#pragma once
#include <ntddk.h>

NTSYSAPI
NTSTATUS
NTAPI
NtCreateSection(OUT PHANDLE SectionHandle,
        IN ACCESS_MASK DesiredAccess,
        IN POBJECT_ATTRIBUTES ObjectAttributes,
        IN PLARGE_INTEGER SectionSize OPTIONAL,
        IN ULONG Protect,
        IN ULONG Attributes,
        IN HANDLE FileHandle);

NTSTATUS
DetourNtCreateSection(OUT PHANDLE SectionHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN PLARGE_INTEGER SectionSize OPTIONAL,
            IN ULONG Protect,
            IN ULONG Attributes,
            IN HANDLE FileHandle);

VOID
TrueCellUnload(IN PDRIVER_OBJECT DriverObject);

BOOLEAN
HookFunc(BOOLEAN IsHook);

NTSTATUS
DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath);

NTSTATUS
IoQueryFileDosDeviceName(IN PFILE_OBJECT  FileObject,
            OUT POBJECT_NAME_INFORMATION  *ObjectNameInformation );

#include "Ncs.h"
#include "hde32.h"

#pragma comment(lib, "hde32.lib")

UCHAR OriFuncHead[12]={0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90};//假设目标函数头部有12个字节
UCHAR NewFuncHead[5]={0xE9,0x00,0x00,0x00,0x00};//jmp [相对偏移] 的字节码——奇妙的地方
ULONG ulHeadLen=0;

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath){
    KdPrint(("[TrueCell] Driver Entry!\r\n"));
    DriverObject->DriverUnload=TrueCellUnload;
    return HookFunc(TRUE)?STATUS_SUCCESS:STATUS_UNSUCCESSFUL;
}

VOID TrueCellUnload(IN PDRIVER_OBJECT DriverObject){
    HookFunc(FALSE);
    KdPrint(("[TrueCell] Driver Unload!\r\n"));
}

_declspec(naked) NTSTATUS
GoNtCreateSection(OUT PHANDLE SectionHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN PLARGE_INTEGER SectionSize OPTIONAL,
    IN ULONG Protect,
    IN ULONG Attributes,
    IN HANDLE FileHandle){//跳板
    _asm{
        nop;//    \   
        nop;//    |
        nop;//    |
        nop;//    |
        nop;//    |
        nop;//    |   
        nop;//    ＞开辟足够大的空间来容纳NtCreateSection开头的ulHeadlen个字节的机器码
        nop;//    |
        nop;//    |
        nop;//    |
        nop;//    |
        nop;//    /
        mov        eax,NtCreateSection;
        add     eax,ulHeadLen;
        jmp     eax
    }
}

NTSTATUS
DetourNtCreateSection(OUT PHANDLE SectionHandle,
            IN ACCESS_MASK DesiredAccess,
            IN POBJECT_ATTRIBUTES ObjectAttributes,
            IN PLARGE_INTEGER SectionSize OPTIONAL,
            IN ULONG Protect,
            IN ULONG Attributes,
            IN HANDLE FileHandle){//代理函数
    PFILE_OBJECT    FileObject;
    POBJECT_NAME_INFORMATION wcFilePath;
    //由Protect判断当前Section是否可执行：一般将要执行的DLL和EXE的都是Section可执行的
    if (Protect & (PAGE_EXECUTE|PAGE_EXECUTE_READ|PAGE_EXECUTE_READWRITE|PAGE_EXECUTE_WRITECOPY) ){
        //获取FileHandle对应的FILE_OBJEC——其有我们感兴趣的成员和作用
        if (NT_SUCCESS(ObReferenceObjectByHandle(FileHandle,0,NULL,KernelMode,&FileObject,NULL))){//获取文件对象       
        //获取FileObject对应的文件全路径
            if (IoQueryFileDosDeviceName(FileObject,&wcFilePath)==STATUS_SUCCESS){//获取文件对象所对应的文件Dos设备名称,即是全路径
               
                DbgPrint("[TrueCell] %ws\r\n",wcFilePath->Name.Buffer);
                ExFreePool(wcFilePath);//IoQueryFileDosDeviceName获取的OBJECT_NAME_INFORMATION 需要手动释放
            }
            ObDereferenceObject(FileObject);//放弃对FileObject的引用
        }       
    }
    //“返回”到真正的“跳板”处,完成Hook过程
    return GoNtCreateSection(SectionHandle,DesiredAccess,ObjectAttributes,SectionSize,Protect,Attributes,FileHandle);   
}

BOOLEAN HookFunc(BOOLEAN IsHook){
    ULONG  Offset;
    KIRQL  Irql;   
    ULONG  CR0Value;
    hde32s hs;
    PUCHAR code_pos;

if (IsHook==FALSE && ulHeadLen==0){
        return FALSE;
    }
    KdPrint(("[TrueCell] %s\r\n",IsHook?"Hook":"UnHook"));

Irql=KeRaiseIrqlToDpcLevel();
    if (IsHook){
        Offset=(ULONG)DetourNtCreateSection-(ULONG)NtCreateSection-5;
        RtlCopyMemory(NewFuncHead+1,(PUCHAR)&Offset,4);

code_pos=(PUCHAR )NtCreateSection;
        while (ulHeadLen<5){//利用反汇编引擎HDE,解析目标函数位置头部能容纳Hook跳转指令所需空间的大小
            RtlZeroMemory(&hs,sizeof(hs));
            ulHeadLen+=hde32_disasm(code_pos,&hs);
            code_pos+=ulHeadLen;
        }
        RtlCopyMemory(OriFuncHead,(PUCHAR)NtCreateSection,ulHeadLen);
        RtlCopyMemory(GoNtCreateSection,(PUCHAR)NtCreateSection,ulHeadLen);//将目标函数位置头部的指令复制到踏板函数体内
    }   
    _asm{//关闭写保护
        cli;
        push eax;   
        mov eax,cr0;
        mov CR0Value,eax;
        and eax,0xfffeffff;
        mov cr0,eax;
        pop eax;
    }
    if (IsHook){
        RtlMoveMemory((PUCHAR)NtCreateSection,NewFuncHead,5);
    }else{
        RtlMoveMemory((PUCHAR)NtCreateSection,OriFuncHead,ulHeadLen);
    }
    _asm{//重启写保护
        push eax;
        mov eax,CR0Value;
        mov cr0,eax;
        pop eax;
        sti;
    }
    KeLowerIrql(Irql);

return TRUE;
}