上篇文章知道了尋找SSDT表的方法，這篇記錄一下如何實現SSDT表的Hook。

下面以Hook NtOpenProcess為例，之前我查SSDT表發現NtOpenProcess函式的標號為35，用XT等工具也能檢視。

廢話不多說，上程式碼。

首先感謝老大（Tesla.Angela）對我的幫助

//相關宣告
__int64 __readmsr(int register);
unsigned __int64 __readcr0(void);
void __writecr0( 
	unsigned __int64 Data 
	);
void _disable(void);
void _enable(void);

//_SYSTEM_SERVICE_TABLE結構宣告
typedef struct _SYSTEM_SERVICE_TABLE{
	PVOID  		ServiceTableBase; 
	PVOID  		ServiceCounterTableBase; 
	ULONGLONG  	NumberOfServices; 
	PVOID  		ParamTableBase; 
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE;

//_SERVICE_DESCRIPTOR_TABLE結構宣告
typedef struct _SERVICE_DESCRIPTOR_TABLE{
	SYSTEM_SERVICE_TABLE ntoskrnl;  // ntoskrnl.exe (native api)
	SYSTEM_SERVICE_TABLE win32k;    // win32k.sys   (gdi/user)
	SYSTEM_SERVICE_TABLE Table3;    // not used
	SYSTEM_SERVICE_TABLE Table4;    // not used
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;

//宣告要尋找程序名用的函式
NTKERNELAPI UCHAR * PsGetProcessImageFileName(PEPROCESS Process);

//定義NTOPENPROCESS
typedef NTSTATUS (__stdcall *NTOPENPROCESS)(OUT PHANDLE  ProcessHandle,
									IN ACCESS_MASK  DesiredAccess,
									IN POBJECT_ATTRIBUTES  ObjectAttributes, 
									IN OPTIONAL PCLIENT_ID  ClientId);
NTOPENPROCESS OldOpenProcess = NULL;
ULONG OldTpVal;

//定義自己的NtOpenProcess
NTSTATUS __stdcall Fake_NtOpenProcess(OUT PHANDLE  ProcessHandle,
									   IN ACCESS_MASK  DesiredAccess,
									   IN POBJECT_ATTRIBUTES  ObjectAttributes, 
									   IN OPTIONAL PCLIENT_ID  ClientId)
{
	PEPROCESS process = NULL;
	NTSTATUS st = ObReferenceObjectByHandle(<span style="font-family: Arial, Helvetica, sans-serif;">ClientId->processid</span>
,0,*PsProcessType,KernelMode,&process,NULL);
	DbgPrint("進入HOOK函式.\n");
	if (NT_SUCCESS(st))
	{
		if (!_stricmp((char*)PsGetProcessImageFileName(process),"CrackMe3.exe"))
		{
			
			return STATUS_ACCESS_DENIED;
		}
		else
		{
			return OldOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId);
		} 
	}
	else
	{
		return STATUS_ACCESS_DENIED;
	}
}

//關閉頁面保護
KIRQL WPOFFx64()
{
	KIRQL irql=KeRaiseIrqlToDpcLevel();
	UINT64 cr0=__readcr0();
	cr0 &= 0xfffffffffffeffff;
	__writecr0(cr0);
	_disable();
	return irql;
}
//開啟頁面保護
void WPONx64(KIRQL irql)
{
	UINT64 cr0=__readcr0();
	cr0 |= 0x10000;
	_enable();
	__writecr0(cr0);
	KeLowerIrql(irql);
}

//老外定位KeServiceDescriptorTable的方法
ULONGLONG GetKeServiceDescriptorTable64() 
{
	char KiSystemServiceStart_pattern[] = "\x8B\xF8\xC1\xEF\x07\x83\xE7\x20\x25\xFF\x0F\x00\x00";	//特徵碼
	ULONGLONG CodeScanStart = (ULONGLONG)&_strnicmp;
	ULONGLONG CodeScanEnd = (ULONGLONG)&KdDebuggerNotPresent;
	UNICODE_STRING Symbol;
	ULONGLONG i, tbl_address, b;
	for (i = 0; i < CodeScanEnd - CodeScanStart; i++)
	{
		if (!memcmp((char*)(ULONGLONG)CodeScanStart +i, (char*)KiSystemServiceStart_pattern,13))
		{ 
			for (b = 0; b < 50; b++)
			{
				tbl_address = ((ULONGLONG)CodeScanStart+i+b);
				if (*(USHORT*) ((ULONGLONG)tbl_address ) == (USHORT)0x8d4c)
					return ((LONGLONG)tbl_address +7) + *(LONG*)(tbl_address +3);
			}
		}
	}
	return 0;
}

//根據KeServiceDescriptorTable找到SSDT基址
PULONG GetSSDTBaseAddress()
{
	PULONG addr = NULL;
	PSYSTEM_SERVICE_TABLE ssdt = (PSYSTEM_SERVICE_TABLE)GetKeServiceDescriptorTable64();
	addr = (PULONG)(ssdt->ServiceTableBase);
	return addr;
}

//根據標號找到SSDT表中函式的地址
ULONGLONG GetFuncAddr(ULONG id)
{
	LONG dwtmp = 0;
	ULONGLONG addr = 0;
	PULONG stb = NULL;
	stb = GetSSDTBaseAddress();
	dwtmp = stb[id];
	dwtmp = dwtmp >> 4;
	addr = (LONGLONG)dwtmp + (ULONGLONG)stb;
	DbgPrint("SSDT TABLE BASEADDRESS:%llx",addr);
	return addr;
}

//設定函式的偏移地址，注意其中引數的處理。低四位放了引數個數減4個引數。如果引數小於等於4的時候為0
#define SETBIT(x,y) x|=(1<<y) //將X的第Y位置1
#define CLRBIT(x,y) x&=~(1<<y) //將X的第Y位清0
#define GETBIT(x,y) (x & (1 << y)) //取X的第Y位，返回0或非0
ULONG GetOffsetAddress(ULONGLONG FuncAddr, CHAR paramCount)
{
	LONG dwtmp = 0,i;
	CHAR b = 0, bits[4] = {0};
	PULONG stb = NULL;
	stb = GetSSDTBaseAddress();
	dwtmp = (LONG)(FuncAddr - (ULONGLONG)stb);
	dwtmp = dwtmp << 4;
	if (paramCount>4)
	{
		paramCount = paramCount - 4;
	}
	else
	{
		paramCount = 0;
	}
	memcpy(&b,&dwtmp,1);
	for (i=0;i<4;i++)
	{
		bits[i] = GETBIT(paramCount,i);
		if (bits[i])
		{
			SETBIT(b,i);
		}
		else
		{
			CLRBIT(b,i);
		}
	}
	memcpy(&dwtmp,&b,1);
	return dwtmp;
}

//核心中用不到的方法，二次跳轉用(自己的NtOpenProcess跳到KeBugCheckEx函式，然後再KeBugCheckEx函式跳到要Hook的NtOpenProcess)
VOID FuckKeBugCheckEx()
{
	KIRQL irql;
	ULONGLONG myfun;
	UCHAR jmp_code[]="\xFF\x25\x00\x00\x00\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF";
	myfun=(ULONGLONG)Fake_NtOpenProcess;
	memcpy(jmp_code+6,&myfun,8);
	irql=WPOFFx64();
	memset(KeBugCheckEx,0x90,15);
	memcpy(KeBugCheckEx,jmp_code,14);
	WPONx64(irql);
}

//Hook ssdt
VOID HookSSDT()
{
	KIRQL irql;
	LONG dwtmp = 0;
	PULONG stb = NULL;
	//1.get old address
	OldOpenProcess = (NTOPENPROCESS)GetFuncAddr(35);
	DbgPrint("Old_NtOpenProcess:%llx",(ULONGLONG)OldOpenProcess);
	//2.show new address
	stb = GetSSDTBaseAddress();
	//3.get offset value
	dwtmp = GetOffsetAddress((ULONGLONG)KeBugCheckEx,4);
	//set kebugcheckex
	FuckKeBugCheckEx();
	//4.record  old offset  value
	OldTpVal = stb[35];
	irql = WPOFFx64();
	stb[35] = GetOffsetAddress((ULONGLONG)KeBugCheckEx,2);
	WPONx64(irql);
	DbgPrint("KeBugCheckEx:%llx",(ULONGLONG)KeBugCheckEx);
	DbgPrint("New_NtOpenProcess:%llx",GetFuncAddr(35));
}

//UN hook
VOID UnhookSSDT()
{
	KIRQL irql;
	PULONG stb=NULL;
	stb = GetSSDTBaseAddress();
	//老函式的地址複製回來
	irql=WPOFFx64();
	stb[35]=OldTpVal;
	WPONx64(irql);
}
 

相關解釋：

1.為什麼要二次跳轉？

WIN64核心裡的每個驅動都不在同一個4GB裡，4位元組的整數只能表示4GB的範圍，所以不管怎麼修改這個4位元組都不會跳到你的代理函式，因為你的驅動不可能跟NTOSKRNL在同一個4GB裡面。

2.引數的處理：

函式地址的低四位存放了函式引數個數減4的數字，如果引數為5，那麼低四位的數字為1，如果引數個數小於等於4個，低四位的數位0，可以再WINDBG裡面檢視到。