Shadow SSDT

A、Shadow SSDT表基址定位

B、Shadow SSDT表结构

C、Shadow SSDT HOOK

KeServiceDescriptorTable //系统描述符表 extern

KeServiceDescriptorTableShadow //影子系统描述符表 win32k.sys

bp win32k!NtUserPostMessage

bp win32k!NtUserShowWindow

bp win32k!NtUserFindWindow

bp win32k!NtUserDestroyWindow

bp win32k!NtUserPostMessage

Shadow SSDT表基址定位

系统只提供了KeServiceDescriptorTable导出

KeServiceDescriptorTableShadow是个未导出结构

dd poi(KeServiceDescriptorTable-0x40+0x10) //XP

RtlGetVersion

PsGetVersion

Windows 2000: dwMajorVersion = 5 dwMinorVersion = 0

Windows XP: dwMajorVersion = 5 dwMinorVersion = 1

Windows 2003: dwMajorVersion = 5 dwMinorVersion = 1

Windows Vista: dwMajorVersion = 6

Operating system	Version number	dwMajorVersion	dwMinorVersion	Other
Windows 7	6.1	6	1	OSVERSIONINFOEX.wProductType == VER_NT_WORKSTATION
Windows Server 2008 R2	6.1	6	1	OSVERSIONINFOEX.wProductType != VER_NT_WORKSTATION
Windows Server 2008	6.0	6	0	OSVERSIONINFOEX.wProductType != VER_NT_WORKSTATION
Windows Vista	6.0	6	0	OSVERSIONINFOEX.wProductType == VER_NT_WORKSTATION
Windows Server 2003 R2	5.2	5	2	GetSystemMetrics(SM_SERVERR2) != 0
Windows Home Server	5.2	5	2	OSVERSIONINFOEX.wSuiteMask & VER_SUITE_WH_SERVER
Windows Server 2003	5.2	5	2	GetSystemMetrics(SM_SERVERR2) == 0
Windows XP Professional x64 Edition	5.2	5	2	(OSVERSIONINFOEX.wProductType == VER_NT_WORKSTATION) && (SYSTEM_INFO.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_AMD64)
Windows XP	5.1	5	1	Not applicable
Windows 2000	5.0	5	0	Not applicable

DWORD Get_KeServiceDescriptorTableShadow_Addr()

{ DWORD KeServiceDescriptorTableShadow=0;

DWORD Version=GetVersion();

switch (Version )

{

case VERSION_2K:

KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable+0xE0;

break;

case VERSION_2K3:

break;

case VERSION_XP:

KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable-0x40;

break;

default:

break;

}

return KeServiceDescriptorTableShadow;

}

dd poi(KeServiceDescriptorTableShadow+10) ///SSDT Shadow Base

NtUserDestroyWindow //ZwTerminateProcess

NtUserFindWindowEx

NtUserSetWindowLong

NtUserPostMessage

NtUserGetForegroundWindow

#define VERSION_2K 50

#define VERSION_XP 51

#define VERSION_2K3 52

#define VERSION_XP64 52

#define VERSION_2K3_R2 52

#define VERSION_VISTA 60

#define VERSION_SERVER2008 60

#define VERSION_WIN7 61

#define VERSION_SERVER2008_R2 61

#pragma PAGECODE

DWORD GetVersion()

{ ULONG rtn=0;

ULONG MajorVersion,MinorVersion,BuildNumber;

PsGetVersion(&MajorVersion,&MinorVersion,&BuildNumber,NULL);

rtn=MajorVersion;

rtn=rtn *10;

rtn+=MinorVersion;

return rtn;

}

#pragma PAGECODE

DWORD Get_KeServiceDescriptorTableShadow_Addr()

{ DWORD KeServiceDescriptorTableShadow=0;

DWORD Version=GetVersion();

switch (Version )

{

case VERSION_2K:

KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable+0xE0;

break;

case VERSION_2K3:

break;

case VERSION_XP:

KeServiceDescriptorTableShadow=(DWORD)KeServiceDescriptorTable-0x40;

break;

default:

break;

}

return KeServiceDescriptorTableShadow;

}

#pragma PAGECODE

VOID Show_SSDTShadowList()

{

KdPrint(("Entry Show_SSDTShadowList \n"));

DWORD TableBase=Get_KeServiceDescriptorTableShadow_Addr();

TableBase=TableBase+0x10;

DWORD TableCount=TableBase+8;

DWORD count=*((PDWORD)TableCount);

KdPrint(("SSDT_Shadow Base=%x Count=%x\n",TableBase,count));

//__asm int 3

PDWORD CFun_Addr=PDWORD(TableBase);

CFun_Addr=PDWORD(*CFun_Addr);

for (DWORD i=0;i<count;i++)

{

KdPrint(("\n %d=%x\n",i,*CFun_Addr ));

CFun_Addr++;

//__asm int 3

}

HWND myh;

typedef BOOL (__stdcall *PNtUserDestroyWindow)(HWND hwnd);

PNtUserDestroyWindow Old_NtUserDestroyWindow,Cur_NtUserDestroyWindow;

#pragma PAGECODE

BOOL __stdcall My_NtUserDestroyWindow(HWND h)

{

KdPrint(("h=%x \n",h));

if (h==myh)

{

KdPrint(("被保护窗口h=%x \n",h));

return FALSE;

}else return Old_NtUserDestroyWindow(h);

}

#pragma PAGECODE

VOID SSDT_HOOK_NtUserDestroyWindow() //355

{ KdPrint(("Entry Show_SSDTShadowList \n"));

DWORD TableBase=Get_KeServiceDescriptorTableShadow_Addr();

TableBase=TableBase+0x10;

DWORD TableCount=TableBase+8;

DWORD count=*((PDWORD)TableCount);

KdPrint(("SSDT_Shadow Base=%x Count=%x\n",TableBase,count));

//__asm int 3

PDWORD CFun_Addr=PDWORD(TableBase);

CFun_Addr=PDWORD(*CFun_Addr);

CFun_Addr+=355;

Old_NtUserDestroyWindow=(PNtUserDestroyWindow)(*CFun_Addr);

KdPrint(("\n NtUserDestroyWindow当前地址=%x,%x \n",CFun_Addr,*CFun_Addr));

__asm //去掉页面保护

{

cli

mov eax,cr0

and eax,not 10000h //and eax,0FFFEFFFFh

mov cr0,eax

}

*CFun_Addr=(DWORD)(&My_NtUserDestroyWindow);

KdPrint(("\n NtUserDestroyWindow HOOK后地址=%x,%x \n",CFun_Addr,*CFun_Addr));

__asm

{

mov eax, cr0

or eax, 10000h

mov cr0, eax

sti

}

#pragma PAGECODE

VOID SSDT_UNHOOK_NtUserDestroyWindow() //335

{

KdPrint(("Entry Show_SSDTShadowList \n"));

DWORD TableBase=Get_KeServiceDescriptorTableShadow_Addr();

TableBase=TableBase+0x10;

DWORD TableCount=TableBase+8;

DWORD count=*((PDWORD)TableCount);

KdPrint(("SSDT_Shadow Base=%x Count=%x\n",TableBase,count));

//__asm int 3

PDWORD CFun_Addr=PDWORD(TableBase);

CFun_Addr=PDWORD(*CFun_Addr);

CFun_Addr+=355;

*CFun_Addr=(DWORD)(Old_NtUserDestroyWindow);

Shadow SSDT相关推荐

Windows内核新手上路2——挂钩shadow SSDT
Windows内核新手上路2--挂钩shadow SSDT 文章核心内容:安全软件窗口保护.安全输入.截屏保护的一些思路.挂钩NtUserFindWindowEx.NtUserGetForegroun ...
Win64 驱动内核编程-22.SHADOW SSDT HOOK（宋孖健）
SHADOW SSDT HOOK HOOK 和 UNHOOK SHADOW SSDT 跟之前的 HOOK/UNHOOK SSDT 类似,区别是查找SSSDT的特征码,以及根据索引计算函数地址的公式,还 ...
shadow ssdt学习笔记
1.取得shadow ssdt真实地址系统只提供了KeServiceDescriptorTable导出 KeServiceDescriptorTableShadow是个未导出结构定义 Copy c ...
在windbg中测试shadow ssdt , win32k!NtUserGetForegroundWindow , hook shadow ssdt
在windbg中查看shadow ssdt: 0: kd> lm start end module name 804d8000 806e3000 nt ( ...
关于Win7 x64 Shadow SSDT 的探索和 Inline HOOK
http://bbs.pediy.com/thread-210481.htm 来看雪一年了,在这里面学到了很多知识,非常感谢各位前辈对知识的分享和不懈的研究,也非常感谢各位大神对我们这些小白的照顾,特 ...
驱动开发：恢复SSDT内核钩子
SSDT 中文名称为系统服务描述符表,该表的作用是将Ring3应用层与Ring0内核层,两者的API函数连接起来,起到承上启下的作用,SSDT并不仅仅只包含一个庞大的地址索引表,它还包含着一些其它有用 ...
X86驱动：恢复SSDT内核钩子
SSDT 中文名称为系统服务描述符表,该表的作用是将Ring3应用层与Ring0内核层,两者的API函数连接起来,起到承上启下的作用,SSDT并不仅仅只包含一个庞大的地址索引表,它还包含着一些其它有用 ...
win 64 SSDT HOOK
以下内容参考黑客防线2012合订本第294页其实没什么好说的,直接上代码: ssdt的结构,和win32差不多,但是要注意这里的指针类型不能用ULONG替代,如果要非要替代应该用ULONGLONG, ...
Win64 驱动内核编程-23.Ring0 InLineHook 和UnHook
Ring0 InLineHook 和UnHook 如果是要在R0里hook,作者的建议是InLine HOOK,毕竟SSDT HOOK 和 SHADOW SSDT HOOK比较麻烦,不好修改.目前R3 ...
windows 内核情景分析
原文很长:先转部分过来,有时间看一下: 一 windows 内核情景分析---说明说明本文结合<Windows内核情景分析>(毛德操著).<软件调试>(张银奎著).< ...

Shadow SSDT

Shadow SSDT相关推荐

最新文章

热门文章