HOOK SSDT(inline hook)

HOOK SSDT(inline hook)主要代码

/*
 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
 *                                                                                 *                                                                                *
 * 更多游戏逆向视频www.yxfzedu.com                                                 *
 *                                                                                 *
 * 有任何问题请发邮件至service@yxfzedu.com                                         *
 *                                                                                 *
 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
 */
ULONG g_NtopenkeyAddr;
ULONG g_jmp_addr;
UCHAR g_original_code[5];
__declspec(naked) VOID NewNtOpenKey() {
    __asm {
        //pop eax;
        //add esp, 4;
        mov edi, edi;
        push ebp
        mov ebp, esp;

        jmp g_jmp_addr;
    }
}

VOID HookNtOpenKey() {
    g_NtopenkeyAddr = KeServiceDescriptorTable.ServiceTableBase[182];
    g_jmp_addr = g_NtopenkeyAddr + 5;
    UCHAR code[5];
    ULONG jmp_target;
    jmp_target = (ULONG)NewNtOpenKey - g_NtopenkeyAddr - 5;
    code[0] = 0xe9;
    *(ULONG*)&code[1] = jmp_target;

    PageProtectOFF();
    //g_NtopenkeyAddr = code;
    RtlCopyMemory(g_original_code, (PVOID)g_NtopenkeyAddr, 5);
    RtlCopyMemory((PVOID)g_NtopenkeyAddr, code,5); 
    PageProtectOn();

}
VOID UnHookNtOpenKey() {
    PageProtectOFF();
    //g_NtopenkeyAddr = code;
    RtlCopyMemory((PVOID)g_NtopenkeyAddr, g_original_code, 5);
    PageProtectOn();
}

更多游戏逆向视频www.yxfzedu.com