简单恢复NtOpenProcess函数驱动源码

《简单恢复NtOpenProcess函数驱动源码》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、#include#includetypedefstruct_SERVICE_DESCRIPTOR_TABLE{PVOIDServiceTableBase;PULONGServiceCounterTableBase;ULONGNumberTableBase;ULONGParamTableBase;}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;externPSERVICE_DESCRIPTOR_TABLEKeSe

2、rviceDescriptorTable;typedefNTSTATUS(*NTOPENTHREAD)(OUTPHANDLEThreadHandle,INACCESS_MASKDesiredAccess,INPOBJECT_ATTRIBUTESObjectAttributes,INPCLIENT_IDClientId);typedefNTSTATUS(*ZWOPENPROCESS)(OUTPHANDLEProcessHandle,INACCESS_MASKAccessMask,INPOBJECT_ATTR

3、IBUTESObjectAttributes,INPCLIENT_IDClientId);typedefNTSTATUS(*NTREADVIRTUALMEMORY)(INHANDLEProcessHandle,INPVOIDBaseAddress,OUTPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);typedefNTSTATUS(*NTWRITEVIRTUALMEMORY)(INHANDLEProcessHandle,INPV

4、OIDBaseAddress,INPVOIDBuffer,INULONGBufferLength,OUTPULONGReturnLengthOPTIONAL);NTOPENTHREADRealNtOpenThread;ZWOPENPROCESSRealZwOpenProcess;NTREADVIRTUALMEMORYRealNtReadVirtualMemory;NTWRITEVIRTUALMEMORYRealNtWriteVirtualMemory;VOIDHook();VOIDUnHook();VOI

5、DTD_DRIVER_UNLOAD(PDRIVER_OBJECTDriverObject);NTSTATUSreturnvalue;ULONGNtOpenProcess_15;ULONGNtOpenThread_15;ULONGNtReadVirtualMemory_12;ULONGNtWriteVirtualMemory_12;ULONGOldServiceAddress1,OldServiceAddress2,OldServiceAddress3,OldServiceAddress4;__declsp

6、ec(naked)NTSTATUS__stdcallMy_NtReadVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,ULONGReturnLength){returnvalue=(NTSTATUS)(NTREADVIRTUALMEMORY)RealNtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnL

7、ength);__asm{push1Chpush804DA4E0hmoveax,80538FB0hcalleaxjmp[NtReadVirtualMemory_12]}}__declspec(naked)NTSTATUS__stdcallMy_NtWriteVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGBufferLength,PULONGReturnLength){returnvalue=(NTSTATUS)(NT

8、WRITEVIRTUALMEMORY)RealNtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,BufferLength,ReturnLength);__asm{push1Chpush804DA4F8hmoveax,80538FB0hcalleaxjmp[NtWriteVirtualMemory_12]}}__declspec(naked)NTSTATUS__stdca