简析利用调试寄存器实现内核函数的HOOK

/*
drxhook.h
Written By yykingking@126.com
*/
 
#ifndef _DRX_HOOK
#define _DRX_HOOK
 
#include 
 
typedef unsigned long DWORD;
typedef unsigned char BOOL;
 
#pragma pack(push,1)
typedef struct _idtr
{
  //定义中断描述符表的限制，长度两字节；
  short     IDTLimit;
  //定义中断描述服表的基址，长度四字节；
  unsigned int   IDTBase;
}IDTR,*PIDTR;
 
typedef struct _IDTENTRY
{
  unsigned short LowOffset;
  unsigned short selector;
  unsigned char unused_lo;
  unsigned char segment_type:4;   //0x0E is an interrupt gate
  unsigned char system_segment_flag:1;
  unsigned char DPL:2;   // descriptor privilege level
  unsigned char P:1; /* present */
  unsigned short HiOffset;
} IDTENTRY,*PIDTENTRY;
 
#pragma pack(pop)
 
DWORD GetDBEntry();
void HookDBInt();
void UnHookDBInt();
 
#endif
 
/*
drxhook.cpp
Written By yykingking@126.com
*/
 
#include "drxhook.h"
 
DWORD g_OldDBEntry;
IDTR g_IDTR;
DWORD g_OldCreateFile;
DWORD g_HookNumber = 0;
DWORD g_CR0;
BOOL g_bExit;
 
void ReLoadCR0AndSti()
{
  __asm
  {
    push   eax
        mov     eax, g_CR0
        mov     cr0, eax
        pop     eax
        sti
  }
}
 
void CliAndDisableWPBit()
{
  __asm
  {
    cli
        push   eax
        mov     eax, cr0
        mov     g_CR0, eax
        and     eax, 0xFFFEFFFF
        mov     cr0, eax
        pop     eax
  }
}
 
void PrintHook()
{
  DbgPrint(" Now Get In ZwCreateFile Hook: %d...Pid: %d...\n", g_HookNumber++, (DWORD)PsGetCurrentProcessId());
}
 
__declspec(naked) void NewZwCreateFile()
{
  __asm
  {
    pushfd;                 // 仅仅适合于 XP 操作系统
    call PrintHook;
    popfd;
    mov eax,0x25;
    jmp g_OldCreateFile;
  }
}
 
void SetHB()         // set hardware breakpoint 设置硬件断点
{
  __asm
  {
    mov eax, ZwCreateFile;     // 想要挂接的函数或者地址
    mov dr0, eax;
    mov eax, dr7;
    or eax, 0x2703;         // 也要修改 dr7:GD 位，以免DrX被操作系统或其他程序修改
    and eax, 0xfff0ffff;
    mov dr7, eax;
  }
}
 
__declspec(naked) void NewDBEntry()
{
  __asm
  {
    pushfd;
    push eax;
 
    mov eax, dr6;
    test eax, 0x2000;
    jz NOT_EDIT_DRX;
 
    // 以下是如果有对DRX的操作的简单处理,如有需要可以修改
    // 我只是简单的跳过这些指令
    and eax, 0xFFFFDFFF;
    mov dr6, eax;         // 清除DR6的标志
 
    cmp g_bExit, 0;
    jnz MY_DRV_EXIT;     // 驱动 Unload
 
    mov eax, [esp+8];     // 获取堆栈中的 EIP
    add eax, 3;           // 由于所有对 DRX 的操作全都是3个字节的
    mov [esp+8], eax;     // 修改 EIP ,跳过当前指令,返回时执行下条指令
 
    jmp MY_INT_END;
 
NOT_EDIT_DRX:
 
    mov eax, dr6;
    test eax, 0x1;
    jz SYS_INT;         // 如果不是Dr0 产生的中断,则跳回原系统中断
 
    mov eax, [esp+8];
    cmp eax, ZwCreateFile;   // 判断一下是不是 ZwCreateFile 的线性地址
    jnz SYS_INT;
 
    mov eax, NewZwCreateFile;
    mov [esp+8],eax;     // 修改堆栈中的 EIP ,实现返回时跳转
 
MY_INT_END:  
 
    mov eax, dr7;
    or eax, 0x2000;     // 恢复 GD 位
    mov dr7, eax;
 
MY_DRV_EXIT:             // 整个驱动 UnLoad 时,不恢复 Dr7
 
    pop eax;
    popfd;
    iretd;
 
SYS_INT:
    pop eax;
    popfd;
    jmp g_OldDBEntry;
 
  }
}
 
DWORD GetDBEntry()
{
  PIDTENTRY IdtEntry;
  DWORD Entry;
 
  __asm sidt g_IDTR;
 
  IdtEntry = (PIDTENTRY)(g_IDTR.IDTBase + 8);
 
  Entry = IdtEntry->HiOffset << 16;
 
  Entry |= IdtEntry->LowOffset;
 
  return Entry;
}
 
void HookDBInt()
{
  DWORD NewEntry;
  PIDTENTRY IdtEntry;
 
  NewEntry = (DWORD)NewDBEntry;
 
  g_OldCreateFile = (DWORD)ZwCreateFile + 5;     // 新的要跳转过去的地址
 
  g_OldDBEntry = GetDBEntry();
 
  IdtEntry = (PIDTENTRY)(g_IDTR.IDTBase + 8);
 
  CliAndDisableWPBit();
 
  IdtEntry->LowOffset = (USHORT)NewEntry;
 
  IdtEntry->HiOffset = (USHORT)( NewEntry >> 16 );
 
  ReLoadCR0AndSti();
 
  SetHB();
 
  g_bExit = FALSE;
 
  return;
}
 
void UnHookDBInt()
{
  PIDTENTRY IdtEntry;
  DWORD Entry;
 
  __asm sidt g_IDTR;
 
  IdtEntry = (PIDTENTRY)(g_IDTR.IDTBase + 8);
 
  CliAndDisableWPBit();
 
  g_bExit = TRUE;
 
  __asm mov eax, dr7;           // 产生一次例外并且清除Dr7:GD
 
  if ( g_OldDBEntry != 0 )
  {
    IdtEntry->LowOffset = (USHORT)g_OldDBEntry;
 
    IdtEntry->HiOffset = (USHORT)( g_OldDBEntry >> 16 );
  }
 
  ReLoadCR0AndSti();
 
  DbgPrint(" UnLoad drx hook..\n");
 
  return;
}
 
NTSTATUS DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
  UnHookDBInt();
 
  return STATUS_SUCCESS;
}
 
NTSTATUS DriverEntry(
              IN PDRIVER_OBJECT DriverObject,
              IN PUNICODE_STRING RegistryPath
              )
{
  HookDBInt();
 
  DriverObject->DriverUnload = DriverUnload;
 
  DbgPrint("Load drxhook Driver Ok...\n");
 
  return STATUS_SUCCESS;
}
/***********************/