[原创]win7 x64 下的Object Hook
x86下Object Hook很简单，后来到了x64,发现Hook蓝屏,于是自己动手研究了下,发现PspProcessOpen是下是mov rcx,qword ptr [rsp+28h]得出至少9个参数
于是开始敲代码呗，不知道的全部用int64替换掉,重要的几个参数通过逆向得到了,
直接上码吧 不需要过PG
上个图
#include "ntddk.h"
typedef NTSTATUS (*PSPPROCESSOPEN)(unsigned __int64 arg1,unsigned __int64 arg2,IN PEPROCESS Process OPTIONAL,IN PVOID Object,unsigned __int64 arg5,
unsigned __int64 arg6,unsigned __int64 arg7,unsigned __int64 arg8,unsigned __int64 arg9);
//g
ULONG IsHook = 1;
ULONGLONG oldOpenProcedure;
NTSTATUS MyOpenProcedure(unsigned __int64 arg1,unsigned __int64 arg2,IN PEPROCESS Process OPTIONAL,IN PVOID Object,unsigned __int64 arg5,
unsigned __int64 arg6,unsigned __int64 arg7,unsigned __int64 arg8,unsigned __int64 arg9)
{
if(strstr((char*)Object+0x2e0,"calc.exe")!=0)
{
if(strstr((char*)Process+0x2e0,"explorer.exe")!=0)//过滤explorer.exe
{
return ((PSPPROCESSOPEN)oldOpenProcedure)(arg1,arg2,Process,Object,arg5,arg6,arg7,arg8,arg9);
}
KdPrint(("%s OpenProcess %s",(char*)Process+0x2e0,(char*)Object+0x2e0));//不是2d8 ???;
return STATUS_UNSUCCESSFUL;
}
return ((PSPPROCESSOPEN)oldOpenProcedure)(arg1,arg2,Process,Object,arg5,arg6,arg7,arg8,arg9);
}
void SetObjectHook()
{
oldOpenProcedure = *(ULONGLONG*)((ULONGLONG)*PsProcessType+0x78);
if(oldOpenProcedure ==0)
{
KdPrint(("OpenProcedure is NULL;"));
IsHook =0;
return;//如果是NULL 说明系统没有这个回调 返回;
}
*(ULONGLONG*)((ULONGLONG)*PsProcessType+0x78) = (ULONGLONG)MyOpenProcedure;
}
void ResObjectHook()
{
if(IsHook==1)
{
*(ULONGLONG*)((ULONGLONG)*PsProcessType+0x78) = oldOpenProcedure;
}
}
void DriverUnload(PDRIVER_OBJECT pDriverObject)
{
ResObjectHook();
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pUnicodeString)
{
SetObjectHook();
pDriverObject->DriverUnload = DriverUnload;
return STATUS_SUCCESS;
}
