPool, RemainingName->Buffer+2);
RtlZeroMemory(namePool, RemainingName->Buffer+2);
if (namePool)
{
RtlCopyMemory(namePool, RemainingName->Buffer,RemainingName->Length);
_wcsupr((wchar_t*)namePool);
if (wcsstr(namePool, L"TEST.TXT"))
{
ExFreePool(namePool);
return STATUS_ACCESS_DENIED;
}
}
}
return oldParseProcedure(ParseObject,
ObjectType,
AccessState,
AccessMode,
Attributes,
CompleteName,
RemainingName,
Context,
SecurityQos,
*Object);
}
.h
//object hook
VOID MyObjectHook();
#define OBJECT_TO_OBJECT_HEADER(o)\
CONTAINING_RECORD((o),OBJECT_HEADER,Body)
typedef struct _OBJECT_HEADER {
LONG PointerCount;
union {
LONG HandleCount;
PSINGLE_LIST_ENTRY SEntry;
};
POBJECT_TYPE Type;
UCHAR NameInfoOffset;
UCHAR HandleInfoOffset;
UCHAR QuotaInfoOffset;
UCHAR Flags;
union
{
PVOID ObjectCreateInfo;
PVOID QuotaBlockCharged;
};
PSECURITY_DESCRIPTOR SecurityDescriptor;
QUAD Body;
} OBJECT_HEADER, *POBJECT_HEADER;
NTSTATUS NewParseProcedure(IN PVOID ParseObject,
IN PVOID ObjectType,
IN OUT PACCESS_STATE AccessState,
IN KPROCESSOR_MODE AccessMode,
IN ULONG Attributes,
IN OUT PUNICODE_STRING CompleteName,
IN OUT PUNICODE_STRING RemainingName,
IN OUT PVOID Context OPTIONAL,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL,
OUT PVOID *Object);