|
|
本帖最后由 chilun 于 2011-6-19 11:16 编辑
#define KeGetPreviousMode() (KeGetCurrentThread()->PreviousMode)
typedef struct _AUX_ACCESS_DATA {
PPRIVILEGE_SET PrivilegesUsed;
GENERIC_MAPPING GenericMapping;
ACCESS_MASK AccessesToAudit;
ACCESS_MASK MaximumAuditMask;
} AUX_ACCESS_DATA, *PAUX_ACCESS_DATA;
NTSTATUS
SeCreateAccessState(
PACCESS_STATE AccessState,
PAUX_ACCESS_DATA AuxData,
ACCESS_MASK DesiredAccess,
PGENERIC_MAPPING GenericMapping
);
POBJECT_TYPE PsProcessType;
extern"C" void _stdcall ProbeForWriteHandle(PVOID);
extern"C" void ProbeForReadSmallStructure(PVOID,ULONG,ULONG);
extern"C" NTSTATUS SeCreateAccessState(PVOID,PVOID,ULONG,PVOID);
LUID SeDebugPrivilege = {0};
NTSTATUS
ObOpenObjectByName (
POBJECT_ATTRIBUTES ObjectAttributes,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
PVOID ParseContext,
PHANDLE Handle
);
VOID
SeDeleteAccessState(
PACCESS_STATE AccessState
);
typedef struct _OBJECT_TYPE_INITIALIZER {
USHORT Length;
BOOLEAN UseDefaultObject;
BOOLEAN Reserved;
ULONG InvalidAttributes;
UCHAR GenericMapping[0x10];
ULONG ValidAccessMask;
BOOLEAN SecurityRequired;
BOOLEAN MaintainHandleCount;
BOOLEAN MaintainTypeList;
USHORT PoolType;
ULONG DefaultPagedPoolCharge;
ULONG DefaultNonPagedPoolCharge;
PVOID DumpProcedure;
PVOID OpenProcedure;
PVOID CloseProcedure;
PVOID DeleteProcedure;
PVOID ParseProcedure;
PVOID SecurityProcedure;
PVOID QueryNameProcedure;
PVOID OkayToCloseProcedure;
} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;
typedef struct _OBJECT_TYPE {
UCHAR Mutex[0x38];
LIST_ENTRY TypeList;
UNICODE_STRING Name;
PVOID DefaultObject;
ULONG Index;
ULONG TotalNumberOfObjects;
ULONG TotalNumberOfHandles;
ULONG HighWaterNumberOfObjects;
ULONG HighWaterNumberOfHandles;
OBJECT_TYPE_INITIALIZER TypeInfo;
} OBJECT_TYPE, *POBJECT_TYPE;
NTSTATUS
PsLookupProcessThreadByCid(
PCLIENT_ID Cid,
PEPROCESS *Process,
PETHREAD *Thread
);
NTSTATUS
PsLookupProcessByProcessId(
HANDLE ProcessId,
PEPROCESS *Process
);
NTSTATUS
PsLookupThreadByThreadId(
HANDLE ThreadId,
PETHREAD *Thread
);
NTSTATUS
ObOpenObjectByPointer (
PVOID Object,
ULONG HandleAttributes,
PACCESS_STATE PassedAccessState,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PHANDLE Handle
);
NTSTATUS WINAPI
HxNtOpenProcess (
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId
)
{
HANDLE Handle;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PEPROCESS Process;
PETHREAD Thread;
CLIENT_ID CapturedCid={0};
BOOLEAN ObjectNamePresent;
BOOLEAN ClientIdPresent;
ACCESS_STATE AccessState;
AUX_ACCESS_DATA AuxData;
ULONG Attributes;
KIRQL CurrentIrql;
PAGED_CODE();
CurrentIrql = KeGetCurrentIrql();
if(CurrentIrql>PASSIVE_LEVEL)
{
KeLowerIrql(PASSIVE_LEVEL);
}
//DbgPrint("HxNtOpenProcess IRQL: %u \n",CurrentIrql);
DbgPrint("OD已经调用过我们的HxNtOpenProcess ()函数 \n");
PreviousMode = KeGetPreviousMode();
if (PreviousMode != KernelMode) {
_try {
ProbeForWriteHandle (ProcessHandle);
ProbeForReadSmallStructure (ObjectAttributes,
sizeof(OBJECT_ATTRIBUTES),
sizeof(ULONG));
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
//Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, UserMode);
Attributes=ObjectAttributes->Attributes;
if (ARGUMENT_PRESENT (ClientId)) {
ProbeForReadSmallStructure (ClientId, sizeof (CLIENT_ID), sizeof (ULONG));
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
} else {
ClientIdPresent = FALSE;
}
} _except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode();
}
} else {
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
//Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, KernelMode);
Attributes=ObjectAttributes->Attributes;
if (ARGUMENT_PRESENT (ClientId)) {
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
} else {
ClientIdPresent = FALSE;
}
}
if (ObjectNamePresent && ClientIdPresent) {
return STATUS_INVALID_PARAMETER_MIX;
}
Status = SeCreateAccessState(
&AccessState,
&AuxData,
DesiredAccess,
&(*PsProcessType)->TypeInfo.GenericMapping
);
if ( !NT_SUCCESS(Status) ) {
return Status;
}
if (SeSinglePrivilegeCheck( SeDebugPrivilege, PreviousMode )) {
if ( AccessState.RemainingDesiredAccess & MAXIMUM_ALLOWED ) {
AccessState.PreviouslyGrantedAccess |= PROCESS_ALL_ACCESS;
} else {
AccessState.PreviouslyGrantedAccess |= ( AccessState.RemainingDesiredAccess );
}
AccessState.RemainingDesiredAccess = 0;
}
if (ObjectNamePresent) {
Status = ObOpenObjectByName(
ObjectAttributes,
*PsProcessType,
PreviousMode,
&AccessState,
0,
NULL,
&Handle
);
SeDeleteAccessState( &AccessState );
if ( NT_SUCCESS(Status) ) {
_try {
*ProcessHandle = Handle;
} _except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode ();
}
}
return Status;
}
if ( ClientIdPresent ) {
Thread = NULL;
if (CapturedCid.UniqueThread) {
Status = PsLookupProcessThreadByCid(
&CapturedCid,
&Process,
&Thread
);
if (!NT_SUCCESS(Status)) {
SeDeleteAccessState( &AccessState );
return Status;
}
} else {
Status = PsLookupProcessByProcessId(
CapturedCid.UniqueProcess,
&Process
);
if ( !NT_SUCCESS(Status) ) {
SeDeleteAccessState( &AccessState );
return Status;
}
}
Status = ObOpenObjectByPointer(
Process,
Attributes,
&AccessState,
0,
*PsProcessType,
PreviousMode,
&Handle
); //得到进程句柄
SeDeleteAccessState( &AccessState );
if (Thread) {
ObDereferenceObject(Thread);
}
ObDereferenceObject(Process);
if (NT_SUCCESS (Status)) {
_try {
*ProcessHandle = Handle;
} _except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode ();
}
}
return Status;
}
return STATUS_INVALID_PARAMETER_MIX;
//}
}
自定义NtOpenProcess编译通不过，，哪位帮帮忙改一下，给点资料
Compiling...
Driver.cpp
d:\我的文档\桌面\Driver.cpp(663) : error C2027: use of undefined type '_KTHREAD'
C:\WINDDK\2600\INC\DDK\W2K\NTDDK.h(75) : see declaration of '_KTHREAD'
d:\我的文档\桌面\Driver.cpp(663) : error C2227: left of '->PreviousMode' must point to class/struct/union
d:\我的文档\桌面\Driver.cpp(701) : error C2819: type '_OBJECT_TYPE' does not have an overloaded member 'operator ->'
d:\我的文档\桌面\Driver.h(164) : see declaration of '_OBJECT_TYPE'
d:\我的文档\桌面\Driver.cpp(701) : error C2227: left of '->TypeInfo' must point to class/struct/union
d:\我的文档\桌面\\Driver.cpp(702) : error C2228: left of '.GenericMapping' must have class/struct/union type
d:\我的文档\桌面\Driver.cpp(723) : error C2664: 'ObOpenObjectByName' : cannot convert parameter 2 from 'struct _OBJECT_TYPE' to 'struct _OBJECT_TYPE *'
No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called
d:\我的文档\桌面\Driver.cpp(764) : error C2664: 'ObOpenObjectByPointer' : cannot convert parameter 5 from 'struct _OBJECT_TYPE' to 'struct _OBJECT_TYPE *'
No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called
Error executing cl.exe.
HelloDDK.sys - 7 error(s), 0 warning(s)
|
|
发表于 2011-6-11 11:02:54
发表于 2011-6-12 20:01:46
