1
2
3 #include "ntddk.h"
4 #include <stdio.h>
5
6
7
8 #define DWORD unsigned long
9 #define WORD unsigned short
10 #define BOOL unsigned long
11 #define BYTE unsigned char
12 //SIDT 指令在内存中为每个CPU寻找IDT，返回IDTINFO的地址,
13 typedef struct
14 {
15 WORD IDTLimit ;
16 WORD LowIDTBase ;
17 WORD HideIDTBase ;
18 }IDTINFO;
19
20
21
22
23 #define MAKELONG(a, b) ((LONG)(( ( WORD )( a ) ) | ( ( DWORD )( ( WORD ) ( b )) ) << 16 ))
24
25
26
27 #pragma pack(1)
28
29
30
31 //IDT中每一项都是这个结构
32 typedef struct
33 {
34 WORD LowOffset ; // 这个和HiOffset 组成了中断处理程序的地址
35 WORD selector ;
36 BYTE unused_lo ;
37 unsigned char unusaed_hi : 5 ;
38 unsigned char DPL : 2;
39 unsigned char P : 1 ;
40 WORD HiOffset ;
41 }IDTENTRY;
42
43
44
45 #pragma pack()
46
47
48
49
50 DWORD KiRealSystemServicISR_Ptr ;
51 #define IDT_SYSTEM_SERVICE 0x2E
52
53
54
55
56 //
57 _declspec(naked) MyKisystemService ()
58 {
59 KdBreakPoint();
60 __asm
61 {
62 pushad
63 pushfd
64 push fs
65 mov bx,0x30
66 mov fs,bx
67 push dx
68 push es
69 Finish:
70 pop es
71 pop dx
72 pop fs
73 popfd
74 popad
75
76 jmp KiRealSystemServicISR_Ptr ;
77 }
78
79
80
81 }
82
83
84
85
86
87
88
89
90
91
92
93 int HookInterRuput ( )
94
95
96
97 {
98
99 IDTINFO Idt_info ;
100 IDTENTRY * Idt_Entry ;
101 IDTENTRY * Idt2_Entry ;
102 KdBreakPoint();
103 __asm
104 {
105 sidt Idt_info ; //返回IDT
106 }
107
108
109
110 Idt_Entry = (IDTINFO*) MAKELONG (Idt_info.LowIDTBase,Idt_info.HideIDTBase);
111 //返回的是0x2e中断处理程序的地址
112 KiRealSystemServicISR_Ptr = MAKELONG( Idt_Entry[IDT_SYSTEM_SERVICE].LowOffset,\
113 Idt_Entry[IDT_SYSTEM_SERVICE].HiOffset ) ;
114
115
116
117
118 Idt2_Entry = &(Idt_Entry[IDT_SYSTEM_SERVICE]) ;
119
120
121
122
123 __asm
124 {
125 cli ;
126 lea eax, MyKisystemService // 将我们的恶意函数
127 mov ebx,Idt2_Entry
128 mov [ebx] ,ax
129 shr eax,16
130 mov [ebx+6], ax
131 sti ;
132 }
133
134
135
136 return 1 ;
137 }
138
139
140
141
142 /*NTSTATUS UnLoadDrivice ()
143 {
144 IDTINFO Idt_info ;
145 IDTINFO * Idt_Entry ;
146 IDTINFO * Idt2_Entry ;
147 _asm
148 {
149 sidt Idt_info ; //返回IDT
150 }
151
152
153
154 Idt_Entry = (IDTINFO*) MAKELONG (Idt_info.LowIDTBase,Idt_info.HideIDTBase)
155 Idt2_Entry = &(Idt_Entry[IDT_SYSTEM_SERVICE]) ;
156 *Idt2_Entry = KiRealSystemServicISR_Ptr ;
157 return NTSTATUS_SUCCESS ;
158 } */
159
160
161
162 NTSTATUS DriverEntry(PDRIVER_OBJECT driver , PUNICODE_STRING reg_path)
163
164
165
166 {
167 HookInterRuput() ;
168 //OBJ->DriverUnload = UnLoadDrivice ;
169
170
171
172 return STATUS_SUCCESS ;
173 }
174
175 /
