hook NtTerminateProcess进行应用的保护

这段时间在学习驱动，然后看到hook ssdt的代码，找了一个写的清晰的学习了一下：http://www.netfairy.net/?post=218

这里是hook NtOpenProcess，但是想自己练手所以hook NtTerminateProcess，经过多次蓝屏后，然后这里记录一下

• 遇到的问题

由于所学的例子是通过应用程序获取pid来控制保护的进程，但是ZwTerminateProcess不能通过参数获得PID，那如何获取PID呢？

• 解决方案

通过ZwQueryInformationProcess获得ProcessInformation再获得PID

• 环境

开发配置：vs2015  x86  debug

测试环境：xp sp3

驱动代码

#include <ntddk.h>

#define NT_DEVICE_NAME L"\\Device\\ProtectProcess"
#define DOS_DEVICE_NAME L"\\DosDevices\\ProtectProcess"

#define IOCTL_PROTECT_CONTROL CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)


#pragma pack(1)        //SSDT表的结构
typedef struct ServiceDescriptorEntry
{
  unsigned int *ServiceTableBase;
  unsigned int *ServiceCounterTableBase; //Used only in checked build
  unsigned int NumberOfServices;
  unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;        //变量名是不能变的,因为是从外部导入

                                           //这个用于查询某个函数的地址的宏定义
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[*(PULONG)((PUCHAR)_function+1)]

NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(
  IN HANDLE ProcessHandle,
  IN PROCESSINFOCLASS ProcessInformationClass,
  OUT PVOID ProcessInformation,
  IN ULONG ProcessInformationLength,
  OUT PULONG ReturnLength);

NTSYSAPI NTSTATUS NTAPI ZwTerminateProcess(
  IN HANDLE ProcessHandle OPTIONAL,
  IN NTSTATUS ExitStatus);


typedef NTSTATUS (*ZWTERMINATEPROCESS)(
  IN HANDLE ProcessHandle OPTIONAL,
  IN NTSTATUS ExitStatus);

ZWTERMINATEPROCESS OldZwTerminateProcess;
long pid = -1;

NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT deviceObject, IN PIRP Irp)
{
  NTSTATUS nStatus = STATUS_SUCCESS;
  ULONG IoControlCode = 0;
  PIO_STACK_LOCATION IrpStack = NULL;

  long* inBuf = NULL;
  char* outBuf = NULL;
  ULONG inSize = 0;
  ULONG outSize = 0;
  PCHAR buffer = NULL;
  PMDL mdl = NULL;

  Irp->IoStatus.Status = STATUS_SUCCESS;
  Irp->IoStatus.Information = 0;

  IrpStack = IoGetCurrentIrpStackLocation(Irp);    //利用函数获得当前请求任务的参数
  switch (IrpStack->MajorFunction)
  {
  case IRP_MJ_CREATE:
    DbgPrint("IRP_MJ_CREATE被调用\n");
    break;
  case IRP_MJ_CLOSE:
    DbgPrint("IRP_MJ_CLOSE被调用\n");
    break;
  case IRP_MJ_DEVICE_CONTROL:
    DbgPrint("IRP_MJ_DEVICE_CONTROL被调用\n");
    IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
    switch (IoControlCode)
    {
    case IOCTL_PROTECT_CONTROL:
      inSize = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
      outSize = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;

      inBuf = (long*)Irp->AssociatedIrp.SystemBuffer;
      pid = *inBuf;
      DbgPrint("==================================");
      DbgPrint("IOCTL_PROTECT_CONTROL被调用，通讯成功\n");
      DbgPrint("输入缓冲区大小：%d\n", inSize);
      DbgPrint("输出缓冲区大小：%d\n", outSize);
      DbgPrint("输入缓冲区内容：%ld\n", inBuf);
      DbgPrint("当前保护进程ID：%ld\n", pid);
      DbgPrint("==================================");
      break;
    default:
      break;
    }
    break;
  default:
    DbgPrint("未知请求包被调用\n");
    break;
  }

  nStatus = Irp->IoStatus.Status;

  IoCompleteRequest(Irp, IO_NO_INCREMENT);

  return nStatus;
}

NTSTATUS NewZwTerminateProcess(
  IN HANDLE ProcessHandle OPTIONAL,
  IN NTSTATUS ExitStatus)
{
  NTSTATUS nStatus = STATUS_SUCCESS;
  
  ULONG Ret;
  PROCESS_BASIC_INFORMATION pbi;

  //pBuffer = ExAllocatePool(PagedPool, sizeof(PROCESS_BASIC_INFORMATION));
  ZwQueryInformationProcess(ProcessHandle, ProcessBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), &Ret);


  if (pbi.UniqueProcessId == pid)
  {
    DbgPrint("保护进程不被关闭:%d\n", pid);
    return STATUS_ACCESS_DENIED;
  }

  nStatus = OldZwTerminateProcess(ProcessHandle, ExitStatus);
  return STATUS_SUCCESS;
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
  UNICODE_STRING DeviceLinkString;
  PDEVICE_OBJECT DeviceObjectTemp1 = NULL;
  PDEVICE_OBJECT DeviceObjectTemp2 = NULL;

  DbgPrint("Driver Unload\n");

  RtlInitUnicodeString(&DeviceLinkString, DOS_DEVICE_NAME);
  IoDeleteSymbolicLink(&DeviceLinkString);
  if (pDriverObject)
  {
    DeviceObjectTemp1 = pDriverObject->DeviceObject;
    while (DeviceObjectTemp1)
    {
      DeviceObjectTemp2 = DeviceObjectTemp1;
      DeviceObjectTemp1 = DeviceObjectTemp1->NextDevice;
      IoDeleteDevice(DeviceObjectTemp2);
    }
  }

  DbgPrint("设备已经卸载\n");
  DbgPrint("修复SSDT表\n");
  (ZWTERMINATEPROCESS)(SYSTEMSERVICE(ZwTerminateProcess)) = OldZwTerminateProcess;
  DbgPrint("驱动卸载完毕\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
  NTSTATUS ntStatus = STATUS_SUCCESS;
  UNICODE_STRING ntDeviceName;
  UNICODE_STRING DeviceLinkString;
  PDEVICE_OBJECT deviceObject = NULL;

  RtlInitUnicodeString(&ntDeviceName, NT_DEVICE_NAME);

  ntStatus = IoCreateDevice(
    pDriverObject,
    0,
    &ntDeviceName,
    FILE_DEVICE_UNKNOWN,
    0,
    FALSE,
    &deviceObject);

  if (!NT_SUCCESS(ntStatus))
  {
    DbgPrint("无法创建驱动设备");
    return ntStatus;
  }

  RtlInitUnicodeString(&DeviceLinkString, DOS_DEVICE_NAME);
  ntStatus = IoCreateSymbolicLink(&DeviceLinkString, &ntDeviceName);

  if (!NT_SUCCESS(ntStatus))
  {
    return ntStatus;
  }

  pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchDeviceControl;
  pDriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchDeviceControl;
  pDriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;
  pDriverObject->DriverUnload = DriverUnload;

  DbgPrint("驱动程序已经启动\n");
  DbgPrint("修改SSDT表。。。\n");

  //修改ZwTerminateProcess函数地址
  //将原来ssdt中所要hook的函数地址换成我们自己的函数地址
  OldZwTerminateProcess = (ZWTERMINATEPROCESS)(SYSTEMSERVICE(ZwTerminateProcess));
  SYSTEMSERVICE(ZwTerminateProcess) = (unsigned int)NewZwTerminateProcess;

  DbgPrint("驱动程序加载完毕\n");

  return STATUS_SUCCESS;
}

控制程序与上面所给链接的代码相同