HOOK KiFastCallEntry代码 委员长 · · Windows程序设计
0 0 0

本文共计672个字,预计阅读时长2.7分钟。

include

ULONG d_origKiFastCallEntry; // Original value of ntoskrnl!KiFastCallEntry

VOID OnUnload( IN PDRIVER_OBJECT DriverObject ) { DbgPrint("ROOTKIT: OnUnload called\n"); }

declspec(naked) MyKiFastCallEntry() // Hook function { asm { jmp [d_origKiFastCallEntry] } }

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath ) { theDriverObject->DriverUnload = OnUnloa? __asm { mov ecx, 0x176 rdmsr // read the value of the IA32_SYSENTER_EIP register mov d_origKiFastCallEntry, eax mov eax, MyKiFastCallEntry // Hook function address wrmsr // Write to the IA32_SYSENTER_EIP register } return STATUS_SUCCESS; }

最后于 2023-2-26 被admin编辑 ,原因:

最新回复 ( 0 )
全部楼主
  • 暂无评论