青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.￠%

像打了激速一樣，以四倍的速度運(yùn)轉(zhuǎn)，開心的工作
簡單、開放、平等的公司文化；尊重個性、自由與個人價(jià)值；
posts - 1098, comments - 335, trackbacks - 0, articles - 1
  C++博客 :: 首頁 :: 新隨筆 :: 聯(lián)系 :: 聚合  :: 管理

[轉(zhuǎn)] hook PsCreateSystemThread

Posted on 2009-09-17 21:59 S.l.e!ep.￠% 閱讀(790) 評論(0)  編輯 收藏 引用 所屬分類: Windows WDM

hook PsCreateSystemThread

很多RootKit在ring0下利用PsCreateSystemThread來創(chuàng)建系統(tǒng)線程做某些WS的事情，我們平時不利用ARK工具的話，是很難發(fā)現(xiàn)這些線程，在某些情況下，需要anti一些特定的rootkit，這里給出一個簡單的示例：

.h:
#pragma?once

#include?<ntddk.h>?

typedef?long?LONG;
typedef?unsigned?char??BOOL,?*PBOOL;
typedef?unsigned?char??BYTE,?*PBYTE;
typedef?unsigned?long??DWORD,?*PDWORD;
typedef?unsigned?short?WORD,?*PWORD;

typedef?void??*HMODULE;
typedef?long?NTSTATUS,?*PNTSTATUS;
typedef?unsigned?long?DWORD;
typedef?DWORD?*?PDWORD;
typedef?unsigned?long?ULONG;
typedef?unsigned?long?ULONG_PTR;
typedef?ULONG?*PULONG;
typedef?unsigned?short?WORD;
typedef?unsigned?char?BYTE;?
typedef?unsigned?char?UCHAR;
typedef?unsigned?short?USHORT;
typedef?void?*PVOID;
typedef?BYTE?BOOLEAN;
#define?SEC_IMAGE????0x01000000

NTSTATUS
??PsLookupProcessByProcessId(
????IN?HANDLE?ProcessId,
????OUT?PEPROCESS?*Process
????);

.c:
#include?"HookPsThread.h"
/******************************************************************************

????Hook?PsCreateSystemThread
????out?adress

******************************************************************************/

//=============================================================================
//????????Version?Define
//=============================================================================
#define?EPROCESS_SIZE????????????1
#define?PEB_OFFSET????????????????2???
#define?FILE_NAME_OFFSET????????3???
#define?PROCESS_LINK_OFFSET?????4???
#define?PROCESS_ID_OFFSET???????5?
#define?EXIT_TIME_OFFSET????????6?
//=============================================================================
//????????Logic?Define
//=============================================================================
ULONG?PsCreateSystemThreadAddr?=?0;
char?PsCreateSystemThreadData[5]?=?{0};

DWORD??ProcessNameOffset;

//-----------------------------------------------------------------------------
//????????GetPlantformDependentInfo
//-----------------------------------------------------------------------------
DWORD?GetPlantformDependentInfo(?DWORD?dwFlag?)????
{?????
????DWORD?current_build;?????
????DWORD?ans?=?0;?????
???
????PsGetVersion(NULL,?NULL,?&current_build,?NULL);?????
???
????switch?(?dwFlag?)????
????{?????
????case?EPROCESS_SIZE:?????
????????if?(current_build?==?2195)?ans?=?0?;????????//?2000，當(dāng)前不支持2000，下同????
????????if?(current_build?==?2600)?ans?=?0x25C;?????//?xp????
????????if?(current_build?==?3790)?ans?=?0x270;?????//?2003????
????????break;?????
????case?PEB_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x1b0;?????
????????if?(current_build?==?3790)??ans?=?0x1a0;????
????????break;?????
????case?FILE_NAME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x174;?????
????????if?(current_build?==?3790)??ans?=?0x164;????
????????break;?????
????case?PROCESS_LINK_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x088;?????
????????if?(current_build?==?3790)??ans?=?0x098;????
????????break;?????
????case?PROCESS_ID_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x084;?????
????????if?(current_build?==?3790)??ans?=?0x094;????
????????break;?????
????case?EXIT_TIME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x078;?????
????????if?(current_build?==?3790)??ans?=?0x088;????
????????break;?????
????}?????
????return?ans;?????
}


//-----------------------------------------------------------------------------
//????????GetFunctionAddr
//-----------------------------------------------------------------------------
ULONG?GetFunctionAddr(?IN?PCWSTR?FunctionName)
{
????UNICODE_STRING?UniCodeFunctionName;
????RtlInitUnicodeString(?&UniCodeFunctionName,?FunctionName?);
????return?(ULONG)MmGetSystemRoutineAddress(?&UniCodeFunctionName?);???
}

//-----------------------------------------------------------------------------
//????????_PsCreateSystemThread
//-----------------------------------------------------------------------------
NTSTATUS?_PsCreateSystemThread(IN?PKSTART_ROUTINE??StartRoutine)
{
????ULONG?RAddr?=?(ULONG)StartRoutine;??//Routine?Address
????//Get?Process?Info
????LPTSTR???CurProc;
????PEPROCESS?EProcess;
????PsLookupProcessByProcessId(PsGetCurrentProcessId(),?&EProcess);
????CurProc?=(LPTSTR)EProcess;
????CurProc?=CurProc+ProcessNameOffset;

????if?(strncmp((char*)CurProc,"System",6)?!=?0)
????{
????????DbgPrint("Current?Process?:?%s,?StartRoutine?:?%X\n",?(char?*)CurProc,?StartRoutine);
????}
????return?0;
}

//-----------------------------------------------------------------------------
//????????MyPsCreateSystemThread
//-----------------------------------------------------------------------------
__declspec?(naked)void?MyPsCreateSystemThread()
{
????_asm
????{
????????pushad
????????push?[esp+20h+18h]
????????call?_PsCreateSystemThread
????????popad
????????
????????mov?edi,edi
????????push?ebp
????????mov?ebp,esp
????????jmp?PsCreateSystemThreadAddr
????}
}

//-----------------------------------------------------------------------------
//????????Install?Hook
//-----------------------------------------------------------------------------
VOID?InHook()
{
????PsCreateSystemThreadAddr?=?GetFunctionAddr(L"PsCreateSystemThread");

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????//Save?asmCode
????memcpy(PsCreateSystemThreadData,?(PVOID)PsCreateSystemThreadAddr,?5);
????(ULONG)PsCreateSystemThreadAddr?+=?5;

????//Inline?PsCreateSystemThread
????__asm
????{
????????mov?esi,?PsCreateSystemThreadAddr
????????sub?esi,?5
????????mov?byte?ptr[esi],?0xE9
????????lea?eax,?[MyPsCreateSystemThread]
????????sub?eax,?esi
????????sub?eax,?5
????????mov?dword?ptr?[esi+1],eax
????}

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????DbgPrint("Hooked?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Uninstall?Hook
//-----------------------------------------------------------------------------
VOID?UnHook()
{
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????(ULONG)PsCreateSystemThreadAddr?-=?5;
????memcpy((PVOID)PsCreateSystemThreadAddr,?PsCreateSystemThreadData,?5);
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????DbgPrint("UnHook?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Driver?UnLoad
//-----------------------------------------------------------------------------
void?OnUnload(PDRIVER_OBJECT?pDriverObj)
{
????UnHook();
????DbgPrint("UnLoading?Driver");
}

//-----------------------------------------------------------------------------
//????????Driver?LoadEntry
//-----------------------------------------------------------------------------
NTSTATUS?DriverEntry(PDRIVER_OBJECT?pDriverObj,?PUNICODE_STRING?pRegistryString)
{
????pDriverObj->DriverUnload?=?OnUnload;

????DbgPrint("Loading?Driver");
????ProcessNameOffset?=?GetPlantformDependentInfo(FILE_NAME_OFFSET);
????InHook();
????return?STATUS_SUCCESS;
}
很多RootKit在ring0下利用PsCreateSystemThread來創(chuàng)建系統(tǒng)線程做某些WS的事情，我們平時不利用ARK工具的話，是很難發(fā)現(xiàn)這些線程，在某些情況下，需要anti一些特定的rootkit，這里給出一個簡單的示例：

.h:
#pragma?once

#include?<ntddk.h>?

typedef?long?LONG;
typedef?unsigned?char??BOOL,?*PBOOL;
typedef?unsigned?char??BYTE,?*PBYTE;
typedef?unsigned?long??DWORD,?*PDWORD;
typedef?unsigned?short?WORD,?*PWORD;

typedef?void??*HMODULE;
typedef?long?NTSTATUS,?*PNTSTATUS;
typedef?unsigned?long?DWORD;
typedef?DWORD?*?PDWORD;
typedef?unsigned?long?ULONG;
typedef?unsigned?long?ULONG_PTR;
typedef?ULONG?*PULONG;
typedef?unsigned?short?WORD;
typedef?unsigned?char?BYTE;?
typedef?unsigned?char?UCHAR;
typedef?unsigned?short?USHORT;
typedef?void?*PVOID;
typedef?BYTE?BOOLEAN;
#define?SEC_IMAGE????0x01000000

NTSTATUS
??PsLookupProcessByProcessId(
????IN?HANDLE?ProcessId,
????OUT?PEPROCESS?*Process
????);

.c:
#include?"HookPsThread.h"
/******************************************************************************

????Hook?PsCreateSystemThread
????out?adress

******************************************************************************/

//=============================================================================
//????????Version?Define
//=============================================================================
#define?EPROCESS_SIZE????????????1
#define?PEB_OFFSET????????????????2???
#define?FILE_NAME_OFFSET????????3???
#define?PROCESS_LINK_OFFSET?????4???
#define?PROCESS_ID_OFFSET???????5?
#define?EXIT_TIME_OFFSET????????6?
//=============================================================================
//????????Logic?Define
//=============================================================================
ULONG?PsCreateSystemThreadAddr?=?0;
char?PsCreateSystemThreadData[5]?=?{0};

DWORD??ProcessNameOffset;

//-----------------------------------------------------------------------------
//????????GetPlantformDependentInfo
//-----------------------------------------------------------------------------
DWORD?GetPlantformDependentInfo(?DWORD?dwFlag?)????
{?????
????DWORD?current_build;?????
????DWORD?ans?=?0;?????
???
????PsGetVersion(NULL,?NULL,?&current_build,?NULL);?????
???
????switch?(?dwFlag?)????
????{?????
????case?EPROCESS_SIZE:?????
????????if?(current_build?==?2195)?ans?=?0?;????????//?2000，當(dāng)前不支持2000，下同????
????????if?(current_build?==?2600)?ans?=?0x25C;?????//?xp????
????????if?(current_build?==?3790)?ans?=?0x270;?????//?2003????
????????break;?????
????case?PEB_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x1b0;?????
????????if?(current_build?==?3790)??ans?=?0x1a0;????
????????break;?????
????case?FILE_NAME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x174;?????
????????if?(current_build?==?3790)??ans?=?0x164;????
????????break;?????
????case?PROCESS_LINK_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x088;?????
????????if?(current_build?==?3790)??ans?=?0x098;????
????????break;?????
????case?PROCESS_ID_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x084;?????
????????if?(current_build?==?3790)??ans?=?0x094;????
????????break;?????
????case?EXIT_TIME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x078;?????
????????if?(current_build?==?3790)??ans?=?0x088;????
????????break;?????
????}?????
????return?ans;?????
}


//-----------------------------------------------------------------------------
//????????GetFunctionAddr
//-----------------------------------------------------------------------------
ULONG?GetFunctionAddr(?IN?PCWSTR?FunctionName)
{
????UNICODE_STRING?UniCodeFunctionName;
????RtlInitUnicodeString(?&UniCodeFunctionName,?FunctionName?);
????return?(ULONG)MmGetSystemRoutineAddress(?&UniCodeFunctionName?);???
}

//-----------------------------------------------------------------------------
//????????_PsCreateSystemThread
//-----------------------------------------------------------------------------
NTSTATUS?_PsCreateSystemThread(IN?PKSTART_ROUTINE??StartRoutine)
{
????ULONG?RAddr?=?(ULONG)StartRoutine;??//Routine?Address
????//Get?Process?Info
????LPTSTR???CurProc;
????PEPROCESS?EProcess;
????PsLookupProcessByProcessId(PsGetCurrentProcessId(),?&EProcess);
????CurProc?=(LPTSTR)EProcess;
????CurProc?=CurProc+ProcessNameOffset;

????if?(strncmp((char*)CurProc,"System",6)?!=?0)
????{
????????DbgPrint("Current?Process?:?%s,?StartRoutine?:?%X\n",?(char?*)CurProc,?StartRoutine);
????}
????return?0;
}

//-----------------------------------------------------------------------------
//????????MyPsCreateSystemThread
//-----------------------------------------------------------------------------
__declspec?(naked)void?MyPsCreateSystemThread()
{
????_asm
????{
????????pushad
????????push?[esp+20h+18h]
????????call?_PsCreateSystemThread
????????popad
????????
????????mov?edi,edi
????????push?ebp
????????mov?ebp,esp
????????jmp?PsCreateSystemThreadAddr
????}
}

//-----------------------------------------------------------------------------
//????????Install?Hook
//-----------------------------------------------------------------------------
VOID?InHook()
{
????PsCreateSystemThreadAddr?=?GetFunctionAddr(L"PsCreateSystemThread");

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????//Save?asmCode
????memcpy(PsCreateSystemThreadData,?(PVOID)PsCreateSystemThreadAddr,?5);
????(ULONG)PsCreateSystemThreadAddr?+=?5;

????//Inline?PsCreateSystemThread
????__asm
????{
????????mov?esi,?PsCreateSystemThreadAddr
????????sub?esi,?5
????????mov?byte?ptr[esi],?0xE9
????????lea?eax,?[MyPsCreateSystemThread]
????????sub?eax,?esi
????????sub?eax,?5
????????mov?dword?ptr?[esi+1],eax
????}

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????DbgPrint("Hooked?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Uninstall?Hook
//-----------------------------------------------------------------------------
VOID?UnHook()
{
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????(ULONG)PsCreateSystemThreadAddr?-=?5;
????memcpy((PVOID)PsCreateSystemThreadAddr,?PsCreateSystemThreadData,?5);
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????DbgPrint("UnHook?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Driver?UnLoad
//-----------------------------------------------------------------------------
void?OnUnload(PDRIVER_OBJECT?pDriverObj)
{
????UnHook();
????DbgPrint("UnLoading?Driver");
}

//-----------------------------------------------------------------------------
//????????Driver?LoadEntry
//-----------------------------------------------------------------------------
NTSTATUS?DriverEntry(PDRIVER_OBJECT?pDriverObj,?PUNICODE_STRING?pRegistryString)
{
????pDriverObj->DriverUnload?=?OnUnload;

????DbgPrint("Loading?Driver");
????ProcessNameOffset?=?GetPlantformDependentInfo(FILE_NAME_OFFSET);
????InHook();
????return?STATUS_SUCCESS;
}
青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

    • <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>

    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>

            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            
欧美午夜不卡影院在线观看完整版免费|
国产一区二区中文字幕免费看|
亚久久调教视频|
国产精品日韩在线观看|
久久激情网站|
免费观看日韩av|
日韩亚洲视频在线|
在线综合+亚洲+欧美中文字幕|
亚洲无线视频|
国产一区高清视频|
欧美激情一级片一区二区|
欧美女人交a|
欧美在线www|
免费黄网站欧美|
99精品视频免费在线观看|
亚洲一区二区三区免费在线观看
|
欧美日韩亚洲综合一区|
亚洲国产经典视频|
91久久久在线|
国产精品毛片大码女人|
欧美一级二区|
久久久国产精品亚洲一区
|
中文av一区二区|
国精产品99永久一区一区|
亚洲福利在线观看|
国产伦精品一区二区三区视频黑人|
亚洲国产导航|
亚洲五月六月|
日韩视频中文字幕|
欧美在线播放一区|
99亚洲一区二区|
久久精品视频va|
午夜日韩福利|
欧美久久九九|
麻豆亚洲精品|
国产精品天天看|
亚洲精品一区二区网址|
激情文学一区|
亚洲欧美日本精品|
亚洲视频播放|
欧美精品日韩一区|
欧美高清免费|
韩国精品久久久999|
在线视频精品一|
一本大道av伊人久久综合|
久久色在线播放|
久久久91精品国产|
国产精品久久久久久久久借妻|
香蕉久久国产|
欧美日本国产精品|
亚洲国产成人精品女人久久久|
欧美成人按摩|
欧美成人第一页|
狠狠色狠狠色综合日日小说|
亚洲综合国产激情另类一区|
亚洲一区二区在线观看视频|
欧美成人资源网|
欧美激情一区二区久久久|
国内外成人免费激情在线视频网站
|
久久躁狠狠躁夜夜爽|
欧美伊人久久久久久久久影院
|
牛牛影视久久网|
国产在线高清精品|
亚洲一区二区三区涩|
午夜精品福利视频|
国产精品r级在线|
亚洲一区欧美激情|
久久不射电影网|
国产综合久久久久久鬼色|
亚洲精品在线免费观看视频|
欧美激情一区二区三区不卡|
欧美午夜不卡视频|
中文在线一区|
香蕉免费一区二区三区在线观看|
欧美一区二区三区免费大片|
亚洲欧美日韩精品一区二区|
国产精品黄页免费高清在线观看|
久久人人爽人人|
国产亚洲综合在线|
久久夜色精品一区|
欧美激情一区二区三区全黄
|
性伦欧美刺激片在线观看|
亚洲欧美精品中文字幕在线|
国产精品五月天|
欧美一区日韩一区|
欧美高清你懂得|
亚洲天堂av图片|
国产一区二区电影在线观看|
久久免费精品日本久久中文字幕|
亚洲一区二区免费视频|
欧美亚州在线观看|
亚洲午夜激情网站|
米奇777在线欧美播放|
99亚洲伊人久久精品影院红桃|
久久国产精品毛片|
亚洲国产色一区|
亚洲欧美激情诱惑|
亚洲国产高潮在线观看|
欧美日韩二区三区|
午夜精品久久久久久久久久久|
一区二区三区精品视频|
国产精品亚洲激情|
欧美激情国产高清|
性色av香蕉一区二区|
亚洲精品日韩久久|
久色婷婷小香蕉久久|
一区二区三区导航|
一区二区三区在线观看欧美|
欧美性猛交视频|
久久久免费av|
一区二区三区久久久|
欧美成人一区二区三区|
欧美在线关看|
亚洲午夜精品久久|
91久久精品一区二区别|
国产一区二区三区直播精品电影|
亚洲在线观看视频网站|
欧美.www|
欧美在线观看天堂一区二区三区
|
午夜国产精品视频免费体验区|
夜夜狂射影院欧美极品|
亚洲大胆女人|
国产亚洲欧美一区二区|
欧美午夜片在线观看|
久久综合九色九九|
欧美在线欧美在线|
亚洲一区二区成人在线观看|
亚洲精品乱码久久久久久蜜桃91
|
欧美日韩亚洲综合|
欧美va亚洲va香蕉在线|
先锋影音久久|
午夜精品一区二区三区在线视|
久久国产精品一区二区三区四区|
国产裸体写真av一区二区|
欧美三级午夜理伦三级中视频|
久久亚洲精品一区二区|
国产精品一区一区三区|
国产精品高潮呻吟视频|
欧美日韩亚洲一区二|
欧美日韩一视频区二区|
欧美日韩国产一中文字不卡|
欧美裸体一区二区三区|
欧美日韩 国产精品|
欧美母乳在线|
欧美性色综合|
国产毛片一区|
国产欧美在线看|
国产欧美在线|
亚洲电影在线免费观看|
91久久综合|
一区二区免费看|
亚洲综合色视频|
欧美影院成人|
欧美电影美腿模特1979在线看|
夜夜精品视频|
99视频精品全部免费在线|
一级日韩一区在线观看|
午夜精品一区二区三区在线
|
美女诱惑黄网站一区|
免费一级欧美片在线播放|
欧美黑人在线观看|
欧美人妖另类|
国产欧美激情|
亚洲激情av在线|
宅男在线国产精品|
久久成人免费网|
欧美国产欧美亚洲国产日韩mv天天看完整|
一区二区高清视频在线观看|
亚洲一二三区在线|
久久国产婷婷国产香蕉|
六十路精品视频|
亚洲精品免费在线观看|
亚洲免费网址|
免费成人毛片|
国产精品av免费在线观看|
国产一区二区中文|
亚洲美女免费视频|
久久九九国产|
亚洲精品久久久久久久久|
午夜欧美不卡精品aaaaa|
欧美国产91|
国产中文一区二区|
亚洲无线观看|
欧美二区在线|
欧美一区二区三区的|
欧美日韩成人综合天天影院|
伊人蜜桃色噜噜激情综合|
一区二区三区免费观看|
免费视频亚洲|
午夜日韩福利|
欧美调教vk|
亚洲精选91|
欧美激情乱人伦|
欧美一区二区三区播放老司机|
新67194成人永久网站|
欧美激情中文字幕一区二区|
国产永久精品大片wwwapp|
亚洲一区国产|
91久久在线|
免费在线观看一区二区|