|
|
发表于 2011-9-21 19:27:30
|
显示全部楼层
baidu得到：
先修改主页，加载驱动就基本OK了吧！！！！- *++
- HookZwSetValueKey
- 编译以及调试环境：
- Win2K3-sp1 DDK 2003 sp1
- By : M80
- --*/
- 实现类似反黑精英的注册表启动项实时监控(我这里只实现了针对某个键值).
- 测试的参数硬编码的,需要的朋友可以自己修改成用户态下交互的功能.
- #include "ntddk.h"
- #include <stdio.h>
- extern NTSTATUS
- ObQueryNameString(void *,
- void *,
- int size,
- int *);
- extern NTSYSAPI NTSTATUS NTAPI
- ZwSetValueKey( IN HANDLE KeyHandle,
- IN PUNICODE_STRING ValueName,
- IN ULONG TitleIndex OPTIONAL,
- IN ULONG Type,
- IN PVOID Data,
- IN ULONG DataSize);
- // 声明原有函数
- typedef NTSTATUS (*REALZWSETVALUEKEY)(
- IN HANDLE KeyHandle,
- IN PUNICODE_STRING ValueName,
- IN ULONG TitleIndex OPTIONAL,
- IN ULONG Type,
- IN PVOID Data,
- IN ULONG DataSize
- );
- // 定义一个原函数指针
- REALZWSETVALUEKEY RealZwSetValueKey;
- // 定义HOOK注册表设置内容的函数
- NTSTATUS HookZwSetValueKey(
- IN HANDLE KeyHandle,
- IN PUNICODE_STRING ValueName,
- IN ULONG TitleIndex OPTIONAL,
- IN ULONG Type,
- IN PVOID Data,
- IN ULONG DataSize
- );
- // SYSTEMSERVICE 的定义
- typedef struct ServiceDescriptorEntry
- {
- unsigned int * ServiceTableBase; // 关键字段, 指向系统服务分发例程的基地址
- unsigned int * ServiceCounterTableBase;
- unsigned int NumberOfServices;
- unsigned char * ParamTableBase;
- }
- ServiceDescriptorTableEntry_t, * PServiceDescriptorTableEntry_t;
- __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
- #define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)
- _function+1)]
- void Driver_Unload(PDRIVER_OBJECT ) ;
- PVOID GetPointer( HANDLE ) ;
- NTSTATUS HookZwSetValueKey(
- IN HANDLE ,
- IN PUNICODE_STRING ,
- IN ULONG TitleIndex ,
- IN ULONG ,
- IN PVOID ,
- IN ULONG ) ;
- void Driver_Unload(PDRIVER_OBJECT DriverObject)
- {
- UNICODE_STRING usDosDeviceName;
- //恢复原来的函数指针
- (REALZWSETVALUEKEY)(SYSTEMSERVICE(ZwSetValueKey)) = RealZwSetValueKey;
- DbgPrint("HideFile_Unload Called\r\n");
- RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\MonitorReg");
- IoDeleteSymbolicLink(&usDosDeviceName);
- IoDeleteDevice(DriverObject->DeviceObject);
- }
- //驱动的入口函数
- NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING RegistryPath)
- {
- NTSTATUS NtStatus = STATUS_SUCCESS;
- PDEVICE_OBJECT pDeviceObject = NULL;
- UNICODE_STRING usDriverName, usDosDeviceName;
- DbgPrint("DriverEntry Called\r\n");
- RtlInitUnicodeString(&usDriverName, L"\\Device\\MonitorReg");
- RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\MonitorReg");
- NtStatus = IoCreateDevice(pDriverObject,
- 0,
- &usDriverName,
- FILE_DEVICE_UNKNOWN,
- FILE_DEVICE_SECURE_OPEN,
- FALSE,
- &pDeviceObject);
- if (STATUS_SUCCESS == NtStatus)
- {
- pDriverObject->DriverUnload = Driver_Unload;
- }
- IoCreateSymbolicLink(&usDosDeviceName, &usDriverName);
- // 保存 ZwSetValueKey 函数的入口地址
- RealZwSetValueKey = (REALZWSETVALUEKEY)(SYSTEMSERVICE(ZwSetValueKey));
- (REALZWSETVALUEKEY)(SYSTEMSERVICE(ZwSetValueKey)) = HookZwSetValueKey;
-
- return NtStatus ;
- }
- PVOID GetPointer( HANDLE handle )
- {
- PVOID pKey;
- if(!handle)
- return NULL;
- // ObReferenceObjectByHandle函数来获得这个Handle对应的FileObject, 得到的指针转换成文件对象的
- 指针
- if( ObReferenceObjectByHandle( handle, 0, NULL, KernelMode, &pKey, NULL ) != STATUS_SUCCESS )
- {
- pKey = NULL;
- }
- return pKey;
- }
- //HOOK设置注册表键值的函数
- NTSTATUS HookZwSetValueKey(
- IN HANDLE KeyHandle,
- IN PUNICODE_STRING ValueName,
- IN ULONG TitleIndex OPTIONAL,
- IN ULONG Type,
- IN PVOID Data,
- IN ULONG DataSize)
- {
- NTSTATUS rc;
- UNICODE_STRING *pUniName; //定义得到修改注册表的UNI路径
- ULONG actualLen;
- ANSI_STRING keyname,
- akeyname,
- m_keyname,
- m_akeyname; //定义得到修改注册表的UNI路径
- PVOID pKey;
- RtlUnicodeStringToAnsiString( &akeyname, ValueName, TRUE);
- RtlUnicodeStringToAnsiString( &m_akeyname, ValueName, TRUE);
- RtlUpperString(&akeyname,&m_akeyname);
- RtlFreeAnsiString(&m_akeyname);
- // 得到文件对象的指针
- if( pKey = GetPointer( KeyHandle))
- {
- // 分配内存
- pUniName = ExAllocatePool( NonPagedPool, 512*2+2*sizeof(ULONG));
- pUniName->MaximumLength = 512*2;
- // 保证空间内没有不干净的数据
- memset(pUniName,0,pUniName->MaximumLength);
-
- if( NT_SUCCESS( ObQueryNameString( pKey, pUniName, 512*2, &actualLen) ) )
- {
- RtlUnicodeStringToAnsiString( &keyname, pUniName, TRUE);
- keyname.Buffer=_strupr(keyname.Buffer);
- akeyname.Buffer=_strupr(akeyname.Buffer);
- RtlUnicodeStringToAnsiString( &m_keyname, pUniName, TRUE);
- RtlUpperString(&keyname,&m_keyname);
- RtlFreeAnsiString(&m_keyname);
- if (strcmp
- (keyname.Buffer,"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN") == 0)
- {
- if(strcmp(akeyname.Buffer,"TE_REGPROTECT") ==0 )
- {
- DbgPrint("试图修改键值:%s的数据,已被拦截",akeyname.Buffer);
- RtlFreeAnsiString(&akeyname);
- RtlFreeAnsiString(&keyname);
- // 释放内存
- if(pUniName)
- {
- ExFreePool(pUniName);
- }
- return 0;
- }
- }
- }
- }
- RtlFreeAnsiString(&akeyname);
- rc=RealZwSetValueKey(KeyHandle,ValueName,TitleIndex,Type,Data,DataSize);
- // 释放内存
- if(pUniName)
- {
- ExFreePool(pUniName);
- }
- return (rc);
- }
|
|
发表于 2011-8-19 13:42:29
