用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数
用DDDK编写驱动,修改SSDT表HOOK NTDebugActiveProcess函数
代码如下
代码:
unit driver;
interface
uses DDDK;
function _DriverEntry(DriverObject: PDriverObject; RegistryPath:
PUnicodeString): NTSTATUS; stdcall;
var
POldDebugActiveProcess: PLong; //保存NTDebugActiveProcess函数在SSDT表中的指针。
OldDebugActiveProcessAdd : PLong; //保存原来的NTDebugActiveProcess函数的地址。
implementation
function MyDebugActiveProcess(PID:ULong):Boolean;stdcall; //Hook函数
begin
Result := False;
end;
procedure DriverUnload(DriverObject: PDriverObject); stdcall;
begin
asm //关中断
cli
mov eax,cr0
and eax,not $10000
mov cr0,eax
end;
POldDebugActiveProcess^ := ULong(OldDebugActiveProcessAdd); //恢复SSDT
asm //开中断
mov eax,cr0
or eax,$10000
mov cr0,eax
sti
end;
//DbgPrint('DriverUnload(DriverObject:0x%.8X)',[DriverObject]);
//DbgPrint('DriverUnload(-)',[]);
end;
function _DriverEntry(DriverObject: PDriverObject; RegistryPath:
PUnicodeString): NTSTATUS; stdcall;
begin
DriverObject^.DriverUnload := @DriverUnload;
POldDebugActiveProcess := Pointer(ULONG(KeServiceDescriptorTable.ServiceTableBase) + $39
* 4); //$39为NTDebugActiveProcess在XP SP2中的服务号，可由IceSword查出。
OldDebugActiveProcessAdd := Pointer(POldDebugActiveProcess^);//保存原来的NTDebugActiveProcess函数地址，以备驱动卸载时候恢复。
asm //关中断
cli
mov eax,cr0
and eax,not $10000
mov cr0,eax
end;
POldDebugActiveProcess^ := ULong(@MyDebugActiveProcess);//修改SSDT表，将服务号为$39的函数改为自己的钩子函数地址，以实现HOOK。
asm //开中断
mov eax,cr0
or eax,$10000
mov cr0,eax
sti
end;
Result := STATUS_SUCCESS;
end;
end.DDDK可以在盒子 http://www.2ccc.com/article.asp?articleid=3681 下载得到.
