另类拦截加载驱动实现方法
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath)
{
UNICODE_STRING DeviceNameUnicodeString,LinkNameUnicodeString;
NTSTATUS Status;
PDEVICE_OBJECT DeviceObject;
int i;
HANDLE ThreadHandle;
RtlInitUnicodeString(&DeviceNameUnicodeString, DeviceName);
Status = IoCreateDevice(DriverObject,
0,
&DeviceNameUnicodeString,
FILE_DEVICE_UNKNOWN,
0,
TRUE,
&DeviceObject);
if (NT_SUCCESS(Status))
{
for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
{
DriverObject->MajorFunction[i] = DriverDispatch;
}
DriverObject->DriverUnload = DriverUnload;
RtlInitUnicodeString(&LinkNameUnicodeString , LinkerName);
Status = IoCreateSymbolicLink(&LinkNameUnicodeString, &DeviceNameUnicodeString);
if (NT_SUCCESS(Status))
{
//回溯EntryCall地址,下面代码只适合XP
__asm
{
push ecx
mov ecx,ebp
mov ecx,dword ptr ds:[ecx+0x4]
sub ecx,0x3
mov EntryCall,ecx
add ecx,0x5
mov EntryRetn,ecx
pop ecx
}
DbgPrint("EntryCall :%08X" , EntryCall);
Status = PsCreateSystemThread(&ThreadHandle,
THREAD_ALL_ACCESS,
NULL,
NULL,
NULL,
HookThread,
NULL);
if (NT_SUCCESS(Status))
{
ZwClose(ThreadHandle);
}
else
{
IoDeleteSymbolicLink(&LinkNameUnicodeString);
IoDeleteDevice(DeviceObject);
DbgPrint("CreateSystemThread failed");
}
}
else
{
IoDeleteDevice(DeviceObject);
DbgPrint("CreateSymbolicLink failed");
}
}
return Status;
}
VOID HookThread(PVOID Context)
{
LARGE_INTEGER lDelay;
KeSetBasePriorityThread(KeGetCurrentThread(), LOW_REALTIME_PRIORITY);
lDelay = RtlConvertLongToLargeInteger(-10000 * 1000);
KeDelayExecutionThread(KernelMode, FALSE, &lDelay);
OnHook();
PsTerminateSystemThread(STATUS_SUCCESS);
}
VOID OnHook(VOID)
{
KIRQL Irql;
if (EntryCall)
{
memcpy(&OriginalBytes ,EntryCall , sizeof(OriginalBytes));
*(ULONG *)(JmpAdderss+1)=(ULONG)HookPatch - (ULONG)EntryCall - sizeof(JmpAdderss);
DisableWriteProtect();
Irql = KeRaiseIrqlToDpcLevel();
memcpy(EntryCall, &JmpAdderss , sizeof(JmpAdderss));
KeLowerIrql(Irql);
EnableWriteProtect();
}
}
VOID UnHook(VOID)
{
KIRQL Irql;
if (EntryCall)
{
DisableWriteProtect();
Irql = KeRaiseIrqlToDpcLevel();
memcpy(EntryCall ,&OriginalBytes , sizeof(OriginalBytes));
KeLowerIrql(Irql);
EnableWriteProtect();
}
}
VOID __declspec(naked) HookPatch(VOID)
{
__asm
{
pushad
pushfd
push dword ptr ss:[esp+0x28] //RegistryString
push dword ptr ss:[esp+0x28] //DriverObject
call FakeEntry
test eax,eax
jz TAG1
popfd
popad
mov eax,0xC0000001
add esp,8
jmp TAG2
TAG1:
popfd
popad
call dword ptr ds:[edi+0x2c] //只合适XP
TAG2:
cmp eax,ebx
push EntryRetn
retn
}
}
VOID DisableWriteProtect(VOID)
{
__asm
{
push eax
mov eax,cr0
mov OldAttr,eax
and eax,0FFFEFFFFh
mov cr0,eax
pop eax
}
}
VOID EnableWriteProtect(VOID)
{
__asm
{
push eax
mov eax,OldAttr
mov cr0,eax
pop eax
}
}
NTSTATUS FakeEntry(IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath)
{
PLDR_DATA_TABLE_ENTRY PLDTE = DriverObject->DriverSection;
DbgPrint("BaseAddr: %08X" , PLDTE->DllBase);
DbgPrint("FullName: %ws" , PLDTE->FullDllName.Buffer);
DbgPrint("BaseName: %ws" , PLDTE->BaseDllName.Buffer);
return STATUS_SUCCESS;
}
