簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼_第1頁
簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼_第2頁
簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼_第3頁
簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼_第4頁
簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼_第5頁
已閱讀5頁，還剩3頁未讀， 繼續(xù)免費(fèi)閱讀

下載本文檔

版權(quán)說明：本文檔由用戶提供并上傳，收益歸屬內(nèi)容提供方，若內(nèi)容存在侵權(quán)，請(qǐng)進(jìn)行舉報(bào)或認(rèn)領(lǐng)

文檔簡介

本文格式為Word版，下載可任意編輯——簡單恢復(fù)NtOpenProcess函數(shù)驅(qū)動(dòng)源碼#include#include

typedefstruct_SERVICE_DESCRIPTOR_TABLE{

PVOIDServiceTableBase;

PULONGServiceCounterTableBase;ULONGNumberTableBase;ULONGParamTableBase;

}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;externPSERVICE_DESCRIPTOR_TABLEKeServiceDescriptorTable;typedefNTSTATUS(*NTOPENTHREAD)(OUTPHANDLEThreadHandle,INACCESS_MASKDesiredAccess,INPOBJECT_ATTRIBUTESObjectAttributes,INPCLIENT_IDClientId);

typedefNTSTATUS(*ZWOPENPROCESS)(OUTPHANDLEProcessHandle,INACCESS_MASKAccessMask,INPOBJECT_ATTRIBUTESObjectAttributes,INPCLIENT_IDClientId);

typedefNTSTATUS(*NTREADVIRTUALMEMORY)(INHANDLEProcessHandle,INPVOIDBaseAddress,OUTPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);

typedefNTSTATUS(*NTWRITEVIRTUALMEMORY)(INHANDLEProcessHandle,INPVOIDBaseAddress,INPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);NTOPENTHREADRealNtOpenThread;

ZWOPENPROCESSRealZwOpenProcess;

NTREADVIRTUALMEMORYRealNtReadVirtualMemory;NTWRITEVIRTUALMEMORYRealNtWriteVirtualMemory;VOIDHook();VOIDUnHook();

VOIDTD_DRIVER_UNLOAD(PDRIVER_OBJECTDriverObject);NTSTATUSreturnvalue;ULONGNtOpenProcess_15;ULONGNtOpenThread_15;

ULONGNtReadVirtualMemory_12;ULONGNtWriteVirtualMemory_12;

ULONGOldServiceAddress1,OldServiceAddress2,OldServiceAddress3,OldServiceAddress4;__declspec(naked)NTSTATUS__stdcallMy_NtReadVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,ULONGReturnLength){returnvalue

=(NTSTATUS)(NTREADVIRTUALMEMORY)RealNtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnLength);__asm{push1Chpush804DA4E0hmoveax,80538FB0hcalleaxjmp[NtReadVirtualMemory_12]}}

__declspec(naked)NTSTATUS__stdcallMy_NtWriteVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,PULONGReturnLength){returnvalue

=(NTSTATUS)(NTWRITEVIRTUALMEMORY)RealNtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnLength);__asm{push1Chpush804DA4F8hmoveax,80538FB0hcalleaxjmp[NtWriteVirtualMemory_12]}}

__declspec(naked)NTSTATUS__stdcallMy_NtOpenProcess(PHANDLEProcessHandle,ACCESS_MASKAccessMask,POBJECT_ATTRIBUTESObjectAttributes,PCLIENT_IDClientId){returnvalue

=(NTSTATUS)(ZWOPENPROCESS)RealZwOpenProcess(ProcessHandle,AccessMask,ObjectAttributes,ClientId);__asm{push0C4hpush804DAAB0hmoveax,80538FB0hcalleaxjmp[NtOpenProcess_15]}}

__declspec(naked)NTSTATUS__stdcallMy_NtOpenThread(PHANDLEThreadHandle,ACCESS_MASKAccessMask,POBJECT_ATTRIBUTESObjectAttributes,PCLIENT_IDClientId){returnvalue

=(NTSTATUS)(NTOPENTHREAD)RealNtOpenThread(ThreadHandle,AccessMask,ObjectAttributes,ClientId);__asm{push0C0hpush804DAAD8hmoveax,80538FB0hcalleaxjmp[NtOpenThread_15]}}

VOIDHook(){ULONGNtOpenProcess_Cur_Addr;ULONGNtOpenThread_Cur_Addr;ULONGNtReadVirtualMemory_Cur_Addr;ULONGNtWriteVirtualMemory_Cur_Addr;NtOpenProcess_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;NtOpenThread_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x80*4;NtReadVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0BA*4;

NtWriteVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;OldServiceAddress1=*(ULONG*)NtOpenProcess_Cur_Addr;OldServiceAddress2=*(ULONG*)NtOpenThread_Cur_Addr;OldServiceAddress3=*(ULONG*)NtReadVirtualMemory_Cur_Addr;OldServiceAddress4=*(ULONG*)NtWriteVirtualMemory_Cur_Addr;RealZwOpenProcess=(ZWOPENPROCESS)OldServiceAddress1;RealNtOpenThread=(NTOPENTHREAD)OldServiceAddress2;RealNtReadVirtualMemory=(NTREADVIRTUALMEMORY)OldServiceAddress3;RealNtWriteVirtualMemory=(NTWRITEVIRTUALMEMORY)OldServiceAddress4;NtOpenProcess_15=OldServiceAddress1+15;NtOpenThread_15=OldServiceAddress2+15;NtReadVirtualMemory_12=OldServiceAddress3+12;NtWriteVirtualMemory_12=OldServiceAddress4+12;__asm{climoveax,cr0andeax,not10000hmovcr0,eax}*((ULONG*)NtOpenProcess_Cur_Addr)=(ULONG)My_NtOpenProcess;*((ULONG*)NtOpenThread_Cur_Addr)=(ULONG)My_NtOpenThread;*((ULONG*)NtReadVirtualMemory_Cur_Addr)=(ULONG)My_NtReadVirtualMemory;*((ULONG*)NtWriteVirtualMemory_Cur_Addr)=(ULONG)My_NtWriteVirtualMemory;__asm{moveax,cr0oreax,10000hmovcr0,eaxsti}KdPrint((\編程部落過游戲保護(hù)驅(qū)動(dòng)恢復(fù)成功...\\n\

KdPrint((“\\URL:DangDn〞));}

VOIDUnHook(){ULONGNtOpenProcess_Cur_Addr;ULONGNtOpenThread_Cur_Addr;ULONGNtReadVirtualMemory_Cur_Addr;ULONGNtWriteVirtualMemory_Cur_Addr;NtOpenProcess_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;

NtOpenThread_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x80*4;NtReadVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0BA*4;NtWriteVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;__asm{climoveax,cr0andeax,not10000hmovcr0,eax}*((ULONG*)NtOpenProcess_Cur_Addr)=(ULONG)Ol

溫馨提示

  • 1. 本站所有資源如無特殊說明，都需要本地電腦安裝OFFICE2007和PDF閱讀器。圖紙軟件為CAD,CAXA,PROE,UG,SolidWorks等.壓縮文件請(qǐng)下載最新的WinRAR軟件解壓。
  • 2. 本站的文檔不包含任何第三方提供的附件圖紙等，如果需要附件，請(qǐng)聯(lián)系上傳者。文件的所有權(quán)益歸上傳用戶所有。
  • 3. 本站RAR壓縮包中若帶圖紙，網(wǎng)頁內(nèi)容里面會(huì)有圖紙預(yù)覽，若沒有圖紙預(yù)覽就沒有圖紙。
  • 4. 未經(jīng)權(quán)益所有人同意不得將文件中的內(nèi)容挪作商業(yè)或盈利用途。
  • 5. 人人文庫網(wǎng)僅提供信息存儲(chǔ)空間，僅對(duì)用戶上傳內(nèi)容的表現(xiàn)方式做保護(hù)處理，對(duì)用戶上傳分享的文檔內(nèi)容本身不做任何修改或編輯，并不能對(duì)任何下載內(nèi)容負(fù)責(zé)。
  • 6. 下載文件中如有侵權(quán)或不適當(dāng)內(nèi)容，請(qǐng)與我們聯(lián)系，我們立即糾正。
  • 7. 本站不保證下載資源的準(zhǔn)確性、安全性和完整性, 同時(shí)也不承擔(dān)用戶因使用這些下載資源對(duì)自己和他人造成任何形式的傷害或損失。

評(píng)論

0/150

提交評(píng)論