键盘过滤驱动之IRP劫持

参考资料：
[1] 《Rootkits——Windows内核的安全与防护》
[2] 让一切输入都难逃法眼(驱动级键盘过滤钩子)

本文主要介绍通过劫持IRP（IRP_MJ_READ）实现键盘过滤驱动的基本方法。算是学习总结吧。

这里简单地列举了几个需要注意的地方：
[1] 由于需要动态卸载驱动程序，所以要挂接KeyboardClass0。
[2] 键盘过滤驱动工作在异步模式。为了得到一个按键操作，首先会发送一个IRP（IRP_MJ_READ）到驱动的设备栈，键盘物理驱动收到这个IRP后会一直保持为pending状态。当有按键事件产生时，键盘物理驱动就会立刻完成这个IRP，使这个IRP携带按键数据，由驱动设备栈自底向上传送。这就是一次循环。
[3] 由于键盘过滤驱动的异步工作模式，所以在卸载时需要做一些特殊处理。如果直接卸载的话，当时必然还有一个irp在键盘物理驱动中处于pending状态，一旦其返回就会找不到我们的过滤驱动，就会BIOS。因而一个比较直观的想法是在unload时需要人为的按键，使那个处于pending状态的IRP立即返回。
[4] 第3点中所说的BIOS，其本质是该IRP返回后会调用我们的完成例程。当然，如果不设置完成例，即便是直接unload都不会出现问题。但键盘过滤驱动的意义，几乎都在这个完成例程上了，否则怎么实现监控。
[5] 这种方法有一点不好，就是需要用户按键才能正常卸载。而且当执行卸载功能开始知道用户按键，这期间系统处于阻塞状态。将在下一篇介绍“键盘过滤驱动之IRP模拟”，该方法就能够避免这个问题。

安装键盘过滤驱动之前，使用DriverTree观察如下图所示：


安装键盘过滤驱动后，观察如下图所示：


在keyboardclass0上attach了一个设备对象（即我们的上层键盘过滤驱动），其“Attached Device”域值0x82a3d2c0即为“DEV /Device/KEYBDFILTER_DeviceName”的设备对象。

过滤驱动实现过程的几个细节：
[1] 在IRP_MY_READ例程中实现设置完成例程，并增加IRP的pending数。
[2] 在完成例程中实现按键的监控，并减少IRP的pending数。
[3] 卸载时的阻塞，按键触发

下面就这个过滤驱动的具体实现：

typedef struct _DEVICE_EXTENSION {PDEVICE_OBJECTpKeybdDevObject ;ULONGuIrpPenddingCount ;BOOLEANbAttached ;} DEVICE_EXTENSION, *PDEVICE_EXTENSION ;NTSTATUS KEYBDFILTER_DispatchCreateClose(IN PDEVICE_OBJECTDeviceObject,IN PIRPIrp){NTSTATUS status = STATUS_SUCCESS;Irp->IoStatus.Status = status;Irp->IoStatus.Information = 0;IoCompleteRequest(Irp, IO_NO_INCREMENT);return status;}NTSTATUS KEYBDFILTER_DispatchDeviceControl(IN PDEVICE_OBJECTDeviceObject,IN PIRPIrp){NTSTATUS status = STATUS_SUCCESS;PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);switch(irpSp->Parameters.DeviceIoControl.IoControlCode){case IOCTL_KEYBDFILTER_OPERATION:// status = SomeHandlerFunction(irpSp);break;default:Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;Irp->IoStatus.Information = 0;break;}status = Irp->IoStatus.Status;IoCompleteRequest(Irp, IO_NO_INCREMENT);return status;}NTSTATUS OnReadCompletion(IN PDEVICE_OBJECT theDeviceObject,IN PIRP pIrp,IN PVOID Context){// IRQL = DISPATCH_LEVEL，不允许文件记录操作PKEYBOARD_INPUT_DATA keys;int numKeys;int i;PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)theDeviceObject->DeviceExtension;if ( pIrp->IoStatus.Status == STATUS_SUCCESS ){keys=(PKEYBOARD_INPUT_DATA)pIrp->AssociatedIrp.SystemBuffer;numKeys=pIrp->IoStatus.Information/sizeof(KEYBOARD_INPUT_DATA);for( i = 0; i < numKeys ; i++ ){if ( keys->Flags == KEY_MAKE )DbgPrint ( "ScanCode = %d Press", keys->MakeCode ) ;else if ( keys->Flags == KEY_BREAK ) DbgPrint ( "ScanCode = %d Release", keys->MakeCode ) ;}}if(pIrp->PendingReturned)IoMarkIrpPending(pIrp);pdx->uIrpPenddingCount --;return pIrp->IoStatus.Status;}NTSTATUS KEYBDFILTER_DispatchRead (IN PDEVICE_OBJECTDeviceObject,IN PIRPIrp){PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)DeviceObject->DeviceExtension ;IoCopyCurrentIrpStackLocationToNext(Irp);// 设置完成例程IoSetCompletionRoutine ( Irp, OnReadCompletion,DeviceObject,TRUE,TRUE,TRUE);pdx->uIrpPenddingCount ++;return IoCallDriver ( pdx->pKeybdDevObject, Irp ) ;}VOID KEYBDFILTER_DriverUnload(  IN PDRIVER_OBJECTDriverObject  ){KTIMERkTimer;LARGE_INTEGERtimeout;        PDEVICE_OBJECTpDevObj = pdoGlobalDrvObj->DeviceObject;PDEVICE_EXTENSIONpdx = (PDEVICE_EXTENSION) pDevObj->DeviceExtension;// 解除过滤驱动，释放调用者设备对象与物理驱动之间的绑定关系// 这样以后的IRP就不会经过这个过滤驱动，irp的挂起数目就不会增加if ( pdx->bAttached ){IoDetachDevice ( pdx->pKeybdDevObject ) ;pdx->bAttached = FALSE ;}timeout.QuadPart = 1000000;//1sKeInitializeTimer(&kTimer);DbgPrint ( "Waiting for unload! IrpPenddingCount=%d/n", pdx->uIrpPenddingCount ) ;// 等待未处理的IRP，while ( pdx->uIrpPenddingCount > 0 ){KeSetTimer ( &kTimer, timeout, NULL ) ;KeWaitForSingleObject ( &kTimer, Executive, KernelMode, FALSE, NULL ) ;}DbgPrint ( "Not any pendding irps!/n" ) ;IoDeleteSymbolicLink ( &usSymlinkName ) ;IoDeleteDevice ( pDevObj );}NTSTATUS HookKeyboard ( IN PDEVICE_OBJECT pDevObject ){///IRQL = passive level//建立过滤驱动对象PDEVICE_EXTENSION pdx = (PDEVICE_EXTENSION)pDevObject->DeviceExtension ;UNICODE_STRING uKeyboardDevice;// 设置新设备的标志与底层键盘设备标记相同// 在DriverEntry例程中创建的设备对象，并不需要必须清除DO_DEVICE_INITIALIZING标识，// 这是因为这个工作将会由I/O管理器自动完成。// 然而，如果创建了其它设备对象，则需要进行该清除工作。// 对DEVICE_EXTENSION结构清0pDevObject->Flags = pDevObject->Flags | DO_BUFFERED_IO | DO_POWER_PAGABLE ;pDevObject->Flags = pDevObject->Flags & ~DO_DEVICE_INITIALIZING;RtlZeroMemory ( pDevObject->DeviceExtension,sizeof(DEVICE_EXTENSION));pdx->bAttached = TRUE ;//把keyboardClass0转换成一个UNICODE字符串RtlInitUnicodeString ( &uKeyboardDevice, L"//Device//keyboardClass0" ) ;//准备工作完成后放置过滤钩子IoAttachDevice ( pDevObject, &uKeyboardDevice, &pdx->pKeybdDevObject);// 错误：不需要释放// 释放UNICODE字符串// RtlFreeUnicodeString(&uKeyboardDevice);return STATUS_SUCCESS;}#ifdef __cplusplusextern "C" {#endifNTSTATUS DriverEntry(IN OUT PDRIVER_OBJECT   DriverObject,IN PUNICODE_STRING      RegistryPath){PDEVICE_OBJECT pdoDeviceObj = 0;NTSTATUS status = STATUS_UNSUCCESSFUL;pdoGlobalDrvObj = DriverObject;// Create the device object.if(!NT_SUCCESS(status = IoCreateDevice(DriverObject,sizeof(DEVICE_EXTENSION),&usDeviceName,FILE_DEVICE_UNKNOWN,FILE_DEVICE_SECURE_OPEN,FALSE,&pdoDeviceObj))){// Bail out (implicitly forces the driver to unload).return status;};// Now create the respective symbolic link objectif(!NT_SUCCESS(status = IoCreateSymbolicLink(&usSymlinkName,&usDeviceName))){IoDeleteDevice(pdoDeviceObj);return status;}// NOTE: You need not provide your own implementation for any major function that//       you do not want to handle. I have seen code using DDKWizard that left the//       *empty* dispatch routines intact. This is not necessary at all!DriverObject->MajorFunction[IRP_MJ_CREATE] =DriverObject->MajorFunction[IRP_MJ_CLOSE] = KEYBDFILTER_DispatchCreateClose;DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KEYBDFILTER_DispatchDeviceControl;DriverObject->DriverUnload = KEYBDFILTER_DriverUnload;DriverObject->MajorFunction[IRP_MJ_READ] = KEYBDFILTER_DispatchRead ;// 安装键盘过滤驱动HookKeyboard ( pdoDeviceObj ) ;return STATUS_SUCCESS;}#ifdef __cplusplus}; // extern "C"#endif

DEMO在debugview中的输出如下形式：
00000000 0.00000000 ScanCode = 32 Press 
00000001 0.10264880 ScanCode = 32 Release 
00000002 0.28651714 ScanCode = 31 Press 
00000003 0.40792084 ScanCode = 31 Release 
00000004 0.56972045 ScanCode = 30 Press 
00000005 0.67448908 ScanCode = 30 Release 
00000006 2.90813041 ScanCode = 29 Press 
00000007 3.29480147 ScanCode = 29 Release 
00000008 5.57056046 ScanCode = 44 Press 
00000009 6.07932949 ScanCode = 44 Press 
00000010 6.10914564 ScanCode = 44 Press 
00000011 6.16350174 ScanCode = 44 Press 
00000012 6.20665026 ScanCode = 44 Press 
00000013 6.24940920 ScanCode = 44 Press 
00000014 6.28966284 ScanCode = 44 Press 
00000015 6.33540249 ScanCode = 44 Press 
00000016 6.35684252 ScanCode = 44 Release 

最后的44，有多个press+1个release组成，表示按下一段时间后才释放