SSDTHOOK



#include "ntddk.h"

void PageProtectOff();

void PageProtectOn();

#pragma pack(1)

typedef struct ServiceDescriptorEntry {

unsigned int *ServiceTableBase;

unsigned int *ServiceCounterTableBase; 

unsigned int NumberOfServices;

unsigned char *ParamTableBase;

} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;

#pragma pack()

NTSTATUS

PsLookupProcessByProcessId(

IN HANDLE ProcessId,

OUT PEPROCESS *Process

);

UCHAR *PsGetProcessImageFileName(PEPROCESS EProcess); 

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;

typedef NTSTATUS(*MYNTOPENPROCESS)(

OUT PHANDLE             ProcessHandle,

IN ACCESS_MASK          AccessMask,

IN POBJECT_ATTRIBUTES   ObjectAttributes,

IN PCLIENT_ID           ClientId );

ULONG old_openprocee;

void DriverUnload(PDRIVER_OBJECT pdr){

PageProtectOff();

KeServiceDescriptorTable.ServiceTableBase[224]=(unsigned int)old_openprocee;

PageProtectOn();

}

void PageProtectOff()

{

__asm{

cli

mov  eax,cr0

and  eax,not 10000h

mov  cr0,eax

}

}

void PageProtectOn()

{

__asm{

mov  eax,cr0

or   eax,10000h

mov  cr0,eax

sti

}

}

BOOLEAN ProtectProcess(HANDLE ProcessId,char *str_ProtectObjName)

{

NTSTATUS status;

PEPROCESS process_obj;

if(!MmIsAddressValid(str_ProtectObjName))

{

return FALSE;

}

if(ProcessId==0)

{

return FALSE;

}

status=PsLookupProcessByProcessId(ProcessId,&process_obj);

if(!NT_SUCCESS(status))

{

return FALSE;

}

if(!strcmp(PsGetProcessImageFileName(process_obj),str_ProtectObjName))

{

ObDereferenceObject(process_obj);

return TRUE;

}

ObDereferenceObject(process_obj);

return FALSE;

}

NTSTATUS MyNtOpenProcess (

__out PHANDLE ProcessHandle,

__in ACCESS_MASK DesiredAccess,

__in POBJECT_ATTRIBUTES ObjectAttributes,

__in_opt PCLIENT_ID ClientId

)

{

if(ProtectProcess(ClientId->UniqueProcess,"calc.exe"))

{

return STATUS_UNSUCCESSFUL;

}

return ((MYNTOPENPROCESS)old_openprocee)(ProcessHandle,

DesiredAccess,

ObjectAttributes,

ClientId);

}

NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject ,PUNICODE_STRING preg){

KdPrint(("MY first driver！"));

PageProtectOff();

old_openprocee=(ULONG)KeServiceDescriptorTable.ServiceTableBase[224];

KeServiceDescriptorTable.ServiceTableBase[224]=(unsigned int)MyNtOpenProcess;

PageProtectOn();

DriverObject->DriverUnload=DriverUnload;

return STATUS_SUCCESS;

}

途中遇到问题很多 比如= =编译驱动文件的时候居然受误导编译器整成了应用层的EXE文件蛋疼 今天才发现= = 还有  导出 ssdt表的时候 如果你的代码文件名是.c结尾的  一定要在前面加 extern "C" 不然用不了= = 其实 把文件名改了就好  创建项目一定选择空项目= =