本文共 1424 字，大约阅读时间需要 4 分钟。

SSDT Hook??????????? .Net ??? MVC ?????????????? .cpp ? .h ???????????? API ?????????

SSDT ??????? Service Descriptor Table?SSDT????????????????????????????????????Hook?????????????? ServiceTableBase??????????????????????????

SSDT ??????????????

• ServiceTableBase?SSDT ??????
• ServiceCounterTableBase?????????????
• NumberOfServices?SSDT ???????
• ParamTableBase????????

??????????????????????????????cli????????? sti???????????????????Cr0 ?????????????????????????????????

???????????????

void PageProtectOff() {    __asm {        cli        mov eax, cr0        and eax, not 10000h        mov cr0, eax    }}

????????????????

void PageProtectOn() {    __asm {        mov eax, cr0        or eax, 10000h        mov cr0, eax        sti    }}

???Hook?????????????? SSDT ?????????????????????????????????

? OpenProcess ??????????????????????????? Hook ??????????????????????????????????????? OpenProcess ???

??? OpenProcess Hook ????????

NTSTATUS ssdt_hook() {    O_NtOpenProcess = KeServiceDescriptorTable.ServiceTableBase[122];    PageProtectOff();    KeServiceDescriptorTable.ServiceTableBase[122] = (unsigned int)MyNtOpenProcess;    PageProtectOn();    return STATUS_SUCCESS;}

MyNtOpenProcess ?????????????????????????? OpenProcess ????????????? ClientId ?????????????

CLIENT_ID ???????

typedef struct _CLIENT_ID {    HANDLE UniqueProcess;    HANDLE UniqueThread;} CLIENT_ID;

??????????????????? Hook ??????????????????????????????

转载地址：http://rzri.baihongyu.com/