SSDT的例子1-inlineHook的jmp验证

前言

SSDT Hook后, 如果要跳过函数开始的一些opcode, 就只能跳到没有call语句之前的代码.
因为call有重定位问题，即使opcode一样，call的实际地址也是不同的.

试验记录

#include <Ntddk.h>
#include <stdlib.h>
#include <stdio.h>

typedef char CHAR;
typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef unsigned int size_t;
typedef unsigned long DWORD;

#define MAXBYTE 0xff
#define MAKEDWORD(L, H) (((WORD)((DWORD_PTR)(L) & 0xffff)) | ((DWORD)((WORD)((DWORD_PTR)(H) & 0xffff))) << 16)

#pragma pack(push)
#pragma pack(1)

typedef struct _SYSTEM_SERVICE_TABLE {
    PVOID   ServiceTableBase;        //这个指向系统服务函数地址表
    PULONG  ServiceCounterTableBase;
    ULONG   NumberOfService;         //服务函数的个数,NumberOfService*4 就是整个地址表的大小
    ULONG   ParamTableBase;
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;

typedef struct _SERVICE_DESCRIPTOR_TABLE {
    SYSTEM_SERVICE_TABLE   ntoskrnel;  //ntoskrnl.exe的服务函数
    SYSTEM_SERVICE_TABLE   win32k;     //win32k.sys的服务函数,(gdi.dll/user.dll的内核支持)
    SYSTEM_SERVICE_TABLE   NotUsed1;
    SYSTEM_SERVICE_TABLE   NotUsed2;
} SYSTEM_DESCRIPTOR_TABLE, *PSYSTEM_DESCRIPTOR_TABLE;

#pragma pack(pop)

extern PSYSTEM_DESCRIPTOR_TABLE KeServiceDescriptorTable;
SYSTEM_SERVICE_TABLE* g_pSST = NULL;

// typedef NTSTATUS (__stdcall *PFN_ZwOpenProcess)(
//               __out PHANDLE  ProcessHandle,
//               __in ACCESS_MASK  DesiredAccess,
//               __in POBJECT_ATTRIBUTES  ObjectAttributes,
//               __in_opt PCLIENT_ID  ClientId
//               );

// PFN_ZwOpenProcess g_pfn = NULL;

DWORD g_dwSsdtFunIndexAddr_NtOpenProcess = 0;
DWORD g_dwPfnNtOpenProcessOrg = 0;

// naked 函数内不能初始化变量
// 在裸函数内使用的变量必须在函数外定义
DWORD g_dwAddrJmp_MyNtOpenProcess = 0x805c22a0;
__declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle,
                                                     ACCESS_MASK DesiredAccess,
                                                     POBJECT_ATTRIBUTES ObjectAttributes,
                                                     PCLIENT_ID ClientId)
{
    /**
    kd> u 805C2296
    nt!NtOpenProcess:
    805c2296 68c4000000      push    0C4h
    805c229b 68a8aa4d80      push    offset nt!ObWatchHandles+0x25c (804daaa8)
    // 用 __asm + _emit, 在InlineHook函数后，可以跳到任意地址
    // 但是call指令有重定位问题, 如果不修正, 只能在call之前打住

    // 跳到这
    805c22a0 e86b6cf7ff      call    nt!_SEH_prolog (80538f10)

    805c22a5 33f6            xor     esi,esi
    805c22a7 8975d4          mov     dword ptr [ebp-2Ch],esi
    805c22aa 33c0            xor     eax,eax
    805c22ac 8d7dd8          lea     edi,[ebp-28h]
    805c22af ab              stos    dword ptr es:[edi]
    */
    __asm {
        // 这里可以用int 3来调试
        // int 3 

        // 68c4000000
        // 805c2296 68c4000000      push    0C4h

        _emit 0x68
        _emit 0xc4
        _emit 0x00
        _emit 0x00
        _emit 0x00

        // 68a8aa4d80
        // 805c229b 68a8aa4d80      push    offset nt!ObWatchHandles+0x25c (804daaa8)
        _emit 0x68
        _emit 0xa8
        _emit 0xaa
        _emit 0x4d
        _emit 0x80

        // e86b6cf7ff
        // 805c22a0 e86b6cf7ff      call    nt!_SEH_prolog (80538f10)
        // f8dc841a e86b6cf7ff      call    f8d3f08a
        // call 指令涉及到重定位了, opcode一模一样也不是相同的反汇编指令
        // 怪不得人家只跳过前10个字节
//         _emit 0xe8
//         _emit 0x6b
//         _emit 0x6c
//         _emit 0xf7
//         _emit 0xff

        pushf
        pusha
    }
    // do my hook task
    // 调用 KdPrint 可以正常打印
    KdPrint(("MyNtOpenProcess\r\n"));
    __asm {
        popa
        popf

        jmp g_dwAddrJmp_MyNtOpenProcess
    }
    // return STATUS_SUCCESS;
    // return 0;
}

void fnHook_SSDT()
{
    DWORD dwAddr = 0;

    do {
        if (NULL == KeServiceDescriptorTable) {
            break;
        }

        g_pSST = &KeServiceDescriptorTable->ntoskrnel;

        if (NULL == g_pSST) {
            break;
        }

        KdPrint(("g_pSST = %p\r\n", g_pSST));

        if (NULL == g_pSST->ServiceTableBase) {
            break;
        }

        KdPrint(("g_pSST->ServiceTableBase = %p\r\n", g_pSST->ServiceTableBase));
        // 0x7a is OpenProcess Index On SSDT
        dwAddr = (DWORD)g_pSST->ServiceTableBase + 0x7a * sizeof(DWORD);

        if (0 == dwAddr) {
            break;
        }

        // 要换的就是g_dwSsdtFunIndexAddr_NtOpenProcess地址中的内容
        g_dwSsdtFunIndexAddr_NtOpenProcess = dwAddr;
        KdPrint(("g_dwSsdtFunIndexAddr_NtOpenProcess = %p\r\n", g_dwSsdtFunIndexAddr_NtOpenProcess));
        g_dwPfnNtOpenProcessOrg = *((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess));
        KdPrint(("g_dwPfnNtOpenProcessOrg = %p\r\n", g_dwPfnNtOpenProcessOrg));
        /**
        >> DriverEntry
        g_pSST = 80553FA0
        g_pSST->ServiceTableBase = 80502B8C
        g_dwSsdtFunIndexAddr_NtOpenProcess = 80502D74
        g_dwPfnNtOpenProcessOrg = 805C2296

        kd> u 805C2296
        nt!NtOpenProcess:
        805c2296 68c4000000      push    0C4h
        805c229b 68a8aa4d80      push    offset nt!ObWatchHandles+0x25c (804daaa8)
        805c22a0 e86b6cf7ff      call    nt!_SEH_prolog (80538f10)
        805c22a5 33f6            xor     esi,esi
        805c22a7 8975d4          mov     dword ptr [ebp-2Ch],esi
        805c22aa 33c0            xor     eax,eax
        805c22ac 8d7dd8          lea     edi,[ebp-28h]
        805c22af ab              stos    dword ptr es:[edi]
        */
        __asm { //去掉内存保护
            cli
            mov  eax, cr0
            and  eax, not 10000h
            mov  cr0, eax
        }
        *((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess)) = (DWORD)MyNtOpenProcess;
        __asm { //恢复内存保护
            mov  eax, cr0
            or   eax, 10000h
            mov  cr0, eax
            sti
        }
        KdPrint(("Hook By MyNtOpenProcess = %p\r\n", MyNtOpenProcess));
    } while (0);
}

void fnUnHook_SSDT()
{
    __asm { //去掉内存保护
        cli
        mov  eax, cr0
        and  eax, not 10000h
        mov  cr0, eax
    }
    *((DWORD*)(g_dwSsdtFunIndexAddr_NtOpenProcess)) = (DWORD)g_dwPfnNtOpenProcessOrg;
    __asm { //恢复内存保护
        mov  eax, cr0
        or   eax, 10000h
        mov  cr0, eax
        sti
    }
    KdPrint(("UnHook By g_dwPfnNtOpenProcessOrg = %p\r\n", g_dwPfnNtOpenProcessOrg));
}

VOID fnDrvUnLoad(__in struct _DRIVER_OBJECT* DriverObject)
{
    KdPrint((">> fnDrvUnLoad"));
    fnUnHook_SSDT();
}

NTSTATUS fnDrvDisPatch(__in struct _DEVICE_OBJECT* DeviceObject, __inout struct _IRP* Irp)
{
    KdPrint((">> fnDrvDisPatch"));
    return STATUS_SUCCESS;
}

NTSTATUS DriverEntry(__in struct _DRIVER_OBJECT*  DriverObject, __in PUNICODE_STRING  RegistryPath)
{
    KdPrint((">> DriverEntry"));
    DriverObject->DriverUnload = fnDrvUnLoad;
    DriverObject->MajorFunction[IRP_MJ_CREATE] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_CREATE_NAMED_PIPE] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_READ] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_WRITE] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_QUERY_INFORMATION] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_QUERY_EA] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SET_EA] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_FLUSH_BUFFERS] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SET_VOLUME_INFORMATION] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SHUTDOWN] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_LOCK_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_CLEANUP] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_CREATE_MAILSLOT] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_QUERY_SECURITY] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SET_SECURITY] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_POWER] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SYSTEM_CONTROL] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CHANGE] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_QUERY_QUOTA] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_SET_QUOTA] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_PNP] = fnDrvDisPatch;
    DriverObject->MajorFunction[IRP_MJ_MAXIMUM_FUNCTION] = fnDrvDisPatch;
    fnHook_SSDT();
    return STATUS_SUCCESS;
}