Lhs.rar_protect driver_千年_游戏保护_过驱动

#include <ntddk.h> typedef struct _SERVICE_DESCRIPTOR_TABLE { PVOID ServiceTableBase; PULONG ServiceCounterTableBase; ULONG NumberOfService; ULONG ParamTableBase; }SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE; //由于KeServiceDescriptorTable只有一项,这里就简单点了 extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;//KeServiceDescriptorTable为导出函数 typedef NTSTATUS (*NTREADVIRTUALMEMORY)( OUT HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG NumberOfBytesToRead, IN PULONG NumberOfBytesReaded); typedef NTSTATUS (*NTWIRTEVIRTUALMEMORY)( OUT HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN ULONG NumberOfBytesToWrite, IN PULONG NumberOfBytesReaded); ///////////////////////////////////// VOID Hook(); VOID Unhook(); VOID GetAddrCode(); VOID OnUnload(IN PDRIVER_OBJECT DriverObject); ////////////////////////////////////// ULONG JmpAddress;//跳转到NtOpenProcess里的地址 ULONG JmpAddress1;//跳转到NtOpenProcess里的地址 ULONG JmpAddress2;//跳转到NtOpenProcess里的地址 ULONG OldServiceAddress;//原来NtOpenProcess的服务地址 ULONG OldServiceAddress1;//原来NtOpenProcess的服务地址 ULONG OldServiceAddress2;//原来NtOpenProcess的服务地址 NTREADVIRTUALMEMORY NtReadVirtualMemory; //NtReadVirtualMemory 的服务地址 NTWIRTEVIRTUALMEMORY NtWriteVirtualMemory; //NtReadVirtualMemory 的服务地址 static UCHAR SaveOpenProcess[15]; static UCHAR SaveReadMemory[12]; static UCHAR SaveWriteMemory[12]; ////////////////////////////////////// __declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId) { DbgPrint("NtOpenProcess() called"); __asm{ push 0C4h push 804f5518H //共十个字节 mov ebx,80582c77h call ebx jmp [JmpAddress2] } } /////////////////////////////////////////////////// __declspec(naked) NTSTATUS __stdcall MyNtReadVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToRead, PULONG NumberOfBytesReaded) { //跳过去 __asm { push 0x1c push 804f7bf8h //共十个字节 mov ebx,804e4237h call ebx jmp [JmpAddress] } } /////////////////////////////////////////////////// __declspec(naked) NTSTATUS __stdcall MyNtWriteVirtualMemory(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesReaded) { //跳过去 __asm { push 0x1c push 804f7c10h //共15个字节 mov ebx,804e4237h call ebx jmp [JmpAddress1] } } /////////////////////////////////////////////////// NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath) { DriverObject->DriverUnload = OnUnload; DbgPrint("Unhooker load"); //DbgPrint("Address:0x%08X",(ULONG)KeServiceDescriptorTable->ServiceTableBase + 0xBA * 4 + 10); DbgPrint("Address:0x%08X",(ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x115 * 4); Hook(); return STATUS_SUCCESS; } ///////////////////////////////////////////////////// VOID OnUnload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("Unhooker unload!"); Unhook(); } ///////////////////////////////////////////////////// VOID Hook() { ULONG Address, Address1,Address2; Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0xBA * 4;//0x7A为NtReadVirtualMemory服务ID Address1 = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x115 * 4;//0x115为NtWriteVirtualMemory服务ID Address2 = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//0x7A为NtOpenProcess服务ID DbgPrint("Address:0x%08X",Address); OldServiceAddress = *(ULONG*)Address;//保存原来NtOpenProcess的地址 OldServiceAddress1 = *(ULONG*)Address1;//保存原来NtOpenProcess的地址 OldServiceAddress2 = *(ULONG*)Address2;//保存原来NtOpenProcess的地址 DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress); DbgPrint("OldServiceAddress1:0x%08X",OldServiceAddress1); DbgPrint("MyNtOpenProcess:0x%08X",MyNtReadVirtualMemory); DbgPrint("MyNtOpenProcess:0x%08X",MyNtWriteVirtualMemory); JmpAddress = (ULONG)0x805800a0 + 12; //跳转到NtOpenProcess函数头＋10的地方，这样在其前面写的JMP都失效了 JmpAddress1 = (ULONG)0x80580198 + 12; JmpAddress2 = (ULONG)NtOpenProcess + 15; //跳转到NtOpenProcess函数头＋15的地方，这样在其前面写的JMP都失效了 DbgPrint("JmpAddress:0x%08X",JmpAddress); DbgPrint("JmpAddress1:0x%08X",JmpAddress1); __asm { //去掉内存保护 cli mov eax,cr0 and eax,not 10000h mov cr0,eax } *((ULONG*)Address) = (ULONG)MyNtReadVirtualMemory;//HOOK SSDT *((ULONG*)Address1) = (ULONG)MyNtWriteVirtualMemory; *((ULONG*)Address2) = (ULONG)MyNtOpenProcess; __asm { //恢复内存保护 mov eax,cr0 or eax,10000h mov cr0,eax sti } } ////////////////////////////////////////////////////// VOID Unhook() { ULONG Address, Address1,Address2; Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0xBA * 4;//查找SSDT Address1 = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x115 * 4; Address2 = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4; __asm{ cli mov eax,cr0 and eax,not 10000h mov cr0,eax } *((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT *((ULONG*)Address1) = (ULONG)OldServiceAddress1;//还原SSDT *((ULONG*)Address2) = (ULONG)OldServiceAddress2;//还原SSDT __asm{ mov eax,cr0 or eax,10000h mov cr0,eax sti } DbgPrint("Unhook"); }