[原创]暑假浅谈系列第二帖——win7 object hook

搬砖王

技术分享 1月前 4 浏览

[原创]暑假浅谈系列第二帖——win7 object hook

要知道,在win7以前object 是需要自定义宏来 hook的,还需要硬编码.但是到了win7以后发生了很大的变化
有一个小错误导致蓝屏现在我改一下;

NTKERNELAPI

PVOID

NTAPI

ObGetObjectType(

				IN PVOID pObject

				);

①.我们先看 xp 的 Object_header;

kd> dt _object_header

nt!_OBJECT_HEADER

   +0x000 PointerCount     : Int4B

   +0x004 HandleCount      : Int4B

   +0x004 NextToFree       : Ptr32 Void

   +0x008 Type             : Ptr32 _OBJECT_TYPE 这个：

   +0x00c NameInfoOffset   : UChar

   +0x00d HandleInfoOffset : UChar

   +0x00e QuotaInfoOffset  : UChar

   +0x00f Flags            : UChar

   +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION

   +0x010 QuotaBlockCharged : Ptr32 Void

   +0x014 SecurityDescriptor : Ptr32 Void

   +0x018 Body             : _QUAD

接着在看win7下的

kd> dt _object_header

nt!_OBJECT_HEADER

   +0x000 PointerCount     : Int4B

   +0x004 HandleCount      : Int4B

   +0x004 NextToFree       : Ptr32 Void

   +0x008 Lock             : _EX_PUSH_LOCK 这个没了变成这个了

   +0x00c TypeIndex        : UChar

   +0x00d TraceFlags       : UChar

   +0x00e InfoMask         : UChar

   +0x00f Flags            : UChar

   +0x010 ObjectCreateInfo : Ptr32 _OBJECT_CREATE_INFORMATION

   +0x010 QuotaBlockCharged : Ptr32 Void

   +0x014 SecurityDescriptor : Ptr32 Void

   +0x018 Body             : _QUAD

那win7的对象去哪里了？
带着这个问题,我们先看微软给的这个函数 ObGetObjectType

kd> u ObGetObjectType

nt!ObGetObjectType:

8406987b 8bff            mov     edi,edi

8406987d 55              push    ebp

8406987e 8bec            mov     ebp,esp

84069880 8b4508          mov     eax,dword ptr [ebp+8]

84069883 0fb640f4        movzx   eax,byte ptr [eax-0Ch][COLOR="red"]②[/COLOR]

84069887 8b04858045f583  mov     eax,dword ptr nt!ObTypeIndexTable (83f54580)[eax*4]

8406988e 5d              pop     ebp

8406988f c20400          ret     4

可以看到movzx eax,byte ptr [eax-0Ch]

②你懂得.

然后我们可以试验一下.
在 xp 下的结构

typedef struct _OBJECT_TYPE { 

	ERESOURCE Mutex; 

	LIST_ENTRY TypeList; 

	UNICODE_STRING Name; 

	PVOID DefaultObject; 

	ULONG Index; 

	ULONG TotalNumberOfObjects; 

	ULONG TotalNumberOfHandles; 

	ULONG HighWaterNumberOfObjects; 

	ULONG HighWaterNumberOfHandles; 

	OBJECT_TYPE_INITIALIZER TypeInfo;

在win7下的

typedef struct _OBJECT_TYPE { 

	LIST_ENTRY TypeList; 

	UNICODE_STRING Name; 

	PVOID DefaultObject; 

	ULONG Index; 

	ULONG TotalNumberOfObjects; 

	ULONG TotalNumberOfHandles; 

	ULONG HighWaterNumberOfObjects; 

	ULONG HighWaterNumberOfHandles; 

	OBJECT_TYPE_INITIALIZER TypeInfo;

	ULONG  TypeLock;

	ULONG   Key;

	LIST_ENTRY   CallbackList; 

} OBJECT_TYPE, *POBJECT_TYPE;

很明显多了一些东西

先卖一个关子,以后在说.

接着 OBJECT_TYPE_INITIALIZER 也是发生了不同 win7.

typedef struct _OBJECT_TYPE_INITIALIZER {

	    USHORT Length  ;

		ULONG ObjectTypeFlags ;

		ULONG CaseInsensitive  ;

		ULONG UnnamedObjectsOnly ;

		ULONG  UseDefaultObject ;

		BOOLEAN  SecurityRequired ;

		BOOLEAN MaintainHandleCount ;

		BOOLEAN MaintainTypeList ; 

		ULONG SupportsObjectCallbacks ;

		ULONG CacheAligned     ;

		ULONG ObjectTypeCode   ;

		ULONG InvalidAttributes ;

		GENERIC_MAPPING GenericMapping   ; 

		ULONG   ValidAccessMask  ;

		ULONG   RetainAccess    ;

		POOL_TYPE PoolType        ; 

		ULONG DefaultPagedPoolCharge ;

		ULONG DefaultNonPagedPoolCharge ;

		PVOID DumpProcedure   ;

		PVOID OpenProcedure    ;

		PVOID CloseProcedure  ;

		PVOID DeleteProcedure ;

		PVOID ParseProcedure  ;

		PVOID SecurityProcedure;

		PVOID QueryNameProcedure;

		PVOID OkayToCloseProcedure ;

} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

明显比xp多了很多.
群:Super-Rootkis 121157016 欢迎大家来玩,进来主要公告.