代码:
BOOL DebugPortHook(PVOID pKernelBase, PVOID pRelocKernel, DWORD dwRelocKernelSize, HANDLE hHookProcessPID)
{
DWORD i;
test();
if (IsDebugPortHook)
{
ghPID_ProcesstoHook = hHookProcessPID;
KdPrint(("ghPID_ProcesstoHook = %d\n", ghPID_ProcesstoHook));
return TRUE;
}
if (pRelocKernel != NULL && pKernelBase != NULL)
{
gpRelocKernel = pRelocKernel;
gdwOffset_RelocKernel = (DWORD)pRelocKernel - (DWORD)pKernelBase;
gdwRelocKernelSize = dwRelocKernelSize;
KdPrint(("gdwOffset_RelocKernel = %x\n", gdwOffset_RelocKernel));
}
else
{
KdPrint(("pKernelBase或pRelocKernel为NULL,调用DebugPortHook失败\n"));
return FALSE;
}
for(i=0; i<INLINEHOOKPROCNUM; i++)
{
if(VK_InlineHook(&InlineHookProceTable[i]) == FALSE)
{
KdPrint(("InlineHook%s失败\n", InlineHookProceTable[i].Name));
return FALSE;
}
}
ghPID_ProcesstoHook = hHookProcessPID;
KdPrint(("ghPID_ProcesstoHook = %d\n", ghPID_ProcesstoHook));
IsDebugPortHook = TRUE;
return TRUE;
}代码:
BOOL VK_InlineHook(PSTRUCT_INLINEHOOKPROC pSTRUCT_INLINEHOOKPROC)
{
ULONG CallCode;
DWORD HookAddr;
PVOID FindRelocKernelAddr;
DWORD i;
if ( pSTRUCT_INLINEHOOKPROC->NewAddr == 0 && pSTRUCT_INLINEHOOKPROC->Signature[0] == 0)
{
KdPrint(("pSTRUCT_INLINEHOOKPROC->NewAddr or 特征码为NULL\n"));
return FALSE;
}
FindRelocKernelAddr = VK_FindData(gpRelocKernel, gdwRelocKernelSize, pSTRUCT_INLINEHOOKPROC->Signature, 12);
if (FindRelocKernelAddr != NULL)
{
pSTRUCT_INLINEHOOKPROC->OldAddr = (DWORD)FindRelocKernelAddr - gdwOffset_RelocKernel - pSTRUCT_INLINEHOOKPROC->SignatureAddr + pSTRUCT_INLINEHOOKPROC->OldAddr;
KdPrint(("%s函数地址 =%x\n", pSTRUCT_INLINEHOOKPROC->Name, pSTRUCT_INLINEHOOKPROC->OldAddr));
}
else
{
pSTRUCT_INLINEHOOKPROC->OldAddr = 0;
KdPrint(("查找%s函数地址失败\n", pSTRUCT_INLINEHOOKPROC->Name));
return FALSE;
}
RtlCopyMemory(pSTRUCT_INLINEHOOKPROC->CodeToHook, (PVOID)(pSTRUCT_INLINEHOOKPROC->OldAddr + pSTRUCT_INLINEHOOKPROC->HookOffset), pSTRUCT_INLINEHOOKPROC->HookLength);
CallCode = pSTRUCT_INLINEHOOKPROC->NewAddr - pSTRUCT_INLINEHOOKPROC->OldAddr -5; //得到要写入的跳转地址码
HookAddr = pSTRUCT_INLINEHOOKPROC->OldAddr;
_asm
{
cli
mov eax, cr0
and eax, 0FFFEFFFFh
mov cr0, eax
mov eax, CallCode
mov ebx, HookAddr
mov byte ptr ds:[ebx], 0E8h
mov [ebx + 1], eax
mov eax, cr0
or eax, 10000h
mov cr0, eax
sti
}
return TRUE;
}代码:
mov eax, CallCode //Call的地址指令码
mov ebx, HookAddr //Inline Hook的地址
mov byte ptr ds:[ebx], 0E8h //写入Call的指令
mov [ebx + 1], eax //写入Call的地址指令码代码:
VOID test()
{
KdPrint(("test函数执行成功\n"));
}