Paste: SSDT Hook Exemple[by santabug] - PasteKorbe

PasteKorbe



SSDT Hook Exemple[by santabug] par KPCR en cpp

la description |

Un exemple de SSDT Hooking.

avec / sans numéros de ligne

  1. /*
  2.                        A SSDT HOOK EXAMPLE of ZwCreateFile.
  3.                    .'\   /`.         -- by santabug
  4.                  .'.-.`-'.-.`.
  5.             ..._:   .-. .-.   :_...
  6.           .'    '-.(o ) (o ).-'    `.  http://santabug.blogspot.com/
  7.          :  _    _ _`~(_)~`_ _    _  :   santabug[at]live[dot]fr
  8.         :  /:   ' .-=_   _=-. `   ;\  :
  9.         :   :|-.._  '     `  _..-|:   :
  10.          :   `:| |`:-:-.-:-:'| |:'   :
  11.           `.   `.| | | | | | |.'   .'
  12.             `.   `-:_| | |_:-'   .'
  13.              `-._   ````    _.-'
  14.                   ``-------''
  15.                   
  16.                   
  18. The ZwCreateFile API is hooked and returns an error 
  19. if the created file is "c:\pron.txt".
  22. */
  23.  
  24.  
  25. #include <ntddk.h>
  26.  
  27. // usefull <3
  28. #define SYSTEMSERVICE(_name)  KeServiceDescriptorTable.ServiceTable[*(DWORD *) ((unsigned char *)_name + 1)]
  29.  
  30. #define DEBUG
  31. typedef unsigned long DWORD, *PDWORD;
  32. typedef unsigned char BYTE, *PBYTE;
  33.  
  34.  
  35. void hooking(void);
  36. void Unhooking();
  37. NTSTATUS DriverEntry(PDRIVER_OBJECT, PUNICODE_STRING); // main() du driver
  38. void Unload_driver(IN PDRIVER_OBJECT);
  39.  
  40.  
  41.  
  42.  
  43. #pragma pack(1)
  44. typedef struct ServiceDescriptorEntry 
  45. {
  46.     PDWORD ServiceTable;
  47.     PDWORD CounterTableBase;
  48.     DWORD  ServiceLimit;
  49.     PBYTE  ArgumentTable;
  50. } SDT;
  51. #pragma pack()
  52.  
  53. __declspec(dllimport) SDT KeServiceDescriptorTable;
  54.  
  55.  
  56. typedef NTSYSAPI NTSTATUS (*ZWCREATEFILE)
  57. (
  58.  
  59.     OUT PHANDLE FileHandle,
  60.     IN ACCESS_MASK DesiredAccess,
  61.     IN POBJECT_ATTRIBUTES ObjectAttributes,
  62.     OUT PIO_STATUS_BLOCK IoStatusBlock,
  63.     IN PLARGE_INTEGER AllocationSize OPTIONAL,
  64.     IN ULONG FileAttributes,
  65.     IN ULONG ShareAccess,
  66.     IN ULONG CreateDisposition,
  67.     IN ULONG CreateOptions,
  68.     IN PVOID EaBuffer OPTIONAL,
  69.     IN ULONG EaLength
  70.     
  71. );
  72.  
  73. ZWCREATEFILE OrigZwCreateFile;
  74. extern ZWCREATEFILE OrigZwCreateFile;
  75. /*
  76. NTSTATUS RtlCompareUnicodeString(      
  77.  
  78.         IN PUNICODE_STRING String1, 
  79.         IN PUNICODE_STRING String2, 
  80.         IN BOOLEAN  CaseInSensitive  
  81.     );
  82.     
  86. typedef struct _OBJECT_ATTRIBUTES {
  87.     ULONG  Length;
  88.     HANDLE  RootDirectory;
  89.     PUNICODE_STRING  ObjectName; <= Yawn  :]
  90.     ULONG  Attributes;
  91.     PVOID  SecurityDescriptor;
  92.     PVOID  SecurityQualityOfService;
  93. } OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
  94. typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;
  96.  */
  97.  
  98.  
  99. NTSTATUS FakeZwCreateFile(
  100.  
  101.                           OUT PHANDLE FileHandle,
  102.                           IN ACCESS_MASK DesiredAccess,
  103.                           IN POBJECT_ATTRIBUTES ObjectAttributes,
  104.                           OUT PIO_STATUS_BLOCK IoStatusBlock,
  105.                           IN PLARGE_INTEGER AllocationSize OPTIONAL,
  106.                           IN ULONG FileAttributes,
  107.                           IN ULONG ShareAccess,
  108.                           IN ULONG CreateDisposition,
  109.                           IN ULONG CreateOptions,
  110.                           IN PVOID EaBuffer OPTIONAL,
  111.                           IN ULONG EaLength) 
  112.                           
  113. {
  114.                          
  115.                         UNICODE_STRING FileName;
  116.                         RtlInitUnicodeString(&FileName, L"\\??\\C:\\pron.txt");
  117.                         
  118.                         //KdPrint(("FILEZ : %wZ\n", ObjectAttributes->ObjectName)); // unicode string
  119.                         
  120.                         if(RtlCompareUnicodeString(ObjectAttributes->ObjectName,&FileName, TRUE)==0x00) 
  121.                         {
  122.                             DbgPrint("pron text file detected !\n");
  123.                             return(STATUS_OBJECT_NAME_INVALID);
  124.                         } 
  125.                         
  126.                         else 
  127.                        {
  128.     
  129.                         // on appelle la vraie fonction
  130.                          ((ZWCREATEFILE)(OrigZwCreateFile)) (
  131.                         
  132.                                                             FileHandle,
  133.                                                             DesiredAccess,
  134.                                                             ObjectAttributes,
  135.                                                             IoStatusBlock,
  136.                                                             AllocationSize,
  137.                                                             FileAttributes,
  138.                                                             ShareAccess,
  139.                                                             CreateDisposition,
  140.                                                             CreateOptions,
  141.                                                             EaBuffer,
  142.                                                             EaLength);
  143.                                                             return(STATUS_SUCCESS);
  144.                             //    ZwCreateFile returns STATUS_SUCCESS on success or an appropriate NTSTATUS error code on failure
  145.                                                                  
  146.                          }
  147. }
  148.  
  149. void Hooking(void) {
  150.  
  151.     //cli, sti - désactive/rétablit les interruptions
  152.     _asm{cli}
  153.     //  on pose notre hook ainsi
  154.     OrigZwCreateFile = (ZWCREATEFILE) (SYSTEMSERVICE(ZwCreateFile));
  155.     (ZWCREATEFILE) (SYSTEMSERVICE(ZwCreateFile)) =    FakeZwCreateFile;
  156.     _asm{sti}
  157.     
  158. }
  159.  
  160. void Unhooking() 
  161. {
  162.  
  163.     _asm{cli}
  164.     (ZWCREATEFILE) (SYSTEMSERVICE(ZwCreateFile)) = OrigZwCreateFile; // on restaure
  165.     _asm{sti}
  166. }
  167.  
  168. void Unload_driver(IN PDRIVER_OBJECT DriverObject) {
  169.     
  170.     DbgPrint("And now, unhooking API :] \n");
  171.     Unhooking();
  172. }
  173.  
  174. NTSTATUS DriverEntry(PDRIVER_OBJECT driverObject, PUNICODE_STRING RegistryPath) {
  175.     
  176.     driverObject->DriverUnload  = Unload_driver;
  177.     
  178.     DbgPrint("Hooking API!\n");
  179.     Hooking();
  180.     
  181.     return(STATUS_SUCCESS);
  182. }