ULONG old_NtCreateDebugObject=0;
ULONG ssdt_hook_quanbu_biaozhong(ULONG ssdt_i,ULONG newhanshu)
{
old_NtCreateDebugObject = KeServiceDescriptorTable.ServiceTableBase[ssdt_i];
__asm
{
cli
mov eax, cr0
and eax, 0fffeffffh
mov cr0, eax
}
KeServiceDescriptorTable.ServiceTableBase[ssdt_i] = (unsigned int)newhanshu;
__asm
{
mov eax, cr0
or eax, 010000h
mov cr0, eax
sti
}
KdPrint(("ssdt hook 执行完毕\n"));
return 1;
}
ULONG ssdt_unhook_quanbu_biaozhong(ULONG ssdt_i, ULONG laohanshu)
{
old_NtCreateDebugObject = KeServiceDescriptorTable.ServiceTableBase[ssdt_i];
__asm
{
cli
mov eax, cr0
and eax, 0fffeffffh
mov cr0, eax
}
KeServiceDescriptorTable.ServiceTableBase[ssdt_i] = (unsigned int)laohanshu;
__asm
{
mov eax, cr0
or eax, 010000h
mov cr0, eax
sti
}
KdPrint(("ssdt hook 卸载完毕\n"));
return 1;
}
ULONG hook_entry()
{
ssdt_hook_quanbu_biaozhong(0x23, (ULONG)NewNtCreateDebugObject);
return 0;
}
ULONG unhook_entry()
{
ssdt_hook_quanbu_biaozhong(0x23, old_NtCreateDebugObject);
return 0;
}
ssdt表通用hook 任意ssdthook
猜你喜欢
转载自blog.csdn.net/qq1841370452/article/details/81628481
今日推荐
周排行