简单恢复NtOpenProcess函数驱动源码

本文格式为Word版，下载可任意编辑——简单恢复NtOpenProcess函数驱动源码#include#include

typedefstruct_SERVICE_DESCRIPTOR_TABLE{

PVOIDServiceTableBase;

PULONGServiceCounterTableBase;ULONGNumberTableBase;ULONGParamTableBase;

}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;externPSERVICE_DESCRIPTOR_TABLEKeServiceDescriptorTable;typedefNTSTATUS(*NTOPENTHREAD)(OUTPHANDLEThreadHandle,INACCESS_MASKDesiredAccess,INPOBJECT_ATTRIBUTESObjectAttributes,INPCLIENT_IDClientId);

typedefNTSTATUS(*ZWOPENPROCESS)(OUTPHANDLEProcessHandle,INACCESS_MASKAccessMask,INPOBJECT_ATTRIBUTESObjectAttributes,INPCLIENT_IDClientId);

typedefNTSTATUS(*NTREADVIRTUALMEMORY)(INHANDLEProcessHandle,INPVOIDBaseAddress,OUTPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);

typedefNTSTATUS(*NTWRITEVIRTUALMEMORY)(INHANDLEProcessHandle,INPVOIDBaseAddress,INPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);NTOPENTHREADRealNtOpenThread;

ZWOPENPROCESSRealZwOpenProcess;

NTREADVIRTUALMEMORYRealNtReadVirtualMemory;NTWRITEVIRTUALMEMORYRealNtWriteVirtualMemory;VOIDHook();VOIDUnHook();

VOIDTD_DRIVER_UNLOAD(PDRIVER_OBJECTDriverObject);NTSTATUSreturnvalue;ULONGNtOpenProcess_15;ULONGNtOpenThread_15;

ULONGNtReadVirtualMemory_12;ULONGNtWriteVirtualMemory_12;

ULONGOldServiceAddress1,OldServiceAddress2,OldServiceAddress3,OldServiceAddress4;__declspec(naked)NTSTATUS__stdcallMy_NtReadVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,ULONGReturnLength){returnvalue

=(NTSTATUS)(NTREADVIRTUALMEMORY)RealNtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnLength);__asm{push1Chpush804DA4E0hmoveax,80538FB0hcalleaxjmp[NtReadVirtualMemory_12]}}

__declspec(naked)NTSTATUS__stdcallMy_NtWriteVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,PULONGReturnLength){returnvalue

=(NTSTATUS)(NTWRITEVIRTUALMEMORY)RealNtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnLength);__asm{push1Chpush804DA4F8hmoveax,80538FB0hcalleaxjmp[NtWriteVirtualMemory_12]}}

__declspec(naked)NTSTATUS__stdcallMy_NtOpenProcess(PHANDLEProcessHandle,ACCESS_MASKAccessMask,POBJECT_ATTRIBUTESObjectAttributes,PCLIENT_IDClientId){returnvalue

=(NTSTATUS)(ZWOPENPROCESS)RealZwOpenProcess(ProcessHandle,AccessMask,ObjectAttributes,ClientId);__asm{push0C4hpush804DAAB0hmoveax,80538FB0hcalleaxjmp[NtOpenProcess_15]}}

__declspec(naked)NTSTATUS__stdcallMy_NtOpenThread(PHANDLEThreadHandle,ACCESS_MASKAccessMask,POBJECT_ATTRIBUTESObjectAttributes,PCLIENT_IDClientId){returnvalue

=(NTSTATUS)(NTOPENTHREAD)RealNtOpenThread(ThreadHandle,AccessMask,ObjectAttributes,ClientId);__asm{push0C0hpush804DAAD8hmoveax,80538FB0hcalleaxjmp[NtOpenThread_15]}}

VOIDHook(){ULONGNtOpenProcess_Cur_Addr;ULONGNtOpenThread_Cur_Addr;ULONGNtReadVirtualMemory_Cur_Addr;ULONGNtWriteVirtualMemory_Cur_Addr;NtOpenProcess_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;NtOpenThread_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x80*4;NtReadVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0BA*4;

NtWriteVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;OldServiceAddress1=*(ULONG*)NtOpenProcess_Cur_Addr;OldServiceAddress2=*(ULONG*)NtOpenThread_Cur_Addr;OldServiceAddress3=*(ULONG*)NtReadVirtualMemory_Cur_Addr;OldServiceAddress4=*(ULONG*)NtWriteVirtualMemory_Cur_Addr;RealZwOpenProcess=(ZWOPENPROCESS)OldServiceAddress1;RealNtOpenThread=(NTOPENTHREAD)OldServiceAddress2;RealNtReadVirtualMemory=(NTREADVIRTUALMEMORY)OldServiceAddress3;RealNtWriteVirtualMemory=(NTWRITEVIRTUALMEMORY)OldServiceAddress4;NtOpenProcess_15=OldServiceAddress1+15;NtOpenThread_15=OldServiceAddress2+15;NtReadVirtualMemory_12=OldServiceAddress3+12;NtWriteVirtualMemory_12=OldServiceAddress4+12;__asm{climoveax,cr0andeax,not10000hmovcr0,eax}*((ULONG*)NtOpenProcess_Cur_Addr)=(ULONG)My_NtOpenProcess;*((ULONG*)NtOpenThread_Cur_Addr)=(ULONG)My_NtOpenThread;*((ULONG*)NtReadVirtualMemory_Cur_Addr)=(ULONG)My_NtReadVirtualMemory;*((ULONG*)NtWriteVirtualMemory_Cur_Addr)=(ULONG)My_NtWriteVirtualMemory;__asm{moveax,cr0oreax,10000hmovcr0,eaxsti}KdPrint((\编程部落过游戏保护驱动恢复成功...\\n\

KdPrint((“\\URL:DangDn〞));}

VOIDUnHook(){ULONGNtOpenProcess_Cur_Addr;ULONGNtOpenThread_Cur_Addr;ULONGNtReadVirtualMemory_Cur_Addr;ULONGNtWriteVirtualMemory_Cur_Addr;NtOpenProcess_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x7A*4;

NtOpenThread_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x80*4;NtReadVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x0BA*4;NtWriteVirtualMemory_Cur_Addr=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;__asm{climoveax,cr0andeax,not10000hmovcr0,eax}*((ULONG*)NtOpenProcess_Cur_Addr)=(ULONG)Ol