SSDT Hook

一、效果图

二、分析

这里对NtCreateProcessEx做拦截，用WinDbg来定位该函数在SSDT中的记录地址：

: kd> dd KeServiceDescriptorTable

8055d700    0000011c 805058c4

8055d710

8055d720

8055d730

8055d740    bf80c0b6

8055d750  f8399a80 f82ffb60 820f06b0 806f70c0

8055d760  071d8498  0b14f8a6

8055d770   01cf525a

: kd> dd  + 0x30 *

  805d2136  805ac3ae

  805c49b6 805d1fd4  805fa0e6

  805a60f4 80643f58 806440a8

   806170d6 80577c2c 80624c16

  805f5958 80624de6 8057a24a

  805befc4 805edd88 806170e4 80624fc6

  806170c8  805b4c9e 805edf34

  8061660c 80577cf8 805b7806 8062549a

: kd> u 805d2136

nt!NtCreateProcessEx:

805d2136 6a0c            push    0Ch

805d2138 68e0b84d80      push    offset nt!ObWatchHandles+0x684 (804db8e0)

805d213d e83eaaf6ff      call    nt!_SEH_prolog (8053cb80)

805d2142 64a124010000    mov     eax,dword ptr fs:[00000124h]

805d2148 33d2            xor     edx,edx

805d214a     cmp     byte ptr [eax+140h],dl

805d2150             je      nt!NtCreateProcessEx+0x51 (805d2187)

805d2152 8955fc          mov     dword ptr [ebp-],edx

三、源代码

#include <ntddk.h>

typedef struct _SERVICE_DESCRIPTOR_TABLE

{

    PULONG    ServiceTableBase;

    PULONG    ServiceCounterTableBase;

    ULONG    NumberOfServices;

    PUCHAR    ParamTableBase;

}SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TALBLE;

extern PSERVICE_DESCRIPTOR_TALBLE KeServiceDescriptorTable;

typedef NTSTATUS (*NTCREATEPROCESSEX)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, ULONG, HANDLE, HANDLE, HANDLE, ULONG);

//保存NtCreateProcessEx函数的地址

NTCREATEPROCESSEX ulNtCreateProcessEx = ;

//在指针数组中NtCreateProcessEx的地址

ULONG ulNtCreateProcessExAddr = ;

VOID UN_PROTECT()

{

    _asm

    {

        push    eax

        mov        eax,0FFFEFFFFh

        mov        CR0,eax

        pop        eax

    }

}

VOID RE_PROTECT()

{

    _asm

    {

        push    eax

        mov        eax,CR0

        or        eax,0FFFEFFFFh

        mov        CR0,eax

        pop        eax

    }

}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

{

    UN_PROTECT();

    //替换NtCreateProcessEx的地址为MyNtCreateProcessEx

    *(PULONG)ulNtCreateProcessExAddr = (ULONG)ulNtCreateProcessEx;

    RE_PROTECT();

}

NTSTATUS MyNtCreateProcessEx

(

    __out        PHANDLE                ProcessHandle,

    __in        ACCESS_MASK            DesiredAccess,

    __in_opt    POBJECT_ATTRIBUTES    ObjectAttributes,

    __in        HANDLE                ParentProcess,

    __in        ULONG                Flags,

    __in_opt    HANDLE                SectionHandle,

    __in_opt    HANDLE                DebugPort,

    __in_opt    HANDLE                ExceptionPort,

    __in        ULONG                JobMemberLevel

)

{

    NTSTATUS Status = STATUS_SUCCESS;

    KdPrint(("Enter MyNtCreateProcessEx! \r\n"));

    Status = ulNtCreateProcessEx(ProcessHandle,

        DesiredAccess, ObjectAttributes, ParentProcess,

        Flags, SectionHandle, DebugPort, ExceptionPort, JobMemberLevel);

    return Status;

}

VOID HookCreateProcess()

{

    ULONG ulSsdt = ;

    //获取SSDT

    ulSsdt = (ULONG)KeServiceDescriptorTable->ServiceTableBase;

    //获取NtCreateProcessEx地址的指针

    ulNtCreateProcessExAddr = ulSsdt + 0x30 * ;

    //备份NtCreateProcessEx的原始地址

    ulNtCreateProcessEx = (NTCREATEPROCESSEX)*(PULONG)ulNtCreateProcessExAddr;

    UN_PROTECT();

    //替换NtCreateProcessEx的地址为MyNtCreateProcessEx

    *(PULONG)ulNtCreateProcessExAddr = (ULONG)MyNtCreateProcessEx;

    RE_PROTECT();

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)

{

    NTSTATUS Status = STATUS_SUCCESS;

    pDriverObject->DriverUnload = DriverUnload;

    HookCreateProcess();

    return Status;

}