青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.￠%

像打了激速一樣，以四倍的速度運(yùn)轉(zhuǎn)，開心的工作
簡單、開放、平等的公司文化；尊重個性、自由與個人價(jià)值；
posts - 1098, comments - 335, trackbacks - 0, articles - 1
  C++博客 :: 首頁 :: 新隨筆 :: 聯(lián)系 :: 聚合  :: 管理

[轉(zhuǎn)] hook PsCreateSystemThread

Posted on 2009-09-17 21:59 S.l.e!ep.￠% 閱讀(790) 評論(0)  編輯 收藏 引用 所屬分類: Windows WDM

hook PsCreateSystemThread

很多RootKit在ring0下利用PsCreateSystemThread來創(chuàng)建系統(tǒng)線程做某些WS的事情，我們平時不利用ARK工具的話，是很難發(fā)現(xiàn)這些線程，在某些情況下，需要anti一些特定的rootkit，這里給出一個簡單的示例：

.h:
#pragma?once

#include?<ntddk.h>?

typedef?long?LONG;
typedef?unsigned?char??BOOL,?*PBOOL;
typedef?unsigned?char??BYTE,?*PBYTE;
typedef?unsigned?long??DWORD,?*PDWORD;
typedef?unsigned?short?WORD,?*PWORD;

typedef?void??*HMODULE;
typedef?long?NTSTATUS,?*PNTSTATUS;
typedef?unsigned?long?DWORD;
typedef?DWORD?*?PDWORD;
typedef?unsigned?long?ULONG;
typedef?unsigned?long?ULONG_PTR;
typedef?ULONG?*PULONG;
typedef?unsigned?short?WORD;
typedef?unsigned?char?BYTE;?
typedef?unsigned?char?UCHAR;
typedef?unsigned?short?USHORT;
typedef?void?*PVOID;
typedef?BYTE?BOOLEAN;
#define?SEC_IMAGE????0x01000000

NTSTATUS
??PsLookupProcessByProcessId(
????IN?HANDLE?ProcessId,
????OUT?PEPROCESS?*Process
????);

.c:
#include?"HookPsThread.h"
/******************************************************************************

????Hook?PsCreateSystemThread
????out?adress

******************************************************************************/

//=============================================================================
//????????Version?Define
//=============================================================================
#define?EPROCESS_SIZE????????????1
#define?PEB_OFFSET????????????????2???
#define?FILE_NAME_OFFSET????????3???
#define?PROCESS_LINK_OFFSET?????4???
#define?PROCESS_ID_OFFSET???????5?
#define?EXIT_TIME_OFFSET????????6?
//=============================================================================
//????????Logic?Define
//=============================================================================
ULONG?PsCreateSystemThreadAddr?=?0;
char?PsCreateSystemThreadData[5]?=?{0};

DWORD??ProcessNameOffset;

//-----------------------------------------------------------------------------
//????????GetPlantformDependentInfo
//-----------------------------------------------------------------------------
DWORD?GetPlantformDependentInfo(?DWORD?dwFlag?)????
{?????
????DWORD?current_build;?????
????DWORD?ans?=?0;?????
???
????PsGetVersion(NULL,?NULL,?&current_build,?NULL);?????
???
????switch?(?dwFlag?)????
????{?????
????case?EPROCESS_SIZE:?????
????????if?(current_build?==?2195)?ans?=?0?;????????//?2000，當(dāng)前不支持2000，下同????
????????if?(current_build?==?2600)?ans?=?0x25C;?????//?xp????
????????if?(current_build?==?3790)?ans?=?0x270;?????//?2003????
????????break;?????
????case?PEB_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x1b0;?????
????????if?(current_build?==?3790)??ans?=?0x1a0;????
????????break;?????
????case?FILE_NAME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x174;?????
????????if?(current_build?==?3790)??ans?=?0x164;????
????????break;?????
????case?PROCESS_LINK_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x088;?????
????????if?(current_build?==?3790)??ans?=?0x098;????
????????break;?????
????case?PROCESS_ID_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x084;?????
????????if?(current_build?==?3790)??ans?=?0x094;????
????????break;?????
????case?EXIT_TIME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x078;?????
????????if?(current_build?==?3790)??ans?=?0x088;????
????????break;?????
????}?????
????return?ans;?????
}


//-----------------------------------------------------------------------------
//????????GetFunctionAddr
//-----------------------------------------------------------------------------
ULONG?GetFunctionAddr(?IN?PCWSTR?FunctionName)
{
????UNICODE_STRING?UniCodeFunctionName;
????RtlInitUnicodeString(?&UniCodeFunctionName,?FunctionName?);
????return?(ULONG)MmGetSystemRoutineAddress(?&UniCodeFunctionName?);???
}

//-----------------------------------------------------------------------------
//????????_PsCreateSystemThread
//-----------------------------------------------------------------------------
NTSTATUS?_PsCreateSystemThread(IN?PKSTART_ROUTINE??StartRoutine)
{
????ULONG?RAddr?=?(ULONG)StartRoutine;??//Routine?Address
????//Get?Process?Info
????LPTSTR???CurProc;
????PEPROCESS?EProcess;
????PsLookupProcessByProcessId(PsGetCurrentProcessId(),?&EProcess);
????CurProc?=(LPTSTR)EProcess;
????CurProc?=CurProc+ProcessNameOffset;

????if?(strncmp((char*)CurProc,"System",6)?!=?0)
????{
????????DbgPrint("Current?Process?:?%s,?StartRoutine?:?%X\n",?(char?*)CurProc,?StartRoutine);
????}
????return?0;
}

//-----------------------------------------------------------------------------
//????????MyPsCreateSystemThread
//-----------------------------------------------------------------------------
__declspec?(naked)void?MyPsCreateSystemThread()
{
????_asm
????{
????????pushad
????????push?[esp+20h+18h]
????????call?_PsCreateSystemThread
????????popad
????????
????????mov?edi,edi
????????push?ebp
????????mov?ebp,esp
????????jmp?PsCreateSystemThreadAddr
????}
}

//-----------------------------------------------------------------------------
//????????Install?Hook
//-----------------------------------------------------------------------------
VOID?InHook()
{
????PsCreateSystemThreadAddr?=?GetFunctionAddr(L"PsCreateSystemThread");

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????//Save?asmCode
????memcpy(PsCreateSystemThreadData,?(PVOID)PsCreateSystemThreadAddr,?5);
????(ULONG)PsCreateSystemThreadAddr?+=?5;

????//Inline?PsCreateSystemThread
????__asm
????{
????????mov?esi,?PsCreateSystemThreadAddr
????????sub?esi,?5
????????mov?byte?ptr[esi],?0xE9
????????lea?eax,?[MyPsCreateSystemThread]
????????sub?eax,?esi
????????sub?eax,?5
????????mov?dword?ptr?[esi+1],eax
????}

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????DbgPrint("Hooked?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Uninstall?Hook
//-----------------------------------------------------------------------------
VOID?UnHook()
{
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????(ULONG)PsCreateSystemThreadAddr?-=?5;
????memcpy((PVOID)PsCreateSystemThreadAddr,?PsCreateSystemThreadData,?5);
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????DbgPrint("UnHook?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Driver?UnLoad
//-----------------------------------------------------------------------------
void?OnUnload(PDRIVER_OBJECT?pDriverObj)
{
????UnHook();
????DbgPrint("UnLoading?Driver");
}

//-----------------------------------------------------------------------------
//????????Driver?LoadEntry
//-----------------------------------------------------------------------------
NTSTATUS?DriverEntry(PDRIVER_OBJECT?pDriverObj,?PUNICODE_STRING?pRegistryString)
{
????pDriverObj->DriverUnload?=?OnUnload;

????DbgPrint("Loading?Driver");
????ProcessNameOffset?=?GetPlantformDependentInfo(FILE_NAME_OFFSET);
????InHook();
????return?STATUS_SUCCESS;
}
很多RootKit在ring0下利用PsCreateSystemThread來創(chuàng)建系統(tǒng)線程做某些WS的事情，我們平時不利用ARK工具的話，是很難發(fā)現(xiàn)這些線程，在某些情況下，需要anti一些特定的rootkit，這里給出一個簡單的示例：

.h:
#pragma?once

#include?<ntddk.h>?

typedef?long?LONG;
typedef?unsigned?char??BOOL,?*PBOOL;
typedef?unsigned?char??BYTE,?*PBYTE;
typedef?unsigned?long??DWORD,?*PDWORD;
typedef?unsigned?short?WORD,?*PWORD;

typedef?void??*HMODULE;
typedef?long?NTSTATUS,?*PNTSTATUS;
typedef?unsigned?long?DWORD;
typedef?DWORD?*?PDWORD;
typedef?unsigned?long?ULONG;
typedef?unsigned?long?ULONG_PTR;
typedef?ULONG?*PULONG;
typedef?unsigned?short?WORD;
typedef?unsigned?char?BYTE;?
typedef?unsigned?char?UCHAR;
typedef?unsigned?short?USHORT;
typedef?void?*PVOID;
typedef?BYTE?BOOLEAN;
#define?SEC_IMAGE????0x01000000

NTSTATUS
??PsLookupProcessByProcessId(
????IN?HANDLE?ProcessId,
????OUT?PEPROCESS?*Process
????);

.c:
#include?"HookPsThread.h"
/******************************************************************************

????Hook?PsCreateSystemThread
????out?adress

******************************************************************************/

//=============================================================================
//????????Version?Define
//=============================================================================
#define?EPROCESS_SIZE????????????1
#define?PEB_OFFSET????????????????2???
#define?FILE_NAME_OFFSET????????3???
#define?PROCESS_LINK_OFFSET?????4???
#define?PROCESS_ID_OFFSET???????5?
#define?EXIT_TIME_OFFSET????????6?
//=============================================================================
//????????Logic?Define
//=============================================================================
ULONG?PsCreateSystemThreadAddr?=?0;
char?PsCreateSystemThreadData[5]?=?{0};

DWORD??ProcessNameOffset;

//-----------------------------------------------------------------------------
//????????GetPlantformDependentInfo
//-----------------------------------------------------------------------------
DWORD?GetPlantformDependentInfo(?DWORD?dwFlag?)????
{?????
????DWORD?current_build;?????
????DWORD?ans?=?0;?????
???
????PsGetVersion(NULL,?NULL,?&current_build,?NULL);?????
???
????switch?(?dwFlag?)????
????{?????
????case?EPROCESS_SIZE:?????
????????if?(current_build?==?2195)?ans?=?0?;????????//?2000，當(dāng)前不支持2000，下同????
????????if?(current_build?==?2600)?ans?=?0x25C;?????//?xp????
????????if?(current_build?==?3790)?ans?=?0x270;?????//?2003????
????????break;?????
????case?PEB_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x1b0;?????
????????if?(current_build?==?3790)??ans?=?0x1a0;????
????????break;?????
????case?FILE_NAME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x174;?????
????????if?(current_build?==?3790)??ans?=?0x164;????
????????break;?????
????case?PROCESS_LINK_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x088;?????
????????if?(current_build?==?3790)??ans?=?0x098;????
????????break;?????
????case?PROCESS_ID_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x084;?????
????????if?(current_build?==?3790)??ans?=?0x094;????
????????break;?????
????case?EXIT_TIME_OFFSET:?????
????????if?(current_build?==?2195)??ans?=?0;?????
????????if?(current_build?==?2600)??ans?=?0x078;?????
????????if?(current_build?==?3790)??ans?=?0x088;????
????????break;?????
????}?????
????return?ans;?????
}


//-----------------------------------------------------------------------------
//????????GetFunctionAddr
//-----------------------------------------------------------------------------
ULONG?GetFunctionAddr(?IN?PCWSTR?FunctionName)
{
????UNICODE_STRING?UniCodeFunctionName;
????RtlInitUnicodeString(?&UniCodeFunctionName,?FunctionName?);
????return?(ULONG)MmGetSystemRoutineAddress(?&UniCodeFunctionName?);???
}

//-----------------------------------------------------------------------------
//????????_PsCreateSystemThread
//-----------------------------------------------------------------------------
NTSTATUS?_PsCreateSystemThread(IN?PKSTART_ROUTINE??StartRoutine)
{
????ULONG?RAddr?=?(ULONG)StartRoutine;??//Routine?Address
????//Get?Process?Info
????LPTSTR???CurProc;
????PEPROCESS?EProcess;
????PsLookupProcessByProcessId(PsGetCurrentProcessId(),?&EProcess);
????CurProc?=(LPTSTR)EProcess;
????CurProc?=CurProc+ProcessNameOffset;

????if?(strncmp((char*)CurProc,"System",6)?!=?0)
????{
????????DbgPrint("Current?Process?:?%s,?StartRoutine?:?%X\n",?(char?*)CurProc,?StartRoutine);
????}
????return?0;
}

//-----------------------------------------------------------------------------
//????????MyPsCreateSystemThread
//-----------------------------------------------------------------------------
__declspec?(naked)void?MyPsCreateSystemThread()
{
????_asm
????{
????????pushad
????????push?[esp+20h+18h]
????????call?_PsCreateSystemThread
????????popad
????????
????????mov?edi,edi
????????push?ebp
????????mov?ebp,esp
????????jmp?PsCreateSystemThreadAddr
????}
}

//-----------------------------------------------------------------------------
//????????Install?Hook
//-----------------------------------------------------------------------------
VOID?InHook()
{
????PsCreateSystemThreadAddr?=?GetFunctionAddr(L"PsCreateSystemThread");

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????//Save?asmCode
????memcpy(PsCreateSystemThreadData,?(PVOID)PsCreateSystemThreadAddr,?5);
????(ULONG)PsCreateSystemThreadAddr?+=?5;

????//Inline?PsCreateSystemThread
????__asm
????{
????????mov?esi,?PsCreateSystemThreadAddr
????????sub?esi,?5
????????mov?byte?ptr[esi],?0xE9
????????lea?eax,?[MyPsCreateSystemThread]
????????sub?eax,?esi
????????sub?eax,?5
????????mov?dword?ptr?[esi+1],eax
????}

????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}

????DbgPrint("Hooked?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Uninstall?Hook
//-----------------------------------------------------------------------------
VOID?UnHook()
{
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????and????????eax,?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????(ULONG)PsCreateSystemThreadAddr?-=?5;
????memcpy((PVOID)PsCreateSystemThreadAddr,?PsCreateSystemThreadData,?5);
????__asm
????{
????????push????eax
????????mov????????eax,?CR0
????????or????????eax,?NOT?0FFFEFFFFh
????????mov????????CR0,?eax
????????pop????????eax
????}
????DbgPrint("UnHook?OK.\n");
????return;
}

//-----------------------------------------------------------------------------
//????????Driver?UnLoad
//-----------------------------------------------------------------------------
void?OnUnload(PDRIVER_OBJECT?pDriverObj)
{
????UnHook();
????DbgPrint("UnLoading?Driver");
}

//-----------------------------------------------------------------------------
//????????Driver?LoadEntry
//-----------------------------------------------------------------------------
NTSTATUS?DriverEntry(PDRIVER_OBJECT?pDriverObj,?PUNICODE_STRING?pRegistryString)
{
????pDriverObj->DriverUnload?=?OnUnload;

????DbgPrint("Loading?Driver");
????ProcessNameOffset?=?GetPlantformDependentInfo(FILE_NAME_OFFSET);
????InHook();
????return?STATUS_SUCCESS;
}
青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

    • <ins id="pjuwb"></ins>
    <blockquote id="pjuwb"><pre id="pjuwb"></pre></blockquote>

    <noscript id="pjuwb"></noscript>
          <sup id="pjuwb"><pre id="pjuwb"></pre></sup>

            <dd id="pjuwb"></dd>
            <abbr id="pjuwb"></abbr>
            
91久久精品一区|
亚洲久久成人|
男男成人高潮片免费网站|
欧美综合国产|
久久av一区|
久久久免费观看视频|
久久一区二区三区超碰国产精品|
久久精品在线|
欧美成人激情在线|
欧美日韩一区自拍|
国产精品青草久久|
伊人久久噜噜噜躁狠狠躁|
亚洲人成欧美中文字幕|
一区二区精品在线观看|
午夜一区二区三视频在线观看|
久久黄色影院|
91久久在线观看|
亚洲欧美三级伦理|
免费看亚洲片|
国产欧美日韩|
9久re热视频在线精品|
午夜视频久久久久久|
欧美成人r级一区二区三区|
亚洲精品日韩欧美|
欧美一区二区三区四区在线观看|
免费欧美视频|
国产在线拍偷自揄拍精品|
亚洲久久一区|
久久久久久久久久久久久久一区|
亚洲黄色精品|
久久精品夜夜夜夜久久|
国产精品海角社区在线观看|
一区精品在线播放|
久久av一区二区三区漫画|
亚洲高清二区|
亚洲免费影院|
欧美人牲a欧美精品|
亚洲第一中文字幕|
欧美一区二区三区四区在线观看地址|
欧美国产日韩精品|
久久成年人视频|
国产精品久久久久免费a∨大胸
|
亚洲区国产区|
久久精品免费电影|
亚洲视频在线观看一区|
蜜桃av久久久亚洲精品|
国产一区二区三区免费在线观看|
一区二区欧美精品|
亚洲国产小视频|
免费日韩成人|
亚洲高清av在线|
噜噜爱69成人精品|
久久黄色网页|
好看的av在线不卡观看|
久久大综合网|
销魂美女一区二区三区视频在线|
国产精品mm|
亚洲一区二区3|
在线亚洲国产精品网站|
欧美视频二区|
午夜精品一区二区三区四区
|
好看的av在线不卡观看|
久久精品亚洲精品国产欧美kt∨|
中日韩男男gay无套|
国产精品99一区|
亚洲欧美伊人|
午夜日韩在线|
伊人久久大香线|
亚洲大胆av|
欧美日韩成人一区|
亚洲字幕在线观看|
先锋影音网一区二区|
国产一二三精品|
欧美成人亚洲成人日韩成人|
蜜桃av一区|
一本一本久久|
亚洲欧美日韩国产综合|
国产综合香蕉五月婷在线|
美女诱惑黄网站一区|
欧美 日韩 国产一区二区在线视频|
亚洲大胆美女视频|
亚洲欧洲日夜超级视频|
国产精品狠色婷|
久久精品国产亚洲a|
久久蜜臀精品av|
一区二区激情|
亚洲欧美综合精品久久成人|
伊人精品在线|
一区二区三区日韩精品视频|
午夜精品剧场|
久久精品国产欧美亚洲人人爽|
狠狠色丁香久久婷婷综合_中|
欧美韩国日本一区|
欧美日韩久久|
久久免费视频网|
欧美日韩国产精品一区|
欧美中文字幕|
欧美高清视频在线|
久久久国产视频91|
欧美裸体一区二区三区|
久久国产精品久久久久久电车|
免费观看久久久4p|
午夜精品婷婷|
欧美精品一区二|
欧美成人精品不卡视频在线观看|
国产精品福利影院|
91久久精品国产91性色tv|
国产一区三区三区|
亚洲视频一二区|
亚洲毛片在线看|
久久综合网络一区二区|
欧美一区二区三区视频在线观看
|
久久伊人免费视频|
亚洲一区精品电影|
嫩草国产精品入口|
久久亚洲精选|
国产视频自拍一区|
亚洲午夜精品久久|
99在线观看免费视频精品观看|
久久大逼视频|
久久精品毛片|
国产区亚洲区欧美区|
一区二区欧美在线观看|
日韩一级视频免费观看在线|
一本久道综合久久精品|
欧美中文字幕久久|
欧美一级在线播放|
国产精品毛片|
亚洲视频1区2区|
中文亚洲欧美|
欧美日韩一区三区四区|
亚洲精品国产精品久久清纯直播
|
国产精品v亚洲精品v日韩精品|
亚洲二区视频在线|
亚洲国产精品成人综合色在线婷婷|
欧美一区二区高清在线观看|
欧美综合激情网|
国产一区二区高清|
久久国产精品亚洲77777|
久久精品三级|
黄色亚洲在线|
玖玖综合伊人|
最新国产成人在线观看|
一区二区三区黄色|
欧美日韩中文在线观看|
一区二区三区国产在线|
亚洲综合色自拍一区|
国产精品一区二区男女羞羞无遮挡|
亚洲专区欧美专区|
久久亚洲综合网|
亚洲国产一区二区三区高清|
国产综合色一区二区三区|
久久精品成人一区二区三区|
久久国产成人|
在线播放亚洲|
欧美精品免费播放|
亚洲一区二区黄|
美女脱光内衣内裤视频久久网站|
亚洲国产精品第一区二区三区
|
久久久久久成人|
亚洲激情视频在线|
午夜日韩在线|
1769国产精品|
欧美日韩精品免费在线观看视频|
亚洲精品日韩精品|
欧美一区二区视频在线观看2020|
国产在线视频欧美一区二区三区|
蜜臀a∨国产成人精品|
99亚洲视频|
久久午夜电影网|
一本色道久久88亚洲综合88|
国产精品一区视频|
欧美暴力喷水在线|
亚洲欧美日韩人成在线播放|
欧美大片网址|
午夜亚洲视频|
亚洲精选在线观看|
国产真实乱偷精品视频免|
欧美日本国产精品|
久久久国产精品一区|
99热在这里有精品免费|
麻豆精品一区二区av白丝在线|
亚洲已满18点击进入久久|
亚洲福利视频二区|
国产日韩欧美在线播放|
欧美啪啪一区|
久久永久免费|
欧美一区二区三区四区在线|
亚洲欧洲日产国产综合网|
久久琪琪电影院|
午夜影视日本亚洲欧洲精品|
亚洲精品一区在线|
一色屋精品视频在线观看网站|
国产精品久久久久7777婷婷|
欧美精品二区|
欧美成人情趣视频|
久久久午夜电影|
欧美在线观看网站|
亚洲欧美日韩在线高清直播|
99国产精品久久久久久久|