hook NtTerminateProcess进行应用的保护

这段时间在学习驱动，然后看到hook ssdt的代码，找了一个写的清晰的学习了一下：http://www.netfairy.net/?post=218

这里是hook NtOpenProcess，但是想自己练手所以hook NtTerminateProcess，经过多次蓝屏后，然后这里记录一下

• 遇到的问题

由于所学的例子是通过应用程序获取pid来控制保护的进程，但是ZwTerminateProcess不能通过参数获得PID，那如何获取PID呢？

• 解决方案

通过ZwQueryInformationProcess获得ProcessInformation再获得PID

• 环境

开发配置：vs2015  x86  debug

测试环境：xp sp3

驱动代码

 #include <ntddk.h>

 #define NT_DEVICE_NAME L"\\Device\\ProtectProcess"
 #define DOS_DEVICE_NAME L"\\DosDevices\\ProtectProcess"

 #define IOCTL_PROTECT_CONTROL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)

 #pragma pack(1)        //SSDT表的结构
 typedef struct ServiceDescriptorEntry
 {
   unsigned int *ServiceTableBase;
   unsigned int *ServiceCounterTableBase; //Used only in checked build
   unsigned int NumberOfServices;
   unsigned char *ParamTableBase;
 } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
 #pragma pack()

 __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;        //变量名是不能变的,因为是从外部导入

                                            //这个用于查询某个函数的地址的宏定义
 #define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[*(PULONG)((PUCHAR)_function+1)]

 NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(
   IN HANDLE ProcessHandle,
   IN PROCESSINFOCLASS ProcessInformationClass,
   OUT PVOID ProcessInformation,
   IN ULONG ProcessInformationLength,
   OUT PULONG ReturnLength);

 NTSYSAPI NTSTATUS NTAPI ZwTerminateProcess(
   IN HANDLE ProcessHandle OPTIONAL,
   IN NTSTATUS ExitStatus);

 typedef NTSTATUS (*ZWTERMINATEPROCESS)(
   IN HANDLE ProcessHandle OPTIONAL,
   IN NTSTATUS ExitStatus);

 ZWTERMINATEPROCESS OldZwTerminateProcess;
 long pid = -;

 NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT deviceObject, IN PIRP Irp)
 {
   NTSTATUS nStatus = STATUS_SUCCESS;
   ULONG IoControlCode = ;
   PIO_STACK_LOCATION IrpStack = NULL;

   long* inBuf = NULL;
   char* outBuf = NULL;
   ULONG inSize = ;
   ULONG outSize = ;
   PCHAR buffer = NULL;
   PMDL mdl = NULL;

   Irp->IoStatus.Status = STATUS_SUCCESS;
   Irp->IoStatus.Information = ;

   IrpStack = IoGetCurrentIrpStackLocation(Irp);    //利用函数获得当前请求任务的参数
   switch (IrpStack->MajorFunction)
   {
   case IRP_MJ_CREATE:
     DbgPrint("IRP_MJ_CREATE被调用\n");
     break;
   case IRP_MJ_CLOSE:
     DbgPrint("IRP_MJ_CLOSE被调用\n");
     break;
   case IRP_MJ_DEVICE_CONTROL:
     DbgPrint("IRP_MJ_DEVICE_CONTROL被调用\n");
     IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
     switch (IoControlCode)
     {
     case IOCTL_PROTECT_CONTROL:
       inSize = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
       outSize = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;

       inBuf = (long*)Irp->AssociatedIrp.SystemBuffer;
       pid = *inBuf;
       DbgPrint("==================================");
       DbgPrint("IOCTL_PROTECT_CONTROL被调用，通讯成功\n");
       DbgPrint("输入缓冲区大小：%d\n", inSize);
       DbgPrint("输出缓冲区大小：%d\n", outSize);
       DbgPrint("输入缓冲区内容：%ld\n", inBuf);
       DbgPrint("当前保护进程ID：%ld\n", pid);
       DbgPrint("==================================");
       break;
     default:
       break;
     }
     break;
   default:
     DbgPrint("未知请求包被调用\n");
     break;
   }

   nStatus = Irp->IoStatus.Status;

   IoCompleteRequest(Irp, IO_NO_INCREMENT);

   return nStatus;
 }

 NTSTATUS NewZwTerminateProcess(
   IN HANDLE ProcessHandle OPTIONAL,
   IN NTSTATUS ExitStatus)
 {
   NTSTATUS nStatus = STATUS_SUCCESS;

   ULONG Ret;
   PROCESS_BASIC_INFORMATION pbi;

   //pBuffer = ExAllocatePool(PagedPool, sizeof(PROCESS_BASIC_INFORMATION));
   ZwQueryInformationProcess(ProcessHandle, ProcessBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), &Ret);

   if (pbi.UniqueProcessId == pid)
   {
     DbgPrint("保护进程不被关闭:%d\n", pid);
     return STATUS_ACCESS_DENIED;
   }

   nStatus = OldZwTerminateProcess(ProcessHandle, ExitStatus);
   return STATUS_SUCCESS;
 }

 VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
 {
   UNICODE_STRING DeviceLinkString;
   PDEVICE_OBJECT DeviceObjectTemp1 = NULL;
   PDEVICE_OBJECT DeviceObjectTemp2 = NULL;

   DbgPrint("Driver Unload\n");

   RtlInitUnicodeString(&DeviceLinkString, DOS_DEVICE_NAME);
   IoDeleteSymbolicLink(&DeviceLinkString);
   if (pDriverObject)
   {
     DeviceObjectTemp1 = pDriverObject->DeviceObject;
     while (DeviceObjectTemp1)
     {
       DeviceObjectTemp2 = DeviceObjectTemp1;
       DeviceObjectTemp1 = DeviceObjectTemp1->NextDevice;
       IoDeleteDevice(DeviceObjectTemp2);
     }
   }

   DbgPrint("设备已经卸载\n");
   DbgPrint("修复SSDT表\n");
   (ZWTERMINATEPROCESS)(SYSTEMSERVICE(ZwTerminateProcess)) = OldZwTerminateProcess;
   DbgPrint("驱动卸载完毕\n");
 }

 NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
 {
   NTSTATUS ntStatus = STATUS_SUCCESS;
   UNICODE_STRING ntDeviceName;
   UNICODE_STRING DeviceLinkString;
   PDEVICE_OBJECT deviceObject = NULL;

   RtlInitUnicodeString(&ntDeviceName, NT_DEVICE_NAME);

   ntStatus = IoCreateDevice(
     pDriverObject,
     ,
     &ntDeviceName,
     FILE_DEVICE_UNKNOWN,
     ,
     FALSE,
     &deviceObject);

   if (!NT_SUCCESS(ntStatus))
   {
     DbgPrint("无法创建驱动设备");
     return ntStatus;
   }

   RtlInitUnicodeString(&DeviceLinkString, DOS_DEVICE_NAME);
   ntStatus = IoCreateSymbolicLink(&DeviceLinkString, &ntDeviceName);

   if (!NT_SUCCESS(ntStatus))
   {
     return ntStatus;
   }

   pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchDeviceControl;
   pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchDeviceControl;
   pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;
   pDriverObject->DriverUnload = DriverUnload;

   DbgPrint("驱动程序已经启动\n");
   DbgPrint("修改SSDT表。。。\n");

   //修改ZwTerminateProcess函数地址
   //将原来ssdt中所要hook的函数地址换成我们自己的函数地址
   OldZwTerminateProcess = (ZWTERMINATEPROCESS)(SYSTEMSERVICE(ZwTerminateProcess));
   SYSTEMSERVICE(ZwTerminateProcess) = (unsigned int)NewZwTerminateProcess;

   DbgPrint("驱动程序加载完毕\n");

   return STATUS_SUCCESS;
 }

控制程序与上面所给链接的代码相同