ShadowSSdt HOOK

SHADOW表地址的获取。
CSRSS进程。system进程并没有载入win32k.sys，所以，要访问shadowssdt表，必须KeStackAttackProces到一个有GUI线程的进程中，而csrss.exe就是这样的一个合适的进程（管理Windows图形相关任务）
Index？硬编码
挂钩NtGdiBitBlt、NtGdiStretchBlt用于截屏保护 
挂钩NtUserSetWindowsHookEx 保护键盘钩子
http://blog.csdn.net/evi10r/article/details/6932607

http://blog.csdn.net/lionzl/article/details/7735483

代码：

1. #include "ShadowSsdt.h"

2.  

3. #pragma pack(1)

4. typedef struct ServiceDescriptorEntry {

5. unsigned int *ServiceTableBase;

6. unsigned int *ServiceCounterTableBase; //Used only in checked build

7. unsigned int NumberOfServices;

8. unsigned char *ParamTableBase;

9. } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;

10. #pragma pack()

11. __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

12.  

13. REAL_NtGdiStretchBlt real_NtGdiStretchBlt;

14.  

15. REAL_NtGdiBitBlt real_NtGdiBitBlt;

16.  

17. ULONG GetAddressOfShadowTable()

18. {

19. ULONG i;

20. UCHAR* p;

21. ULONG dwordatbyte;

22.  

23. UNICODE_STRING usKeAddSystemServiceTable;

24.  

25. RtlInitUnicodeString(&usKeAddSystemServiceTable, L"KeAddSystemServiceTable");

26.  

27. p = (UCHAR*)MmGetSystemRoutineAddress(&usKeAddSystemServiceTable);

28.  

29. for (i = 0; i < 4096; i++,p++)

30. {

31. __try

32. {

33. dwordatbyte = *(ULONG*)p;

34. }__except(EXCEPTION_EXECUTE_HANDLER)

35. {

36. return 0;

37. }

38.  

39. if(MmIsAddressValid((PVOID)dwordatbyte))

40. {

41. if(memcmp((PVOID)dwordatbyte, &KeServiceDescriptorTable, 16) == 0) //比较的是地址指向的内容

42. {

43. if((PVOID)dwordatbyte == &KeServiceDescriptorTable)

44. {

45. continue;

46. }

47. return dwordatbyte;

48. }

49. }

50. }

51. return 0;

52. }

53.  
54.  

55. PDWORD NtGdiStretchBltAddr;

56. PDWORD NtGdiBitBltAddr;

57. BOOL flag = FALSE;

58. void StartHookShadow (void)

59. {

60. DWORD SSDTShadowBaseAddr=GetAddressOfShadowTable()+0x10;//表基址所在地址

61. DWORD TableCount=SSDTShadowBaseAddr+0x8;//函数数量所在地址

62. DWORD dwCount=*((PDWORD)TableCount);

63. PDWORD Fun_Addr=(PDWORD)(*((PDWORD)SSDTShadowBaseAddr));

64.  

65. KdPrint(("ssdt shadow addr:0x%X = 0x%X= 0x%X",SSDTShadowBaseAddr,

66. *(PDWORD)SSDTShadowBaseAddr,Fun_Addr));

67. KdPrint(("数量是:%d",dwCount));

68. if (!MmIsAddressValid(Fun_Addr))

69. {

70. KdPrint(("Fun_Addr地址不可访问%X！",Fun_Addr));

71. return;

72. }

73. NtGdiStretchBltAddr=Fun_Addr+292;

74. NtGdiBitBltAddr=Fun_Addr+13;

75. KdPrint(("NtGdiStretchBltAddr:%X",NtGdiStretchBltAddr));

76. KdPrint(("NtGdiBitBltAddr:%X",NtGdiBitBltAddr));

77. //Fun_Addr是KeServiceDescriptorTable表的首地址，但是一用*Fun_Addr就出现0x50的蓝屏代码

78. //0x50 PAGE_FAULT_IN_NONPAGED_AREA Parameters 分页内存读取错误，但是这里没分配分页内存呢。

79. KdPrint(("*Fun_Addr:%X",*Fun_Addr));

80.  
81.  

82. //保存原函数地址，SSDT HOOK是根据ZW函数地址硬编码得出的索引得到的函数地址

83. real_NtGdiStretchBlt=(REAL_NtGdiStretchBlt)(*NtGdiStretchBltAddr);

84. real_NtGdiBitBlt=(REAL_NtGdiBitBlt)(*NtGdiBitBltAddr);

85.  
86.  

87. KdPrint(("NtGdiStretchBlt原函数地址：%08X\n",*NtGdiStretchBltAddr));

88. KdPrint(("NtGdiStretchBlt新函数地址：%08X\n",HOOK_NtGdiStretchBlt));

89. KdPrint(("NtGdiBitBlt原函数地址：%08X\n",*NtGdiBitBltAddr));

90. KdPrint(("NtGdiBitBlt新函数地址：%08X\n",HOOK_NtGdiBitBlt));

91. // 获取未导出的服务函数索引号

92. // HANDLE hFile;

93. // PCHAR pDllFile;

94. // ULONG ulSize;

95. // ULONG ulByteReaded;

96.  

97. __asm

98. {

99. push eax

100. mov eax, CR0

101. and eax, 0FFFEFFFFh

102. mov CR0, eax

103. pop eax

104. }

105.  

106. InterlockedExchange((PLONG)NtGdiStretchBltAddr, (LONG)HOOK_NtGdiStretchBlt);

107. InterlockedExchange((PLONG)NtGdiBitBltAddr, (LONG)HOOK_NtGdiBitBlt);

108.  

109. //关闭

110. __asm

111. {

112. push eax

113. mov eax, CR0

114. or eax, NOT 0FFFEFFFFh

115. mov CR0, eax

116. pop eax

117. }

118. flag = TRUE;

119. return ;

120. }

121.  

122. void RemoveHookShadow (void)

123. {

124. if (!flag)

125. {

126. return;

127. }

128.  

129. __asm

130. {

131. push eax

132. mov eax, CR0

133. and eax, 0FFFEFFFFh

134. mov CR0, eax

135. pop eax

136. }

137. InterlockedExchange( (PLONG) NtGdiStretchBltAddr, (LONG) real_NtGdiStretchBlt);

138. InterlockedExchange( (PLONG) NtGdiBitBltAddr, (LONG) real_NtGdiBitBlt);

139. __asm

140. {

141. push eax

142. mov eax, CR0

143. or eax, NOT 0FFFEFFFFh

144. mov CR0, eax

145. pop eax

146. }

147. }

148.  
149.  
150.  

151. BOOL NTAPI HOOK_NtGdiStretchBlt//293

152. (

153. IN HDC hdcDst,

154. IN int xDst,

155. IN int yDst,

156. IN int cxDst,

157. IN int cyDst,

158. IN HDC hdcSrc,

159. IN int xSrc,

160. IN int ySrc,

161. IN int cxSrc,

162. IN int cySrc,

163. IN DWORD dwRop,

164. IN DWORD dwBackColor

165. ){

166. DbgPrint("调用到了NtGdiStretchBlt");

167. return FALSE;

168. return real_NtGdiStretchBlt(

169. hdcDst,

170. xDst,

171. yDst,

172. cxDst,

173. cyDst,

174. hdcSrc,

175. xSrc,

176. ySrc,

177. cxSrc,

178. cySrc,

179. dwRop,

180. dwBackColor

181. );

182. }

183.  

184. BOOL NTAPI HOOK_NtGdiBitBlt//14

185. (

186. IN HDC hdcDst,

187. IN int x,

188. IN int y,

189. IN int cx,

190. IN int cy,

191. IN HDC hdcSrc,

192. IN int xSrc,

193. IN int ySrc,

194. IN DWORD rop4,

195. IN DWORD crBackColor,

196. IN FLONG fl

197. ){

198. DbgPrint("调用到了NtGdiBitBlt");

199. return FALSE;

200. return real_NtGdiBitBlt(

201. hdcDst,

202. x,

203. y,

204. cx,

205. cy,

206. hdcSrc,

207. xSrc,

208. ySrc,

209. rop4,

210. crBackColor,

211. fl

212. );

213.  

214. }

1. #include <ntddk.h>

2. #include <ntstrsafe.h>

3. #include <windef.h>

4.  

5. //#include <WTypes.h>

6. void StartHookShadow (void);

7. void RemoveHookShadow (void);

8.  
9.  

10. typedef BOOL (NTAPI *REAL_NtGdiStretchBlt)//293

11. (

12. IN HDC hdcDst,

13. IN int xDst,

14. IN int yDst,

15. IN int cxDst,

16. IN int cyDst,

17. IN HDC hdcSrc,

18. IN int xSrc,

19. IN int ySrc,

20. IN int cxSrc,

21. IN int cySrc,

22. IN DWORD dwRop,

23. IN DWORD dwBackColor

24. );

25.  

26. BOOL NTAPI HOOK_NtGdiStretchBlt//293

27. (

28. IN HDC hdcDst,

29. IN int xDst,

30. IN int yDst,

31. IN int cxDst,

32. IN int cyDst,

33. IN HDC hdcSrc,

34. IN int xSrc,

35. IN int ySrc,

36. IN int cxSrc,

37. IN int cySrc,

38. IN DWORD dwRop,

39. IN DWORD dwBackColor

40. );

41.  

42. typedef BOOL (NTAPI *REAL_NtGdiBitBlt)//14

43. (

44. IN HDC hdcDst,

45. IN int x,

46. IN int y,

47. IN int cx,

48. IN int cy,

49. IN HDC hdcSrc,

50. IN int xSrc,

51. IN int ySrc,

52. IN DWORD rop4,

53. IN DWORD crBackColor,

54. IN FLONG fl

55. );

56.  

57. BOOL NTAPI HOOK_NtGdiBitBlt//14

58. (

59. IN HDC hdcDst,

60. IN int x,

61. IN int y,

62. IN int cx,

63. IN int cy,

64. IN HDC hdcSrc,

65. IN int xSrc,

66. IN int ySrc,

67. IN DWORD rop4,

68. IN DWORD crBackColor,

69. IN FLONG fl

70. );

防截屏实现：

1. #include <ntifs.h>

2. #include <ntddk.h>

3. #include <WINDEF.H>

4.  

5. #define SystemHandleInformation 16

6. #define ObjectNameInformation 1

7.  

8. typedef struct _SYSTEM_HANDLE_INFORMATION

9. {

10. ULONG ProcessId;

11. UCHAR ObjectTypeNumber;

12. UCHAR Flags;

13. USHORT Handle;

14. PVOID Object;

15. ACCESS_MASK GrantedAccess;

16. } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

17.  

18. typedef struct _SYSTEM_HANDLE_INFORMATION_EX

19. {

20. ULONG NumberOfHandles;

21. SYSTEM_HANDLE_INFORMATION Information[1];

22. }SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;

23.  

24. #pragma pack(1)

25. typedef struct ServiceDescriptorEntry {

26. unsigned int *ServiceTableBase;

27. unsigned int *ServiceCounterTableBase; //Used only in checked build

28. unsigned int NumberOfServices;

29. unsigned char *ParamTableBase;

30. } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;

31. #pragma pack()

32.  

33. __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

34.  

35. PServiceDescriptorTableEntry_t KeServiceDescriptorTableShadow = NULL;

36.  

37. NTKERNELAPI NTSTATUS ZwQuerySystemInformation(

38. IN ULONG SystemInformationClass,

39. OUT PVOID SystemInformation,

40. IN ULONG SystemInformationLength,

41. OUT PULONG ReturnLength OPTIONAL );

42.  

43. typedef BOOL (NTAPI *REAL_NtGdiStretchBlt)

44. (

45. IN HDC hdcDst,

46. IN int xDst,

47. IN int yDst,

48. IN int cxDst,

49. IN int cyDst,

50. IN HDC hdcSrc,

51. IN int xSrc,

52. IN int ySrc,

53. IN int cxSrc,

54. IN int cySrc,

55. IN DWORD dwRop,

56. IN DWORD dwBackColor

57. );

58.  

59. typedef BOOL (NTAPI *REAL_NtGdiBitBlt)

60. (

61. IN HDC hdcDst,

62. IN int x,

63. IN int y,

64. IN int cx,

65. IN int cy,

66. IN HDC hdcSrc,

67. IN int xSrc,

68. IN int ySrc,

69. IN DWORD rop4,

70. IN DWORD crBackColor,

71. IN FLONG fl

72. );

73.  

74. REAL_NtGdiStretchBlt OldNtGdiStretchBlt;

75. REAL_NtGdiBitBlt OldNtGdiBitBlt = NULL;

76.  

77. BOOL NTAPI hook_NtGdiStretchBlt(

78. IN HDC hdcDst,

79. IN int xDst,

80. IN int yDst,

81. IN int cxDst,

82. IN int cyDst,

83. IN HDC hdcSrc,

84. IN int xSrc,

85. IN int ySrc,

86. IN int cxSrc,

87. IN int cySrc,

88. IN DWORD dwRop,

89. IN DWORD dwBackColor

90. )

91. {

92. return TRUE;

93. //DbgPrint("hook_NtGdiStretchBlt:%d", hdcDst);

94.  

95. return OldNtGdiStretchBlt(

96. hdcDst,

97. xDst,

98. yDst,

99. cxDst,

100. cyDst,

101. hdcSrc,

102. xSrc,

103. ySrc,

104. cxSrc,

105. cySrc,

106. dwRop,

107. dwBackColor

108. );

109. }

110.  

111. BOOL NTAPI hook_NtGdiBitBlt(

112. IN HDC hdcDst,

113. IN int x,

114. IN int y,

115. IN int cx,

116. IN int cy,

117. IN HDC hdcSrc,

118. IN int xSrc,

119. IN int ySrc,

120. IN DWORD rop4,

121. IN DWORD crBackColor,

122. IN FLONG fl

123. )

124. {

125. PEPROCESS pe = NULL;

126. PCHAR pProcessName = NULL;

127. PCHAR pIgnorePocess = "explorer.exe";

128.  

129. pe = PsGetCurrentProcess();

130.  

131. pProcessName = (PCHAR)((ULONG)pe + 0x174);

132.  

133. if (RtlCompareMemory(pProcessName, pIgnorePocess, strlen(pIgnorePocess)) == strlen(pIgnorePocess))

134. {

135. return OldNtGdiBitBlt(

136. hdcDst,

137. x,

138. y,

139. cx,

140. cy,

141. hdcSrc,

142. xSrc,

143. ySrc,

144. rop4,

145. crBackColor,

146. fl

147. );

148. }

149.  

150. return TRUE;

151. }

152.  

153. PVOID GetInfoTable(ULONG ATableType)

154. {

155. ULONG mSize = 0x4000;

156. PVOID mPtr = NULL;

157. NTSTATUS St;

158.  

159. do

160. {

161. mPtr = ExAllocatePoolWithTag(PagedPool, mSize, 'GIT');

162. memset(mPtr, 0,mSize);

163.  

164. if (mPtr)

165. {

166. St = ZwQuerySystemInformation(ATableType, mPtr,mSize, NULL);

167. } else return NULL;

168.  

169. if (St == STATUS_INFO_LENGTH_MISMATCH)

170. {

171. ExFreePool(mPtr);

172.  

173. mSize = mSize *2;

174. }

175.  

176. } while (St == STATUS_INFO_LENGTH_MISMATCH);

177.  

178. if (St == STATUS_SUCCESS) return mPtr;

179.  

180. ExFreePoolWithTag(mPtr, 'GIT');

181.  

182. return NULL;

183. }

184.  

185. HANDLE GetCsrPid()

186. {

187. HANDLE Process,hObject;

188.  

189. HANDLE CsrId =(HANDLE)0;

190.  

191. OBJECT_ATTRIBUTES obj;

192.  

193. CLIENT_ID cid;

194.  

195. UCHAR Buff[0x100];

196.  

197. POBJECT_NAME_INFORMATION ObjName= (PVOID)&Buff;

198.  

199. PSYSTEM_HANDLE_INFORMATION_EX Handles;

200.  

201. ULONG r;

202.  

203. Handles = GetInfoTable(SystemHandleInformation);

204.  

205. if (!Handles) return CsrId;

206.  

207. for (r = 0; r < Handles->NumberOfHandles; r++)

208. {

209. if (Handles->Information[r].ObjectTypeNumber == 21) //Portobject

210. {

211. InitializeObjectAttributes(&obj, NULL, OBJ_KERNEL_HANDLE, NULL,NULL);

212.  

213. cid.UniqueProcess= (HANDLE)Handles->Information[r].ProcessId;

214.  

215. cid.UniqueThread= 0;

216.  

217. if (NT_SUCCESS(NtOpenProcess(&Process,PROCESS_DUP_HANDLE, &obj, &cid)))

218. {

219. if (NT_SUCCESS(ZwDuplicateObject(Process,(HANDLE)Handles->Information[r].Handle,NtCurrentProcess(),&hObject, 0, 0, DUPLICATE_SAME_ACCESS)))

220. {

221. if (NT_SUCCESS(ZwQueryObject(hObject, ObjectNameInformation,ObjName, 0x100, NULL)))

222. {

223. if (ObjName->Name.Buffer&& !wcsncmp(L"\\Windows\\ApiPort", ObjName->Name.Buffer, 20))

224. {

225. CsrId = (HANDLE)Handles->Information[r].ProcessId;

226. }

227. }

228. ZwClose(hObject);

229. }

230. ZwClose(Process);

231. }

232. }

233. }

234.  

235. ExFreePool(Handles);

236.  

237. return CsrId;

238. }

239.  

240. VOID DriverUnload(PDRIVER_OBJECT pDriverObject)

241. {

242. NTSTATUS ntStatus = STATUS_SUCCESS;

243. PEPROCESS crsProcess = NULL;

244.  

245. if (OldNtGdiBitBlt && OldNtGdiStretchBlt && KeServiceDescriptorTableShadow)

246. {

247. ntStatus = PsLookupProcessByProcessId(GetCsrPid(),&crsProcess);

248.  

249. if (NT_SUCCESS(ntStatus))

250. {

251. KeAttachProcess(crsProcess);

252.  

253. __asm

254. {

255. push eax

256. mov eax, CR0

257. and eax, 0FFFEFFFFh

258. mov CR0, eax

259. pop eax

260. }

261.  

262. InterlockedExchange(&KeServiceDescriptorTableShadow->ServiceTableBase[13], (ULONG)OldNtGdiBitBlt);

263. InterlockedExchange(&KeServiceDescriptorTableShadow->ServiceTableBase[292], (ULONG)OldNtGdiStretchBlt);

264.  

265. __asm

266. {

267. push eax

268. mov eax, CR0

269. or eax, NOT 0FFFEFFFFh

270. mov CR0, eax

271. pop eax

272. }

273. }

274. }

275. }

276.  

277. NTSTATUS HookssdtShadow()

278. {

279. NTSTATUS ntStatus = STATUS_SUCCESS;

280. ULONG BuildNumber = 0;

281. ULONG MinorVersion = 0;

282. ULONG MajorVersion = 0;

283. PEPROCESS crsProcess = NULL;

284.  

285. PsGetVersion(&MajorVersion, &MinorVersion, &BuildNumber, NULL);

286.  

287. DbgPrint("%d", BuildNumber);

288.  

289. if (BuildNumber == 2600) //XP

290. {

291. KeServiceDescriptorTableShadow = (PServiceDescriptorTableEntry_t)((ULONG)&KeServiceDescriptorTable - 0x40 + 0x10);

292.  

293. DbgPrint("%d", KeServiceDescriptorTableShadow);

294.  

295. if (KeServiceDescriptorTableShadow)

296. {

297. ntStatus = PsLookupProcessByProcessId(GetCsrPid(),&crsProcess);

298.  

299. if (NT_SUCCESS(ntStatus))

300. {

301. KeAttachProcess(crsProcess);

302.  

303. __asm

304. {

305. push eax

306. mov eax, CR0

307. and eax, 0FFFEFFFFh

308. mov CR0, eax

309. pop eax

310. }

311.  

312. OldNtGdiBitBlt = (REAL_NtGdiBitBlt)InterlockedExchange(&KeServiceDescriptorTableShadow->ServiceTableBase[13], (ULONG)hook_NtGdiBitBlt);

313. OldNtGdiStretchBlt = (REAL_NtGdiStretchBlt)InterlockedExchange(&KeServiceDescriptorTableShadow->ServiceTableBase[292], (ULONG)hook_NtGdiStretchBlt);

314.  

315. __asm

316. {

317. push eax

318. mov eax, CR0

319. or eax, NOT 0FFFEFFFFh

320. mov CR0, eax

321. pop eax

322. }

323. }

324. }

325. }

326.  

327. return ntStatus;

328. }

329.  
330.  

331. NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)

332. {

333. pDriverObject->DriverUnload = DriverUnload;

334.  

335. HookssdtShadow();

336.  

337. return STATUS_SUCCESS;

338. }