勾住ZwSetInformationFile和NtOpenProcess

HOOK了ZwSetInformationFile保护c:\\wenbo.txt文件不被删除
HOOK了NtOpenProcess保护PID大于1000的进程不被结束
//头文件源代码  *.h
#pragma once  
#ifdef __cplusplus
extern "C"
{
#endif
#include <ntddk.h>
#ifdef __cplusplus
}
#endif
#define PageCode code_seg("PAGE")
#define InitCode code_seg("INIT")
typedef struct _SYSTEM_SERVICE_TABLE
{
  PVOID   ServiceTableBase;      // SSDT (System Service Dispatch Table)的基地址
  PULONG  ServiceCounterTableBase;  // 用于checked builds, 包含SSDT中每个服务被调用的次数
  ULONG   NumberOfService;      // 服务函数的个数, NumberOfService*4 就是整个地址表的大小
  ULONG   ParamTableBase;        // SSPT (System Service Parameter Table)的基地址
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE; 
typedef struct _SERVICE_DESCRIPTOR_TABLE
{
  SYSTEM_SERVICE_TABLE   ntoskrnl;  // ntoskrnl.exe的服务函数
  SYSTEM_SERVICE_TABLE   win32k;    // win32k.sys的服务函数,(gdi.dll/user.dll的内核支持)
  SYSTEM_SERVICE_TABLE   NotUsed1;
  SYSTEM_SERVICE_TABLE   NotUsed2;
} SYSTEM_DESCRIPTOR_TABLE, *PSYSTEM_DESCRIPTOR_TABLE;
extern "C" extern PSYSTEM_DESCRIPTOR_TABLE  KeServiceDescriptorTable;
// 根据 Zw_function 获取服务ID
#define SERVICE_ID(_function)    (*(PULONG)((PUCHAR)_function + 1))
// 根据 Zw_function 获取 Nt_function的地址
#define SERVICE_FUNCTION(_function) ((ULONG)KeServiceDescriptorTable->ntoskrnl.ServiceTableBase + 4*SERVICE_ID(_function))
/*
lkd> u ZwOpenProcess
nt!ZwOpenProcess:
80501694 b87a000000      mov     eax,7Ah  ---> ZwOpenProcess+1 = ID
*/
// ------------------------------------------------------
void InitServicesTable();
NTSTATUS HookService(ULONG OldService, ULONG NewService);
NTSTATUS UnHookService(ULONG OldService);
void UnLoad(PDRIVER_OBJECT pDriver);
// ------------------------------------------------------
ULONG OldServiceAddressTable[1024];
bool g_Init=false;
//ULONG NewServiceAddressTable[1024];      // 用户自定义的服务函数地址
//cpp源代码

#include "Rootkits.h"
#pragma PageCode
NTSTATUS CreateMyDriver(PDRIVER_OBJECT pDriver)
{
  UNICODE_STRING DriverName;
  PDEVICE_OBJECT pDev;
  NTSTATUS status;
  RtlInitUnicodeString(&DriverName,L"\\Device\\MyDriver");
  status=IoCreateDevice(pDriver,0,&DriverName,FILE_DEVICE_UNKNOWN,0,true,&pDev);
  if (!NT_SUCCESS(status))
  {
    DbgPrint("创建设备失败");
  }
  UNICODE_STRING SymBoliLinkName;
  RtlInitUnicodeString(&SymBoliLinkName,L"\\??\\SymBoliLinkDevice");
  status=IoCreateSymbolicLink(&SymBoliLinkName,&DriverName);
  if (!NT_SUCCESS(status))
  {
    IoDeleteDevice(pDriver->DeviceObject);
    DbgPrint("创建符号连接失败");
  }
  DbgPrint("创建驱动设备和符号连接成功");
  return STATUS_SUCCESS;
}

void InitServicesTable()
{
  g_Init=true;
  for (ULONG i=0;i<KeServiceDescriptorTable->ntoskrnl.NumberOfService;i++)
  {
    OldServiceAddressTable[i] = *(PULONG)((ULONG)KeServiceDescriptorTable->ntoskrnl.ServiceTableBase + 4*i);
    //  KdPrint(("0x%04X : %08X\n", i, OldServiceAddressTable[i]));
  }
}
VOID WPOFF()
{
  __asm
  {      
    cli
      push eax
      mov eax, cr0
      and eax, not 10000H
      mov cr0, eax
      pop eax
  }
}
// 恢复内存写保护
VOID WPON()
{
  __asm
  {
    push eax
      mov eax, cr0
      or  eax,10000H
      mov cr0,eax
      pop eax
      sti
  }
}

NTSTATUS HookService(ULONG OldService, ULONG NewService)
{
  if (!g_Init)
  {
    KdPrint(("ServiceTalbe Not Init.\n"));
  }

  WPOFF();
  KdPrint(("New Service Address: %08X\n", NewService));
  *(PULONG)SERVICE_FUNCTION(OldService)=NewService;
  WPON();
  return STATUS_SUCCESS;
}
NTSTATUS UnHookService(ULONG OldService)
{
  if (!g_Init)
  {
    return STATUS_UNSUCCESSFUL;
  }
  WPOFF();
  *(PULONG)SERVICE_FUNCTION(OldService)=OldServiceAddressTable[SERVICE_ID(OldService)];
  WPON();
  return STATUS_SUCCESS;
}

////////////////////////////////////////////////HOOK /////////////////////////////////////////////////////////////
extern "C" typedef NTSTATUS (__stdcall *ZWSETINFOMATIONFILE)(
  HANDLE  FileHandle,
  PIO_STATUS_BLOCK  IoStatusBlock,
  PVOID  FileInformation,
  ULONG  Length,
  FILE_INFORMATION_CLASS  FileInformationClass
  );
extern "C" typedef NTSTATUS (__stdcall *NTOPENPROCESS) (
  PHANDLE  ProcessHandle,
  ACCESS_MASK  DesiredAccess,
  POBJECT_ATTRIBUTES  ObjectAttributes,
  PCLIENT_ID  ClientId
  );
extern "C" NTSYSAPI NTSTATUS NTAPI ZwOpenProcess(OUT PHANDLE ProcessHandle,
        IN ACCESS_MASK AccessMask,                                           
        IN POBJECT_ATTRIBUTES ObjectAttributes,                                           
        IN PCLIENT_ID ClientId);
extern "C" NTSTATUS  MyZwSetInformationFile(HANDLE  FileHandle,PIO_STATUS_BLOCK  IoStatusBlock,PVOID  FileInformation,ULONG  Length,FILE_INFORMATION_CLASS  FileInformationClass)
{
  PFILE_OBJECT  pFileObject;
  ZWSETINFOMATIONFILE OldZwSetInfomationFile=(ZWSETINFOMATIONFILE)OldServiceAddressTable[SERVICE_ID(ZwSetInformationFile)];
  NTSTATUS ret=ObReferenceObjectByHandle(FileHandle,GENERIC_READ,*IoFileObjectType,KernelMode,(PVOID*)&pFileObject,0);
  if (NT_SUCCESS(ret))
  {
    UNICODE_STRING uDosName;
    ret=IoVolumeDeviceToDosName(pFileObject->DeviceObject,&uDosName);
    if (NT_SUCCESS(ret))
    {  
      if (wcsstr(pFileObject->FileName.Buffer,L"wenbo.txt") && wcsstr(uDosName.Buffer,L"C:"))
      {
        return STATUS_ACCESS_DENIED;
      }
    }
  }
  ObDereferenceObject(pFileObject);
  return OldZwSetInfomationFile(FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass);
}
extern "C" NTSTATUS MyNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
{
//  __asm int 3;
  ULONG PID;
  NTOPENPROCESS OldNtOpenProcess=(NTOPENPROCESS)OldServiceAddressTable[SERVICE_ID(ZwOpenProcess)];
//  DbgPrint("NtOpenProcess地址是%x",OldNtOpenProcess);
  if (ClientId!=NULL)
  {
    PID=(ULONG)(ClientId->UniqueProcess);
    if (PID>1000)
    {
      return STATUS_ACCESS_DENIED;
    }
  }
  return OldNtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId);
}
/////////////////////////////////////////////////////////////////////////////////////////////////////////////
void UnLoad(PDRIVER_OBJECT pDriver)
{
  PDEVICE_OBJECT pDev;
  pDev=pDriver->DeviceObject;
  IoDeleteDevice(pDev);
  UNICODE_STRING SymBoliLinkName;
  RtlInitUnicodeString(&SymBoliLinkName,L"\\??\\SymBoliLinkDevice");
  IoDeleteSymbolicLink(&SymBoliLinkName);
  DbgPrint("删除设备和符号连接成功");
  UnHookService((ULONG)ZwSetInformationFile);
  UnHookService((ULONG)NtOpenProcess);
}
#pragma PageCode
#pragma InitCode
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver,PUNICODE_STRING p)
{
  CreateMyDriver(pDriver);
  pDriver->DriverUnload=UnLoad;
  InitServicesTable();
  HookService((ULONG)ZwSetInformationFile,(ULONG)MyZwSetInformationFile);
  HookService((ULONG)ZwOpenProcess,(ULONG)MyNtOpenProcess);
  return STATUS_SUCCESS;
}

在VM XP虚拟机下测试成功.....