HanDs
NO.2

[Visual Studio文章] 驱动防杀防删代码 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

///////////////////////////////////////////////////////////////////////////
//挂钩80x86 CPU ,Win2k或更高版本的系统服务表,这个驱动用来防止删除指定文件//
//Code by gt2333588
///////////////////////////////////////////////////////////////////////////

#include <ntddk.h>
#include <stdio.h>

typedef struct _SRVTABLE {
PVOID *ServiceTable;
ULONG LowCall;
ULONG HiCall;
PVOID *ArgTable;
} SRVTABLE, *PSRVTABLE;

extern PSRVTABLE KeServiceDescriptorTable;

//调用原函数
#define SYSCALL(_function) ServiceTable->ServiceTable[*(PULONG)((PUCHAR)_function+1)]

PSRVTABLE ServiceTable;

NTSTATUS
(*RealZwSetInformationFile)(IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass); //原函数

NTSTATUS HookZwSetInformationFile(IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass); //自己的函数


VOID HookAPI();
VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject);
VOID UnHook();
VOID UnhookSystemCall();

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath)
{

DriverObject->DriverUnload = DriverUnload;
ServiceTable = KeServiceDescriptorTable;
HookAPI();
return STATUS_SUCCESS;
}

VOID HookAPI()
{
RealZwSetInformationFile = SYSCALL(ZwSetInformationFile);
__asm
{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
SYSCALL(ZwSetInformationFile) = (PVOID)HookZwSetInformationFile;
__asm
{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
return;
}


NTSTATUS HookZwSetInformationFile(IN HANDLE FileHandle,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass)
{
PFILE_OBJECT pFileObject;
NTSTATUS nRet= ObReferenceObjectByHandle(FileHandle, GENERIC_READ,
*IoFileObjectType, KernelMode, (PVOID*)&pFileObject, 0);

if(NT_SUCCESS(nRet))
{
UNICODE_STRING uDosName;
nRet = IoVolumeDeviceToDosName(pFileObject->DeviceObject, &uDosName);
if (NT_SUCCESS(nRet))
{
if (!_wcsicmp(pFileObject->FileName.Buffer, L"\\工作\\HOOK\\objchk_wxp_x86\\i386\\test.txt") &&
!_wcsicmp(uDosName.Buffer, L"D:"))
{
ExFreePool(uDosName.Buffer);
return STATUS_ACCESS_DENIED;
}
ExFreePool(uDosName.Buffer);
}
}
return RealZwSetInformationFile(FileHandle, IoStatusBlock, FileInformation,
Length, FileInformationClass);
}

VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject)
{
UnHook();
}

VOID UnHook()
{
__asm
{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}
UnhookSystemCall();
__asm
{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}

VOID UnhookSystemCall()
{
SYSCALL(ZwSetInformationFile) = (PVOID)RealZwSetInformationFile;

return;
}


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
驱动 代码
#1楼
发帖时间:2016-7-9   |   查看数:0   |   回复数:0
游客组