- 注册时间
- 2011-3-6
- 最后登录
- 1970-1-1
该用户从未签到
|
本人不保证此办法现在还生效!蓝屏死机于本人无关
安博士hook和tp差不多都是那些关键敏感的函数。至于是哪些被hook请自己动手用工具查看一下。
直接上代码!
代码:- #include "struct.h"
- #include "4BOD.h"
- //////////////////////////////////////////////////////////////////////////
- ULONG Pass_NtProcess();
- VOID UnDetour_NtProcess();
- ULONG Pass_NtWriteVirtualMemory();
- VOID UnDetour_NtWriteVirtualMemory();
- ULONG Pass_NtReadVirtualMemory();
- VOID UnDetour_NtReadVirtualMemory();
- ULONG Pass_KiAttachProcess();
- VOID UnDetour_KiAttachProcess();
- ULONG Pass_NtQueryInformationProcess();
- VOID UnDetour_NtQueryInformationProcess();
- ULONG Pass_PsSuspendThread();
- VOID UnDetour_PsSuspendThread();
- ULONG Pass_NtSetContextThread();
- VOID UnDetour_NtSetContextThread();
- ULONG Pass_NtGetContextThread();
- VOID UnDetour_NtGetContextThread();
- void Init_fun();
- ULONG SearchMutex();
- ULONG Pass_debugport();
- ULONG FindProcess();
- //////////////////////////////////////////////////////////////////////////
- ULONG KeStackAttachProcess_Addr;
- ULONG __stdcall IsNPCalled(HANDLE ProcessHandle);
- char g_pFindOrigCode[8];
- ULONG KiSystemService_hack_address;
- PULONG pSSDTKernel;
- PSERVICE_DESCRIPTOR_TABLE_SHADOW _KeServiceDescriptorTable;
- PSERVICE_DESCRIPTOR_TABLE_SHADOW ShadowTable;
- unsigned long SSDT_reentry_address,SSDTDW_reentry_address;
- void __declspec(naked) my_function_detour_KiFastCallEntry()
- {
- __asm
- {
- cmp ecx,10h
- jne SSDT
- mov edi,KeServiceDescriptorTable
- sub edi,0x10
- jmp [SSDTDW_reentry_address]
-
- SSDT:
- mov edi,KeServiceDescriptorTable
- add edi,0x20
- jmp [SSDT_reentry_address]
-
- }
- }
- UCHAR findcode[]={0x83,0xf9,0x10,0x75};
- VOID FindHackAddr()
- {
- ULONG uSysenter;
- ULONG i=0;
- PUCHAR strSysenter;
- __asm{
- mov ecx,0x176
- rdmsr
- mov uSysenter,eax //得到KiFastCallEntry地址
- }
- strSysenter=(PUCHAR)uSysenter;
- for (i=0;i<0x100;i++)
- {
- if (
- findcode[0]==strSysenter[i] &&
- findcode[1]==strSysenter[i+1] &&
- findcode[2]==strSysenter[i+2] &&
- findcode[3]==strSysenter[i+3] )
- {
- break;
- }
- }
- KiSystemService_hack_address=uSysenter+i;
- }
- ULONG HookSysCall()
- {
- KIRQL oldIrql;
- ULONG uSysenter;
- unsigned char newcode[] = { 0xE9, 0x44, 0x33, 0x22, 0x11};
- char *actual_function;
- int i = 0;
- FindHackAddr();
- if (KiSystemService_hack_address==0)
- {
- dprintf("find hack address error!\n");
- return 0;
- }
- /*
- __asm{
- mov ecx,0x176
- rdmsr
- mov uSysenter,eax //得到KiFastCallEntry地址
- }
- KiSystemService_hack_address=uSysenter+0xaf;
- */
-
- actual_function =(char*) KiSystemService_hack_address;
- SSDT_reentry_address = KiSystemService_hack_address+0x20;
- SSDTDW_reentry_address = KiSystemService_hack_address+0x5;
- *( (unsigned long *)(&newcode[1]) ) = (ULONG)my_function_detour_KiFastCallEntry-KiSystemService_hack_address-5;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- for(i=0;i < 5;i++)
- {
- g_pFindOrigCode[i] = actual_function[i];
- actual_function[i] = newcode[i];
- }
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- void RestoreSSDT()
- {
- int i;
- char *actual_function = (char *)(KiSystemService_hack_address);
- KIRQL oldIrql;
- WPOFF();
- KeRaiseIrql( DISPATCH_LEVEL,&oldIrql );
- for(i=0;i < 5;i++)
- {
- actual_function[i] = g_pFindOrigCode[i];
- }
- KeLowerIrql( oldIrql );
- ExFreePool(pSSDTKernel);
- WPON();
- }
- unsigned long AddMyServiceTable()
- {
-
-
- ULONG nSDTKerCallLen;
-
-
- __asm
- {
- pushad
- mov eax,KeServiceDescriptorTable
- mov _KeServiceDescriptorTable,eax
- sub eax,0x40
- mov ShadowTable,eax
- popad
- }
- nSDTKerCallLen = _KeServiceDescriptorTable->ntoskrnl.NumberOfServices;
-
-
- pSSDTKernel = (PULONG)ExAllocatePool( NonPagedPool, nSDTKerCallLen*sizeof(ULONG) );
- if(!pSSDTKernel)
- {
- DbgPrint("AddMyServiceTable alloc fail\n");
- return 0;
- }
- memset( (PVOID)pSSDTKernel, 0, nSDTKerCallLen*sizeof(ULONG));
-
-
- //填充新的SSDT表
- //
- RtlCopyMemory( (PVOID)pSSDTKernel,(PVOID)_KeServiceDescriptorTable->ntoskrnl.ServiceTableBase,nSDTKerCallLen*sizeof(ULONG) );
-
-
- RtlCopyMemory( (PVOID)&_KeServiceDescriptorTable->NotUse1,
- (PVOID)&_KeServiceDescriptorTable->ntoskrnl,sizeof(SERVICE_DESCRIPTOR_TABLE) );
-
-
-
- RtlCopyMemory( (PVOID)&ShadowTable->NotUse1,(PVOID)&ShadowTable->ntoskrnl,sizeof(SERVICE_DESCRIPTOR_TABLE)*2);
-
- WPOFF();
- RtlCopyMemory((PVOID)&_KeServiceDescriptorTable->NotUse1.ServiceTableBase, &pSSDTKernel, sizeof(ULONG));
-
- RtlCopyMemory((PVOID)&ShadowTable->NotUse1.ServiceTableBase, &pSSDTKernel, sizeof(ULONG));
-
- WPON();
-
- return 1;
- }
- void RePlaceSSDT()
- {
- if (AddMyServiceTable())
- {
- HookSysCall();
- }
- }
- //////////////////////////////////////////////////////////////////////////
- NTSTATUS
- DriverEntry(
- PDRIVER_OBJECT pDriverObj,
- PUNICODE_STRING pRegistryString
- )
- {
- NTSTATUS status = STATUS_SUCCESS;
- UNICODE_STRING ustrLinkName;
- UNICODE_STRING ustrDevName;
- PDEVICE_OBJECT pDevObj;
- dprintf("[4BOD] DriverEntry\n");
-
- pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
- pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
- pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
- pDriverObj->DriverUnload = DriverUnload;
- RtlInitUnicodeString(&ustrDevName, DEVICE_NAME);
- status = IoCreateDevice(pDriverObj,
- 0,
- &ustrDevName,
- FILE_DEVICE_UNKNOWN,
- 0,
- FALSE,
- &pDevObj);
- if(!NT_SUCCESS(status)) {
- dprintf("[4BOD] IoCreateDevice = 0x%x\n", status);
- return status;
- }
- RtlInitUnicodeString(&ustrLinkName, LINK_NAME);
- status = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName);
- if(!NT_SUCCESS(status)) {
- dprintf("[4BOD] IoCreateSymbolicLink = 0x%x\n", status);
- IoDeleteDevice(pDevObj);
- return status;
- }
- Init_fun();
- RePlaceSSDT();
- // FindProcess();
- // SearchMutex();
- // Pass_debugport();
- Pass_NtProcess();
-
- Pass_KiAttachProcess();
-
- Pass_NtReadVirtualMemory();
- Pass_NtWriteVirtualMemory();
- Pass_NtQueryInformationProcess();
- Pass_PsSuspendThread();
- Pass_NtSetContextThread();
- Pass_NtGetContextThread();
-
- return STATUS_SUCCESS;
- }
- VOID
- DriverUnload(
- PDRIVER_OBJECT pDriverObj
- )
- {
- UNICODE_STRING strLink;
- LARGE_INTEGER Delay;
- RtlInitUnicodeString(&strLink, LINK_NAME);
- UnDetour_NtGetContextThread();
- UnDetour_NtSetContextThread();
- UnDetour_PsSuspendThread();
- UnDetour_NtQueryInformationProcess();
- UnDetour_NtWriteVirtualMemory();
- UnDetour_NtReadVirtualMemory();
- UnDetour_KiAttachProcess();
- UnDetour_NtProcess();
-
- RestoreSSDT();
- Delay.QuadPart = -5000000;
- KeDelayExecutionThread(KernelMode, TRUE, &Delay);
- IoDeleteSymbolicLink(&strLink);
- IoDeleteDevice(pDriverObj->DeviceObject);
- dprintf("[4BOD] Unloaded\n");
- }
- NTSTATUS
- DispatchCreate(
- PDEVICE_OBJECT pDevObj,
- PIRP pIrp
- )
- {
- pIrp->IoStatus.Status = STATUS_SUCCESS;
- pIrp->IoStatus.Information = 0;
- dprintf("[4BOD] IRP_MJ_CREATE\n");
- IoCompleteRequest(pIrp, IO_NO_INCREMENT);
- return STATUS_SUCCESS;
- }
- NTSTATUS
- DispatchClose(
- PDEVICE_OBJECT pDevObj,
- PIRP pIrp
- )
- {
- pIrp->IoStatus.Status = STATUS_SUCCESS;
- pIrp->IoStatus.Information = 0;
- dprintf("[4BOD] IRP_MJ_CLOSE\n");
- IoCompleteRequest(pIrp, IO_NO_INCREMENT);
- return STATUS_SUCCESS;
- }
- NTSTATUS
- DispatchIoctl(
- PDEVICE_OBJECT pDevObj,
- PIRP pIrp
- )
- {
- NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
- PIO_STACK_LOCATION pIrpStack;
- ULONG uIoControlCode;
- PVOID pIoBuffer;
- ULONG uInSize;
- ULONG uOutSize;
- pIrpStack = IoGetCurrentIrpStackLocation(pIrp);
- uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
- pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
- uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
- uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
- switch(uIoControlCode) {
- case IOCTL_HELLO: {
-
- dprintf("[4BOD] Hello\n");
- status = STATUS_SUCCESS;
- }
- break;
-
- //
- // 添加执行代码
- //
- }
- if(status == STATUS_SUCCESS)
- pIrp->IoStatus.Information = uOutSize;
- else
- pIrp->IoStatus.Information = 0;
-
- /////////////////////////////////////
- pIrp->IoStatus.Status = status;
- IoCompleteRequest(pIrp, IO_NO_INCREMENT);
- return status;
- }
- //////////////////////////////////////////////////////////////////////////
- //返回-1:拒绝访问
- //返回0 :走NP HOOK
- //返回1 :绕过NP HOOK
- //
- ////////////////////////////////////////////////////////////////////////////
- ULONG __stdcall IsNPCalled(HANDLE ProcessHandle)
- {
-
- NTSTATUS status;
- PEPROCESS pEProcess=0;
- char* proname=0;
-
-
-
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
- if (!ProcessHandle)
- {
- return 0;
- }
-
- status = ObReferenceObjectByHandle(ProcessHandle,PROCESS_ALL_ACCESS,NULL,0,&pEProcess,NULL);
-
- if(!NT_SUCCESS(status))
- {
- DbgPrint("ObReferenceObjectByHandle fail! %08x \n",status);
- return 0;
-
- }
- ObDereferenceObject(pEProcess);
- proname=GetProcessNameFromEProc(pEProcess);
-
- if (!_stricmp("OllyDBG.EXE",proname))
- {
- DbgPrint("ollydbg!!!!!!!!! \n");
- return -1;
- }
- if (!_stricmp("Shadow.exe",proname))
- {
- return -1;
- }
- if (!_stricmp("taskmgr.exe",proname))
- {
- return -1;
- }
-
-
- return 0;
- }
- else if (!_stricmp("OllyDBG.EXE",GetProcessNameFromEProc(0)))
- {
-
- return 1;
- }
- else if (!_stricmp("Shadow.exe",GetProcessNameFromEProc(0)))
- {
- return 1;
- }
- else if (!_stricmp("taskmgr.exe",GetProcessNameFromEProc(0)))
- {
- return 1;
- }
- else
- {
- return 0;
- }
-
-
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG __stdcall IsNPCalled_EP(PEPROCESS EProcess)
- {
-
-
- NTSTATUS status;
- PEPROCESS pEProcess=0;
- char* proname=0;
-
-
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
- if (!EProcess)
- {
- return 0;
- }
-
-
- proname=GetProcessNameFromEProc(EProcess);
-
- if (!_stricmp("OllyDBG.EXE",proname))
- {
- DbgPrint("ollydbg!!!!!!!!! epepepepep\n");
- return -1;
- }
- if (!_stricmp("Shadow.exe",proname))
- {
- return -1;
- }
- if (!_stricmp("taskmgr.exe",proname))
- {
- return -1;
- }
-
- return 0;
- }
- else if (!_stricmp("OllyDBG.EXE",GetProcessNameFromEProc(0)))
- {
-
- return 1;
- }
- else if (!_stricmp("Shadow.exe",GetProcessNameFromEProc(0)))
- {
- return 1;
- }
- else if (!_stricmp("taskmgr.exe",GetProcessNameFromEProc(0)))
- {
- return 1;
- }
- else
- {
- return 0;
- }
-
-
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG old_KiMoveApcState;
- ULONG Init_KiMoveApcState()
- {
- old_KiMoveApcState=KeStackAttachProcess_Addr-0x6b2;
- return 1;
- }
- VOID __declspec(naked) _KiMoveApcState (
- __in PKAPC_STATE Source,
- __out PKAPC_STATE Destination
- )
- {
- __asm
- {
- jmp [old_KiMoveApcState]
- }
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG __stdcall fack(PEPROCESS Pep)
- {
- __try
- {
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
- if (!_stricmp("ollydbg.exe",GetProcessNameFromEProc(Pep)))
- {
- DbgPrint("dnf kiattachprocess ollydbg!!!\n");
- return 1;
- }
- }
- }
- __except(1)
- {
- DbgPrint("fack error!!\n");
- }
- return 0;
- }
- unsigned long KiAttachProcess_reentry_address;
- void __declspec(naked) my_function_detour_KiAttachProcess()
- {
- __asm
- {
- inc word ptr [edi+0x60]
- lea ebx,[esi+0x34]
- push ebx
- call _KiMoveApcState
- jmp [KiAttachProcess_reentry_address]
- }
- }
- //////////////////////////////////////////////////////////////////////////
- char KiAttachProcess_g_oricode[8];
- ULONG Pass_KiAttachProcess()
- {
- char *actual_function;
-
- KIRQL oldIrql;
- int i = 0;
- unsigned char newcode[] = { 0xEA, 0x44, 0x33, 0x22, 0x11, 0x08,0x00};
- actual_function = (char *)(KeStackAttachProcess_Addr-0x219);
- KiAttachProcess_reentry_address = (KeStackAttachProcess_Addr-0x20c);
- *( (unsigned long *)(&newcode[1]) ) = (unsigned long)my_function_detour_KiAttachProcess;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- for(i=0;i < 7;i++)
- {
- KiAttachProcess_g_oricode[i] = actual_function[i];
- actual_function[i] = newcode[i];
- }
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_KiAttachProcess()
- {
- char *actual_function = (char *)(KeStackAttachProcess_Addr-0x219);
- KIRQL oldIrql;
- int i = 0;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- for(i=0;i < 7;i++)
- {
- actual_function[i] = KiAttachProcess_g_oricode[i];
- }
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG OldNtReadVirtualMemoryAdd;
- ULONG reentryadd_NtReadVirtualMemory;
- __declspec(naked) NTSTATUS NewNtReadVirtualMemory()
- {
- __asm
- {
- push [esp+4]
- call IsNPCalled
- cmp eax,1
- jnz NtReadVirtualMemory_ENT1
- push 0x1c
- push 0x804daef0
- mov eax, 0x8053cbe0
- call eax
- jmp [reentryadd_NtReadVirtualMemory]
- NtReadVirtualMemory_ENT1:
- cmp eax,0
- jnz NtReadVirtualMemory_ENT2
- jmp [OldNtReadVirtualMemoryAdd]
- NtReadVirtualMemory_ENT2:
- mov eax,0
- ret 0x14
- }
- }
- //////////////////////////////////////////////////////////////////////////NtReadVirtualMemory
- ULONG Pass_NtReadVirtualMemory()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0xBA * 4; //得到NtReadVirtualMemory的服务地址
- (ULONG)OldNtReadVirtualMemoryAdd = *(ULONG*)Address; //保存此地址
- reentryadd_NtReadVirtualMemory=OldNtReadVirtualMemoryAdd+0xc;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)NewNtReadVirtualMemory; //HOOK SSDT
-
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- //反补丁,用于最后恢复用
- VOID UnDetour_NtReadVirtualMemory()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0xBA * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldNtReadVirtualMemoryAdd; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- ULONG reentryadd_NtWriteVirtualMemory;
- ULONG OldNtWriteVirtualMemoryAdd;
- __declspec(naked) NTSTATUS NewNtWriteVirtualMemory()
- {
- __asm
- {
- push [esp+4]
- call IsNPCalled
- cmp eax,1
- jnz NtWriteVirtualMemory_ENT1
- push 0x1c
- push 0x804daf08
- mov eax, 0x8053cbe0
- call eax
- jmp [reentryadd_NtWriteVirtualMemory]
- NtWriteVirtualMemory_ENT1:
- cmp eax,0
- jnz NtWriteVirtualMemory_ENT2
- jmp [OldNtWriteVirtualMemoryAdd]
- NtWriteVirtualMemory_ENT2:
- mov eax,0
- ret 0x14
- }
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG Pass_NtWriteVirtualMemory()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0x115 * 4;
- (ULONG)OldNtWriteVirtualMemoryAdd = *(ULONG*)Address;
- reentryadd_NtWriteVirtualMemory=OldNtWriteVirtualMemoryAdd+0xc;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)NewNtWriteVirtualMemory; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_NtWriteVirtualMemory()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0x115 * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldNtWriteVirtualMemoryAdd; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- //////////////////////////////////////////////////////////////////////////NtOpenProcess
- ULONG OldNtProcessAdd;
- ULONG reentryadd_NtWriteVirtualMemory;
- NTSTATUS
- _NtOpenProcess (
- __out PHANDLE ProcessHandle,
- __in ACCESS_MASK DesiredAccess,
- __in POBJECT_ATTRIBUTES ObjectAttributes,
- __in_opt PCLIENT_ID ClientId
- )
- {
- HANDLE Handle;
- KPROCESSOR_MODE PreviousMode;
- NTSTATUS Status;
- PEPROCESS Process;
- PETHREAD Thread;
- CLIENT_ID CapturedCid={0};
- BOOLEAN ObjectNamePresent;
- BOOLEAN ClientIdPresent;
- ACCESS_STATE AccessState;
- AUX_ACCESS_DATA AuxData;
- ULONG Attributes;
- LUID SeDebugPrivilege = {0};
- POBJECT_TYPE _PsProcessType;
- PEPROCESS tempeprocess;
- PsLookupProcessByProcessId(ClientId->UniqueProcess,&tempeprocess);
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
-
- // ERROR_INVALID_PARAMETER
- __try
- {
- // DbgPrint("dnf threadid %d KTHREAD %08x want openprocess %s\n",
- // PsGetCurrentThreadId(),PsGetCurrentThread(),GetProcessNameFromEProc(tempeprocess));
- if (!_stricmp("OllyDBG.EXE",GetProcessNameFromEProc(tempeprocess)) )
- {
- return STATUS_INVALID_PARAMETER;
- }
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(tempeprocess)) )
- {
- // return STATUS_INVALID_PARAMETER;
- }
- if (!_stricmp("taskmgr.exe",GetProcessNameFromEProc(tempeprocess)) )
- {
- return STATUS_INVALID_PARAMETER;
- }
-
- }
- __except (EXCEPTION_EXECUTE_HANDLER)
- {
- DbgPrint("GetExceptionCode %08x",GetExceptionCode());
- // return GetExceptionCode();
- }
-
- return NtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes, ClientId);
- }
- // DbgPrint("%s want openprocess %s\n",GetProcessNameFromEProc(0),GetProcessNameFromEProc(tempeprocess));
- (ULONG)_PsProcessType=*(ULONG*)PsProcessType;
- PreviousMode = KeGetPreviousMode();
- SeDebugPrivilege =RtlConvertLongToLuid(SE_DEBUG_PRIVILEGE);
- if (PreviousMode != KernelMode) {
- __try {
- ProbeForWriteHandle (ProcessHandle);
- ProbeForReadSmallStructure (ObjectAttributes,
- sizeof(OBJECT_ATTRIBUTES),
- sizeof(ULONG));
- ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
- Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, UserMode);
- if (ARGUMENT_PRESENT (ClientId)) {
- ProbeForReadSmallStructure (ClientId, sizeof (CLIENT_ID), sizeof (ULONG));
- CapturedCid = *ClientId;
- ClientIdPresent = TRUE;
- } else {
- ClientIdPresent = FALSE;
- }
- }
- __except (EXCEPTION_EXECUTE_HANDLER) {
- return GetExceptionCode();
- }
- } else {
- ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
- Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, KernelMode);
- if (ARGUMENT_PRESENT (ClientId)) {
- CapturedCid = *ClientId;
- ClientIdPresent = TRUE;
- } else {
- ClientIdPresent = FALSE;
- }
- }
- if (ObjectNamePresent && ClientIdPresent) {
- return STATUS_INVALID_PARAMETER_MIX;
- }
- Status = SeCreateAccessState(
- &AccessState,
- &AuxData,
- DesiredAccess,
- &_PsProcessType->TypeInfo.GenericMapping
- );
- if ( !NT_SUCCESS(Status) ) {
- return Status;
- }
-
- if (SeSinglePrivilegeCheck( SeDebugPrivilege, PreviousMode )) {
- if ( AccessState.RemainingDesiredAccess & MAXIMUM_ALLOWED ) {
- AccessState.PreviouslyGrantedAccess |= PROCESS_ALL_ACCESS;
- } else {
- AccessState.PreviouslyGrantedAccess |= ( AccessState.RemainingDesiredAccess );
- }
- AccessState.RemainingDesiredAccess = 0;
- }
- if (ObjectNamePresent) {
- Status = ObOpenObjectByName(
- ObjectAttributes,
- _PsProcessType,
- PreviousMode,
- &AccessState,
- 0,
- NULL,
- &Handle
- );
- SeDeleteAccessState( &AccessState );
- if ( NT_SUCCESS(Status) ) {
- __try {
- *ProcessHandle = Handle;
- }
- __except (EXCEPTION_EXECUTE_HANDLER) {
- return GetExceptionCode ();
- }
- }
- return Status;
- }
- if ( ClientIdPresent ) {
- Thread = NULL;
- if (CapturedCid.UniqueThread) {
- Status = PsLookupProcessThreadByCid(
- &CapturedCid,
- &Process,
- &Thread
- );
- if (!NT_SUCCESS(Status)) {
- SeDeleteAccessState( &AccessState );
- return Status;
- }
- } else {
- Status = PsLookupProcessByProcessId(
- CapturedCid.UniqueProcess,
- &Process
- );
- if ( !NT_SUCCESS(Status) ) {
- SeDeleteAccessState( &AccessState );
- return Status;
- }
- }
- //
- // OpenObjectByAddress
- //
- Status = ObOpenObjectByPointer(
- Process,
- Attributes,
- &AccessState,
- 0,
- _PsProcessType,
- PreviousMode,
- &Handle
- );
- SeDeleteAccessState( &AccessState );
- if (Thread) {
- ObDereferenceObject(Thread);
- }
- ObDereferenceObject(Process);
- if (NT_SUCCESS (Status)) {
- __try {
- *ProcessHandle = Handle;
- }
- __except (EXCEPTION_EXECUTE_HANDLER) {
- return GetExceptionCode ();
- }
- }
- return Status;
- }
- return STATUS_INVALID_PARAMETER_MIX;
- }
- ULONG Pass_NtProcess()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0x7A * 4;
- OldNtProcessAdd = *(ULONG*)Address;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)_NtOpenProcess; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_NtProcess()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 0x7A * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = OldNtProcessAdd; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- void Init_fun()
- {
- KeStackAttachProcess_Addr=GetFunctionAddr(L"KeStackAttachProcess");
- Init_KiMoveApcState();
- }
- //////////////////////////////////////////////////////////////////////////
- //////////////////////////////////////////////////////////////////////////
- #define SYSTEMSERVICE(Index) *(PULONG)((ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase+ Index*4);
- ULONG DbgkForwardExceptionAddr = 0;
- ULONG KiDispatchExceptionAddr = 0;
- ULONG DbgkpQueueMessageAddr = 0;
- ULONG SearchMutex()
- {
- ULONG NtResumeThreadAddr = 0;
- ULONG NtRaiseExceptionAddr = 0;
- ULONG KiRaiseExceptionAddr = 0;
- ULONG DbgkpSendApiMessageAddr = 0;
- ULONG DbgkpProcessDebugPortMutex =0;
- ULONG PsResumeThreadAddr =0;
- DWORD dwKey;
- ULONG i;
- NtResumeThreadAddr = SYSTEMSERVICE(206);
- DbgPrint("NtResumeThreadAddr : %X\n", NtResumeThreadAddr);
- for(i = NtResumeThreadAddr; i < NtResumeThreadAddr + 0x7C; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE8E475FF)
- {
- dwKey = i + 4;
- PsResumeThreadAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("PsResumeThreadAddr : %X\n", PsResumeThreadAddr);
- NtRaiseExceptionAddr = SYSTEMSERVICE(181);
- DbgPrint("NtRaiseExceptionAddr : %X\n", NtRaiseExceptionAddr);
- for(i = NtRaiseExceptionAddr; i < NtRaiseExceptionAddr + 0x30; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE8505100)
- {
- dwKey = i + 4;
- KiRaiseExceptionAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("KiRaiseExceptionAddr : %X\n", KiRaiseExceptionAddr);
- if (KiRaiseExceptionAddr > 0x80000000)
- {
- for(i = KiRaiseExceptionAddr; i < KiRaiseExceptionAddr + 0x197; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE853FFFF)
- {
- dwKey = i + 4;
- KiDispatchExceptionAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("KiDispatchExceptionAddr : %X\n", KiDispatchExceptionAddr);
- }
- if (KiDispatchExceptionAddr > 0x80000000)
- {
- for(i = KiDispatchExceptionAddr; i < KiDispatchExceptionAddr + 0x397; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE8565701)
- {
- dwKey = i + 4;
- DbgkForwardExceptionAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("DbgkForwardExceptionAddr : %X\n", DbgkForwardExceptionAddr);
- }
- if (DbgkForwardExceptionAddr > 0x80000000)
- {
- for(i = DbgkForwardExceptionAddr; i < DbgkForwardExceptionAddr + 0x8A; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE8508845)
- {
- dwKey = i + 4;
- DbgkpSendApiMessageAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("DbgkpSendApiMessageAddr : %X\n", DbgkpSendApiMessageAddr);
- }
- if (DbgkpSendApiMessageAddr > 0x80000000)
- {
- for(i = DbgkpSendApiMessageAddr; i < DbgkpSendApiMessageAddr + 0x55; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xE8515052)
- {
- dwKey = i + 4;
- DbgkpQueueMessageAddr = i + *(ULONG*)dwKey + 8;
- }
- }
- }
- DbgPrint("DbgkpQueueMessageAddr : %X\n", DbgkpQueueMessageAddr);
- }
- if (DbgkpQueueMessageAddr > 0x80000000)
- {
- for(i = DbgkpQueueMessageAddr; i < DbgkpQueueMessageAddr + 0x16F; i++)
- {
- dwKey = *(PDWORD)i;
- if (MmIsAddressValid(&dwKey))
- {
- if (dwKey == 0xB93075FC)
- {
- dwKey = i + 4;
- DbgkpProcessDebugPortMutex = *(ULONG*)dwKey;
- }
- }
- }
- DbgPrint("DbgkpProcessDebugPortMutex : %X\n", DbgkpProcessDebugPortMutex);
- }
- return DbgkpProcessDebugPortMutex;
- }
- //////////////////////////////////////////////////////////////////////////
- ULONG Pass_debugport()
- {
- KIRQL oldIrql;
- char timestr[]={0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90};
- char* g_KiDispatchException=(char*)(KiDispatchExceptionAddr+0x187);
- char* g_PspCreateProcess=(char*)(KiDispatchExceptionAddr+0xD2599);
- char* g_DbgkForwardException=(char*)(DbgkForwardExceptionAddr+0x3e);
- char* g_DbgkpQueueMessage=(char*)(DbgkpQueueMessageAddr+0x7B);
- char* g_DbgkCreateThread=(char*)(KiDispatchExceptionAddr+0x14515F);
- char* g_DbgkExitThread=(char*)(KiDispatchExceptionAddr+0x1453F8);
- char* g_DbgkMapViewOfSection=(char*)(KiDispatchExceptionAddr+0x14550B);
- char* g_DbgkExitProcess=(char*)(KiDispatchExceptionAddr+0x145472);
- char* g_DbgkUnMapViewOfSection=(char*)(KiDispatchExceptionAddr+0x1455D1);
- char* g_PspExitThread=(char*)(KiDispatchExceptionAddr+0xD3E84);
- char* g_DbgkpMarkProcessPeb=(char*)(KiDispatchExceptionAddr+0x1438EA);
- char* g_MmCreatePeb=(char*)(KiDispatchExceptionAddr+0xB1907);
- char* g_DbgkpSetProcessDebugObject=(char*)(KiDispatchExceptionAddr+0x144934);
- char* g_DbgkpSetProcessDebugObject1=(char*)(KiDispatchExceptionAddr+0x144942);
- char* g_DbgkpSetProcessDebugObject2=(char*)(KiDispatchExceptionAddr+0x14495C);
- char* g_DbgkpSetProcessDebugObject3=(char*)(KiDispatchExceptionAddr+0x1449A6);
- char* g_DbgkpSetProcessDebugObject4=(char*)(KiDispatchExceptionAddr+0x1449E8);
-
- //nop
- char* anti_DbgkExitThread=(char*)(KiDispatchExceptionAddr+0x1453F6);
- char* anti_DbgkExitProcess=(char*)(KiDispatchExceptionAddr+0x145470);
- char* anti_DbgkUnMapViewOfSection=(char*)(KiDispatchExceptionAddr+0x1455CF);
- //jmp
- char* anti_DbgkMapViewOfSection=(char*)(KiDispatchExceptionAddr+0x145505);
- char* anti_DbgkForwardException=(char*)(DbgkForwardExceptionAddr+0x38);
- //nop create time
- char* g_PspCreateProcess_time=(char*)(KiDispatchExceptionAddr+0xD2B15);
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- memcpy(g_PspCreateProcess_time,timestr,9);
- *(ULONG*)(&g_KiDispatchException[2])=0x70;
- *(ULONG*)(&g_PspCreateProcess[2])=0x70;
- *(ULONG*)(&g_DbgkForwardException[2])=0x70;
- *(ULONG*)(&g_DbgkpQueueMessage[2])=0x70;
- *(ULONG*)(&g_DbgkCreateThread[2])=0x70;
- *(ULONG*)(&g_DbgkExitThread[2])=0x70;
- *(ULONG*)(&g_DbgkMapViewOfSection[2])=0x70;
- *(ULONG*)(&g_DbgkExitProcess[2])=0x70;
- *(ULONG*)(&g_DbgkUnMapViewOfSection[2])=0x70;
- *(ULONG*)(&g_PspExitThread[2])=0x70;
- *(ULONG*)(&g_DbgkpMarkProcessPeb[2])=0x70;
- *(ULONG*)(&g_MmCreatePeb[2])=0x70;
- *(ULONG*)(&g_DbgkpSetProcessDebugObject[2])=0x70;
- *(ULONG*)(&g_DbgkpSetProcessDebugObject1[2])=0x70;
- *(ULONG*)(&g_DbgkpSetProcessDebugObject2[2])=0x70;
- *(ULONG*)(&g_DbgkpSetProcessDebugObject3[2])=0x70;
- *(ULONG*)(&g_DbgkpSetProcessDebugObject4[2])=0x70;
- //
- // anti_DbgkExitThread[0]=0x90;
- // anti_DbgkExitThread[1]=0x90;
- // anti_DbgkExitProcess[0]=0x90;
- // anti_DbgkExitProcess[1]=0x90;
- // anti_DbgkUnMapViewOfSection[0]=0x90;
- // anti_DbgkUnMapViewOfSection[1]=0x90;
- //
- // anti_DbgkMapViewOfSection[0]=0xeb;
- // anti_DbgkForwardException[0]=0xeb;
- KeLowerIrql(oldIrql);
- WPON();
-
- return STATUS_SUCCESS;
- }
- const int process_list_offset=0x88;
- const int createtime_list_offset=0x70;
- ULONG FindProcess()
- {
- ULONG cproc=0x00000000;
- ULONG i=0;
- ULONG TPID;
- PEPROCESS tmpeprocess;
- PLIST_ENTRY plist_active_procs;
- LARGE_INTEGER temptime;
- temptime.QuadPart=0;
- PsLookupProcessByProcessId((HANDLE)4,&tmpeprocess);
- cproc=(ULONG)tmpeprocess;
- while (1)
- {
-
- if ((i>=1) && ((ULONG)tmpeprocess==cproc))
- {
- break;
- return 0x00000000;
- }
- else
- {
- plist_active_procs=(LIST_ENTRY*)(cproc+process_list_offset);
- cproc=(ULONG)plist_active_procs->Flink;
- cproc=cproc-process_list_offset;
- *(LARGE_INTEGER*)(cproc+createtime_list_offset)=temptime;
- i++;
- }
- }
- return 1;
- }
- //////////////////////////////////////////////////////////////////////////
- typedef NTSTATUS (*NTQUERYINFORMATIONPROCESS)(
- __in HANDLE ProcessHandle,
- __in PROCESSINFOCLASS ProcessInformationClass,
- __out PVOID ProcessInformation,
- __in ULONG ProcessInformationLength,
- __out_opt PULONG ReturnLength
- );
- NTQUERYINFORMATIONPROCESS OldNQueryInformationProcessAddr;
- typedef struct _PROCESS_DEBUG_PORT_INFO
- {
-
- HANDLE DebugPort;
-
- } PROCESS_DEBUG_PORT_INFO;
-
-
-
- //enum SYSTEM_INFORMATION_CLASS { SystemKernelDebuggerInformation = 35 };
-
- //enum THREAD_INFO_CLASS { ThreadHideFromDebugger = 17 };
-
- //enum PROCESS_INFO_CLASS { ProcessDebugPort = 7 };
- NTSTATUS NewNtQueryInformationProcess(
- __in HANDLE ProcessHandle,
- __in PROCESSINFOCLASS ProcessInformationClass,
- __out PROCESS_DEBUG_PORT_INFO* ProcessInformation,
- __in ULONG ProcessInformationLength,
- __out_opt PULONG ReturnLength
- )
- {
- // PROCESS_DEBUG_PORT_INFO* tempPi;
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)) ||
- !_stricmp("AION.bin",GetProcessNameFromEProc(0)) ||
- !_stricmp("GameMon.des",GetProcessNameFromEProc(0)))
- {
- if (ProcessInformationClass==7)
- {
- DbgPrint("%s NtQueryInformationProcess debugport!\n",GetProcessNameFromEProc(0));
- ProcessInformation->DebugPort=0;
- return 0;
- }
- }
- // DbgPrint("%s NtQueryInformationProcess !\n",GetProcessNameFromEProc(0));
- return OldNQueryInformationProcessAddr(ProcessHandle,ProcessInformationClass,ProcessInformation,ProcessInformationLength,ReturnLength);
- }
- ULONG Pass_NtQueryInformationProcess()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 154 * 4;
- (ULONG)OldNQueryInformationProcessAddr = *(ULONG*)Address;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)NewNtQueryInformationProcess; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_NtQueryInformationProcess()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 154 * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldNQueryInformationProcessAddr; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- // NTSTATUS __declspec(naked) _PsSuspendThread(PETHREAD Thread, PULONG PreviousSuspendCount)
- // {
- //
- // }
- //////////////////////////////////////////////////////////////////////////
- //unsigned long PsSuspendThread_reentry_address;
- ULONG pssuspendthreadaddr;
- NTSTATUS __declspec(naked) _PsSuspendThread(PETHREAD Thread, PULONG PreviousSuspendCount)
- {
- __asm
- {
- push 0x18
- push 0x804db9e8
- mov esi,0x8053cbe0
- call esi
- mov esi,pssuspendthreadaddr
- add esi,0xc
- jmp esi
- }
- }
- //////////////////////////////////////////////////////////////////////////
- NTSTATUS
- _NtSuspendThread(
- __in HANDLE ThreadHandle,
- __out_opt PULONG PreviousSuspendCount
- )
- {
- PETHREAD Thread;
- NTSTATUS st;
- ULONG LocalPreviousSuspendCount;
- KPROCESSOR_MODE Mode;
- POBJECT_TYPE TempType;
- // PAGED_CODE();
- Mode = KeGetPreviousMode ();
- try {
- if (Mode != KernelMode) {
- if (ARGUMENT_PRESENT (PreviousSuspendCount)) {
- ProbeForWriteUlong (PreviousSuspendCount);
- }
- }
- } except (EXCEPTION_EXECUTE_HANDLER) {
- return GetExceptionCode();
- }
- (ULONG)TempType=*(ULONG*)PsThreadType;
- st = ObReferenceObjectByHandle (ThreadHandle,
- THREAD_SUSPEND_RESUME,
- TempType,
- Mode,
- &Thread,
- NULL);
- if (!NT_SUCCESS (st)) {
- return st;
- }
- st = _PsSuspendThread (Thread, &LocalPreviousSuspendCount);
- ObDereferenceObject (Thread);
- try {
- if (ARGUMENT_PRESENT (PreviousSuspendCount)) {
- *PreviousSuspendCount = LocalPreviousSuspendCount;
- }
- } except (EXCEPTION_EXECUTE_HANDLER) {
- st = GetExceptionCode ();
- }
- return st;
- }
- //////////////////////////////////////////////////////////////////////////
- typedef NTSTATUS(*NTSUSPENDTHREAD)(
- __in HANDLE ThreadHandle,
- __out_opt PULONG PreviousSuspendCount
- );
- NTSUSPENDTHREAD OldSuspendThreadAddr;
- NTSTATUS MyNtSuspendThread(
- __in HANDLE ThreadHandle,
- __out_opt PULONG PreviousSuspendCount
- )
- {
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
- return OldSuspendThreadAddr(ThreadHandle,PreviousSuspendCount);
- }
- return _NtSuspendThread(ThreadHandle,PreviousSuspendCount);
- }
- ULONG Pass_PsSuspendThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- LONG temp=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 254 * 4;
- (ULONG)OldSuspendThreadAddr = *(ULONG*)Address;
- temp=*(LONG*)((LONG)OldSuspendThreadAddr+0x65);
- pssuspendthreadaddr=(LONG)OldSuspendThreadAddr+0x64+temp+5;
- DbgPrint("pssuspendthreadaddr %08x\n",pssuspendthreadaddr);
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)MyNtSuspendThread; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_PsSuspendThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 254 * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldSuspendThreadAddr; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- NTSTATUS
- MyNtGetContextThread(
- __in HANDLE ThreadHandle,
- __inout PCONTEXT ThreadContext
- )
- {
- KPROCESSOR_MODE Mode;
- NTSTATUS Status;
- PETHREAD Thread;
- PKTHREAD CurrentThread;
- POBJECT_TYPE TempType;
- // PAGED_CODE();
- //
- // Get previous mode and reference specified thread.
- //
- CurrentThread = KeGetCurrentThread();
- Mode = *(CCHAR*)((ULONG)CurrentThread+0x140);
- (ULONG)TempType=*(ULONG*)PsThreadType;
- Status = ObReferenceObjectByHandle (ThreadHandle,
- THREAD_GET_CONTEXT,
- TempType,
- Mode,
- &Thread,
- NULL);
- //
- // If the reference was successful, the check if the specified thread
- // is a system thread.
- //
- if (NT_SUCCESS (Status)) {
- //
- // If the thread is not a system thread, then attempt to get the
- // context of the thread.
- //
- if (IS_SYSTEM_THREAD (Thread) == FALSE) {
- Status = PsGetContextThread (Thread, ThreadContext, Mode);
- } else {
- Status = STATUS_INVALID_HANDLE;
- }
- ObDereferenceObject (Thread);
- }
- else
- {
- DbgPrint("%s MyNtGetContextThread ObReferenceObjectByHandle error! ThreadHandle %08x\n",GetProcessNameFromEProc(0),ThreadHandle);
- }
- return Status;
- }
- //////////////////////////////////////////////////////////////////////////
- NTSTATUS
- MyNtSetContextThread(
- __in HANDLE ThreadHandle,
- __in PCONTEXT ThreadContext
- )
- {
- KPROCESSOR_MODE Mode;
- NTSTATUS Status;
- PETHREAD Thread;
- PKTHREAD CurrentThread;
- POBJECT_TYPE TempType;
- // PAGED_CODE();
- //
- // Get previous mode and reference specified thread.
- //
- CurrentThread = KeGetCurrentThread ();
- Mode = *(CCHAR*)((ULONG)CurrentThread+0x140);
- (ULONG)TempType=*(ULONG*)PsThreadType;
- Status = ObReferenceObjectByHandle (ThreadHandle,
- THREAD_SET_CONTEXT,
- TempType,
- Mode,
- &Thread,
- NULL);
- //
- // If the reference was successful, the check if the specified thread
- // is a system thread.
- //
- if (NT_SUCCESS (Status)) {
- //
- // If the thread is not a system thread, then attempt to get the
- // context of the thread.
- //
- if (IS_SYSTEM_THREAD (Thread) == FALSE) {
- Status = PsSetContextThread (Thread, ThreadContext, Mode);
- } else {
- Status = STATUS_INVALID_HANDLE;
- }
- ObDereferenceObject (Thread);
- }
- else
- {
- DbgPrint("MyNtSetContextThread ObReferenceObjectByHandle error\n");
- }
- return Status;
- }
- //////////////////////////////////////////////////////////////////////////
- typedef NTSTATUS (*NTSETCONTEXTTHREAD)
- (
- __in HANDLE ThreadHandle,
- __in PCONTEXT ThreadContext
- );
- NTSETCONTEXTTHREAD OldNtSetContextThreadAddr;
- NTSTATUS NewNtSetContextThread
- (
- __in HANDLE ThreadHandle,
- __in PCONTEXT ThreadContext
- )
- {
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)))
- {
- return OldNtSetContextThreadAddr(ThreadHandle,ThreadContext);
- // DbgPrint("dnf ThreadHandle: %d NtSetContextThread\n",ThreadHandle);
- // return 0;
- }
- // return OldNtSetContextThreadAddr(ThreadHandle,ThreadContext);
- return MyNtSetContextThread(ThreadHandle,ThreadContext);
- }
- ULONG Pass_NtSetContextThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 213 * 4;
- (ULONG)OldNtSetContextThreadAddr = *(ULONG*)Address;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)NewNtSetContextThread; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_NtSetContextThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 213 * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldNtSetContextThreadAddr; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
- //////////////////////////////////////////////////////////////////////////
- typedef NTSTATUS (*NTGETCONTEXTTHREAD)
- (
- __in HANDLE ThreadHandle,
- __inout PCONTEXT ThreadContext
- );
- NTGETCONTEXTTHREAD OldNtGetContextThreadAddr;
- NTSTATUS NewNtGetContextThread
- (
- __in HANDLE ThreadHandle,
- __inout PCONTEXT ThreadContext
- )
- {
- NTSTATUS nTstatus=0;
- if (!_stricmp("DNF.exe",GetProcessNameFromEProc(0)) ||
- !_stricmp("AION.bin",GetProcessNameFromEProc(0)) ||
- !_stricmp("GameMon.des",GetProcessNameFromEProc(0)))
- {
-
- // if (-2==(LONG)ThreadHandle)
- // {
- // return OldNtGetContextThreadAddr(ThreadHandle,ThreadContext);
- // }
- DbgPrint("dnf ThreadHandle: %d NtGetContextThread\n",ThreadHandle);
- nTstatus=OldNtGetContextThreadAddr(ThreadHandle,ThreadContext);
-
- ThreadContext->Dr0=0;
- ThreadContext->Dr1=0;
- ThreadContext->Dr2=0;
- ThreadContext->Dr3=0;
- // ThreadContext->Dr6=0;
- // ThreadContext->Dr7=0;
- // DbgPrint("ThreadHandle:%d\nDr0=%08x\nDr1=%08x\nDr2=%08x\nDr3=%08x\n",ThreadHandle,
- // ThreadContext->Dr0,ThreadContext->Dr1,ThreadContext->Dr2,ThreadContext->Dr3);
- return nTstatus;
-
- }
- //
- // return OldNtGetContextThreadAddr(ThreadHandle,ThreadContext);
- return MyNtGetContextThread(ThreadHandle,ThreadContext);
- }
- ULONG Pass_NtGetContextThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 85 * 4;
- (ULONG)OldNtGetContextThreadAddr = *(ULONG*)Address;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)NewNtGetContextThread; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- return 1;
- }
- VOID UnDetour_NtGetContextThread()
- {
- KIRQL oldIrql;
- ULONG Address=0;
- Address = (ULONG)_KeServiceDescriptorTable->NotUse1.ServiceTableBase + 85 * 4;
- WPOFF();
- oldIrql = KeRaiseIrqlToDpcLevel();
- *((ULONG*)Address) = (ULONG)OldNtGetContextThreadAddr; //HOOK SSDT
- KeLowerIrql(oldIrql);
- WPON();
- }
- //////////////////////////////////////////////////////////////////////////
复制代码 |
|