InlineHookPsTerminateProcess(0环)

PsTerminateProcess函数用于结束一个进程。

#include <ntddk.h>

typedef NTSTATUS (*PSPTERMINATETPROCESS)(
                    PEPROCESS Process,
                    NTSTATUS ExitStatus
                    );
PSPTERMINATETPROCESS PspTerminateProcess;

typedef NTSTATUS (*NTQUERYSYSTEMINFORMATION)(
                IN ULONG    SystemInformationClass,
                OUT PVOID   SystemInformation,
                IN ULONG    SystemInformationLength,
                OUT PULONG  ReturnLength OPTIONAL);
typedef unsigned long DWORD;    
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation;
#define SystemModuleInformation 11  
typedef struct _SYSTEM_MODULE_INFORMATION
{
    ULONG  Reserved[2];
    PVOID  Base;
    ULONG  Size;
    ULONG  Flags;
    USHORT Index;
    USHORT Unknown;
    USHORT LoadCount;
    USHORT ModuleNameOffset;
    CHAR   ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

ULONG GetFunctionAddr( IN PCWSTR FunctionName)
    {
        UNICODE_STRING UniCodeFunctionName;

        RtlInitUnicodeString( &UniCodeFunctionName, FunctionName );
        return (ULONG)MmGetSystemRoutineAddress( &UniCodeFunctionName );    

    }

VOID DoFind(IN PVOID pContext)
    {
        NTSTATUS ret;
        PSYSTEM_MODULE_INFORMATION  module = NULL;
        ULONG n=0;
        void  *buf    = NULL;
        ULONG ntosknlBase;
        ULONG ntosknlEndAddr;
        ULONG curAddr;
        ULONG code1_sp3=0x8b55ff8b,code2_sp3=0xA16456EC,code3_sp3=0x00000124,code4_sp3=0x3B08758B;
        ULONG i;

        NtQuerySystemInformation=(NTQUERYSYSTEMINFORMATION)GetFunctionAddr(L"NtQuerySystemInformation");
        if (!NtQuerySystemInformation) 
        {
            DbgPrint("Find NtQuerySystemInformation faild!");
            goto Ret;
        }
        ret=NtQuerySystemInformation(SystemModuleInformation,&n,0,&n);
        if (NULL==( buf=ExAllocatePoolWithTag(NonPagedPool, n, 'DFSP')))
        {
            DbgPrint("ExAllocatePool() failed\n" );
            goto Ret;
        }
        ret=NtQuerySystemInformation(SystemModuleInformation,buf,n,NULL);
        if (!NT_SUCCESS(ret))   {
            DbgPrint("NtQuerySystemInformation faild!");
            goto Ret;
        } 
        module=(PSYSTEM_MODULE_INFORMATION)((PULONG)buf+1);
        ntosknlEndAddr=(ULONG)module->Base+(ULONG)module->Size;
        ntosknlBase=(ULONG)module->Base;
        curAddr=ntosknlBase;
        ExFreePool(buf);
        for (i=curAddr;i<=ntosknlEndAddr;i++)
        {
                if (*((ULONG *)i)==code1_sp3) 
                {
                    if (*((ULONG *)(i+4))==code2_sp3) 
                    {
                        if (*((ULONG *)(i+8))==code3_sp3) 
                        {
                            if (*((ULONG *)(i+12))==code4_sp3) 
                            {
                                PspTerminateProcess=(PSPTERMINATETPROCESS)i;
                                break;
                            }
                        }
                    }
                }
        }
Ret:
    PsTerminateSystemThread(STATUS_SUCCESS);
    }

VOID GetPspAddr()
{
        HANDLE hThread;
        PVOID objtowait=0;
        NTSTATUS dwStatus = 
            PsCreateSystemThread(
            &hThread,
                  0,
               NULL,
            (HANDLE)0,
                  NULL,
               DoFind,
            NULL
            );
        NTSTATUS st;
        if ((KeGetCurrentIrql())!=PASSIVE_LEVEL)
        {
            st=KfRaiseIrql(PASSIVE_LEVEL);

        }
        if ((KeGetCurrentIrql())!=PASSIVE_LEVEL)
        {

            return;
        }

        ObReferenceObjectByHandle(
            hThread,
            THREAD_ALL_ACCESS,
            NULL,
            KernelMode,
            &objtowait,
            NULL
            ); 

        st=KeWaitForSingleObject(objtowait,Executive,KernelMode,FALSE,NULL); //NULL表示无限期等待.
        return;

}

NTSTATUS CheckPspTerminateProcessIsHook()
{
    int             i       = 0;
    char            *addr   = (char *)PspTerminateProcess;
    char            code[]  = { 0x8b, 0xff, 0x55, 0x8b, 0xec};

    while(i<5)
    {
        DbgPrint("0x%02X", (unsigned char)addr[i]);
        if(addr[i] != code[i])
        {
            return STATUS_UNSUCCESSFUL;
        }
        i++;
    }
    return STATUS_SUCCESS;
}

int MyPspTerminateProcess(
                          PEPROCESS Process,
                          NTSTATUS ExitStatus
                          )
{
    DbgPrint("PspTerminateProcess hello\n");
    return 1;
}

_declspec(naked) T_PspTerminateProcess(
                                       PEPROCESS Process,
                                       NTSTATUS ExitStatus
                                       )
{
    _asm
    {
        mov edi, edi
            push ebp
            mov ebp ,esp
            push [ebp+0ch]
            push [ebp+8]
            call MyPspTerminateProcess 
            cmp eax,1
            jz end
            mov eax,PspTerminateProcess 
            add eax,5 
            jmp eax

end:
        pop ebp
            retn 8
    }
}

VOID InlineHookPspTerminateProcess()
{ 

    int             JmpOffSet = 0;
    unsigned char   JmpCode[5] = { 0xe9, 0x00, 0x00, 0x00, 0x00 };
    KIRQL           oldIrql;

    if (PspTerminateProcess == 0)
    {
        DbgPrint("PspTerminateProcess NOT FOUND\n");
        return;
    }

    DbgPrint("PspTerminateProcess is found at:0x%08x\n", (ULONG)PspTerminateProcess );

    DbgPrint("T_PspTerminateProcess is:%x\n",T_PspTerminateProcess);
    JmpOffSet= (char*)T_PspTerminateProcess - (char*)PspTerminateProcess - 5;
    DbgPrint("JmpOffSet is:%x\n",JmpOffSet);
    RtlCopyMemory ( JmpCode+1, &JmpOffSet, 4 );

    _asm
    {
        CLI
        MOV EAX, CR0
        AND EAX, NOT 10000H
        MOV CR0, EAX
    }
    oldIrql = KeRaiseIrqlToDpcLevel();
    RtlCopyMemory ( PspTerminateProcess, JmpCode, 5 );
    DbgPrint("PspTerminateProcess is hook now \n");
    KeLowerIrql(oldIrql);

    _asm
    {
        MOV EAX, CR0
        OR EAX, 10000H
        MOV CR0, EAX
        STI
    }

}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
    //  在win2000上是三字节
    //  push ebp
    //  mov ebp, esp
    //      　　
    //  到了winxp以及后续系统上，则变成了五字节
    //  mov edi, edi
    //  push ebp
    //  mov ebp, esp
    //  函数的序言

    unsigned char Code[5]={0x8b,0xff,0x55,0x8b,0xec};

    _asm
    {
        CLI
        MOV eax, CR0
        AND eax, NOT 10000H
        MOV CR0, eax

        pushad
        mov edi, PspTerminateProcess
        mov eax, dword ptr Code[0]
        mov [edi], eax
        mov al, byte ptr Code[4]
        mov [edi+4], al
        popad

        MOV eax, CR0
        OR eax, 10000H
        MOV CR0, eax
        STI
    }

    DbgPrint("Goodbye driver\n");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
    GetPspAddr();
    if(PspTerminateProcess == NULL)
    {
        DbgPrint("PspFunc Not Find!\n");
        return STATUS_UNSUCCESSFUL;
    }

    if(STATUS_SUCCESS != CheckPspTerminateProcessIsHook())
    {
        DbgPrint("PspTerminateProcess Match Failed !");
        return STATUS_UNSUCCESSFUL;
    }

    InlineHookPspTerminateProcess();

    pDriverObject->DriverUnload = DriverUnload;
    return STATUS_SUCCESS;

}