SysEnter Hook

最新推荐文章于 2019-07-03 00:30:32 发布

转载最新推荐文章于 2019-07-03 00:30:32 发布 · 983 阅读

收录于

底层专栏收录该内容

35 篇文章

订阅专栏

本文介绍了一种在内核级别实现Hook技术的方法，通过修改IA32_SYSENTER_EIP寄存器来达到替换ntoskrnl!KiFastCallEntry函数的目的。展示了如何在驱动加载和卸载时进行Hook及还原。

#include <ntddk.h>

ULONG g_OldKiFastCallEntry; // Original value of ntoskrnl!KiFastCallEntry

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
    _asm
    {
        mov ecx, 0x176
        xor edx,edx
        mov eax, g_OldKiFastCallEntry     // Hook function address
        wrmsr                        // Write to the IA32_SYSENTER_EIP register
      }
}

// Hook function
__declspec(naked) MyKiFastCallEntry()
{
  __asm {
    jmp [g_OldKiFastCallEntry]
  }
}

NTSTATUS DriverEntry( IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath )
{
  pDriverObject->DriverUnload  = OnUnload; 

  __asm {
        mov ecx, 0x176
        rdmsr                 // read the value of the IA32_SYSENTER_EIP register
        mov g_OldKiFastCallEntry, eax
        mov eax, MyKiFastCallEntry     // Hook function address
        wrmsr                        // Write to the IA32_SYSENTER_EIP register
  }

  return STATUS_SUCCESS;
}