KProcessHacker now hooks on XP

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@527 21ef857c-d57f-4fe0-8362-d861dc6d29cd

trunk/KProcessHacker/hooks.c

@@ -57,6 +57,14 @@ extern PVOID *OrigKiServiceTable;
 #define UNHOOK_CALL(f) SsdtRestoreEntryByCall(Zw##f, OldNt##f, NewNt##f)
 #define UNHOOK_INDEX(f) SsdtRestoreEntryByIndex(Zw##f##Index, OldNt##f, NewNt##f)
 
+/* Values for Vista */
+int ZwOpenThreadIndex;
+int ZwQueryInformationProcessIndex;
+int ZwQueryInformationThreadIndex;
+int ZwQuerySystemInformationIndex;
+int ZwSetInformationProcessIndex;
+int ZwTerminateThreadIndex;
+
 _ZwCreateFile OldNtCreateFile;
 _ZwCreateKey OldNtCreateKey;
 _ZwDeleteKey OldNtDeleteKey;
@@ -83,6 +91,25 @@ _ZwTerminateProcess OldNtTerminateProcess;
 _ZwTerminateThread OldNtTerminateThread;
 _ZwWriteFile OldNtWriteFile;
 
+PVOID GetSystemRoutineAddress(WCHAR *Name)
+{
+    PVOID address = NULL;
+    UNICODE_STRING unicodeName;
+    
+    RtlInitUnicodeString(&unicodeName, Name);
+    
+    __try
+    {
+        address = MmGetSystemRoutineAddress(&unicodeName);
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        address = NULL;
+    }
+    
+    return address;
+}
+
 NTSTATUS NewNtCreateFile(
     PHANDLE FileHandle,
     ACCESS_MASK DesiredAccess,
@@ -624,8 +651,38 @@ NTSTATUS NewNtWriteFile(
     }
 }
 
-void KPHHook()
+NTSTATUS KPHHook()
 {
+    RTL_OSVERSIONINFOW version;
+    
+    version.dwOSVersionInfoSize = sizeof(version);
+    RtlGetVersion(&version);
+    
+    if (version.dwMajorVersion == 5 && version.dwMinorVersion == 1)
+    {
+        // XP
+        ZwOpenThreadIndex = 0x80;
+        ZwQueryInformationProcessIndex = 0x9a;
+        ZwQueryInformationThreadIndex = 0x9b;
+        ZwQuerySystemInformationIndex = 0xad;
+        ZwSetInformationProcessIndex = 0xe4;
+        ZwTerminateThreadIndex = 0x102;
+    }
+    else if (version.dwMajorVersion == 6 && version.dwMinorVersion == 0)
+    {
+        // Vista
+        ZwOpenThreadIndex = 0xc9;
+        ZwQueryInformationProcessIndex = 0xe4;
+        ZwQueryInformationThreadIndex = 0xe5;
+        ZwQuerySystemInformationIndex = 0xf8;
+        ZwSetInformationProcessIndex = 0x131;
+        ZwTerminateThreadIndex = 0x14f;
+    }
+    else
+    {
+        return STATUS_UNSUCCESSFUL;
+    }
+    
 #ifdef HOOK_FILE
     HOOK_CALL(CreateFile);
     HOOK_CALL(OpenFile);
@@ -662,6 +719,8 @@ void KPHHook()
     HOOK_CALL(DuplicateObject);
     HOOK_INDEX(QuerySystemInformation);
 #endif
+    
+    return STATUS_SUCCESS;
 }
 
 void KPHUnhook()

trunk/KProcessHacker/hooks.h

@@ -25,7 +25,7 @@
 
 #include <ntifs.h>
 
-void KPHHook();
+NTSTATUS KPHHook();
 void KPHUnhook();
 
 typedef struct _KTHREAD
@@ -291,7 +291,6 @@ typedef NTSTATUS (*_ZwOpenProcess)(
     PCLIENT_ID ClientId
     );
 
-#define ZwOpenThreadIndex 0xc9
 typedef NTSTATUS (*_ZwOpenThread)(
     PHANDLE ThreadHandle,
     ACCESS_MASK DesiredAccess,
@@ -307,7 +306,6 @@ typedef NTSTATUS (*_ZwQueryInformationFile)(
     FILE_INFORMATION_CLASS FileInformationClass
     );
 
-#define ZwQueryInformationProcessIndex 0xe4
 typedef NTSTATUS (*_ZwQueryInformationProcess)(
     HANDLE ProcessHandle,
     int ProcessInformationClass,
@@ -316,7 +314,6 @@ typedef NTSTATUS (*_ZwQueryInformationProcess)(
     int *ReturnLength
     );
 
-#define ZwQueryInformationThreadIndex 0xe5
 typedef NTSTATUS (*_ZwQueryInformationThread)(
     HANDLE ThreadHandle,
     int ThreadInformationClass,
@@ -333,7 +330,6 @@ typedef NTSTATUS (*_ZwQueryKey)(
     PULONG ResultLength
     );
 
-#define ZwQuerySystemInformationIndex 0xf8
 typedef NTSTATUS (*_ZwQuerySystemInformation)(
     int SystemInformationClass,
     PVOID SystemInformation,
@@ -370,7 +366,6 @@ typedef NTSTATUS (*_ZwSetInformationFile)(
     FILE_INFORMATION_CLASS FileInformationClass
     );
 
-#define ZwSetInformationProcessIndex 0x131
 typedef NTSTATUS (*_ZwSetInformationProcess)(
     HANDLE ProcessHandle,
     int ProcessInformationClass,
@@ -399,7 +394,6 @@ typedef NTSTATUS (*_ZwTerminateProcess)(
     ULONG ExitCode
     );
 
-#define ZwTerminateThreadIndex 0x14f
 typedef NTSTATUS (*_ZwTerminateThread)(
     HANDLE Thread,
     ULONG ExitCode

trunk/KProcessHacker/kprocesshacker.c

@@ -48,15 +48,7 @@
 int ClientPID = -1;
 PVOID *OrigKiServiceTable = NULL;
 extern int CurrentCallCount;
-
-PVOID GetSystemRoutineAddress(WCHAR *Name)
-{
-    UNICODE_STRING unicodeName;
-    
-    RtlInitUnicodeString(&unicodeName, Name);
-    
-    return MmGetSystemRoutineAddress(&unicodeName);
-}
+int Hooked = FALSE;
 
 void DriverUnload(PDRIVER_OBJECT DriverObject)
 {
@@ -64,11 +56,13 @@ void DriverUnload(PDRIVER_OBJECT DriverObject)
     UNICODE_STRING dosDeviceName;
     int i;
     
-    KPHUnhook();
+    if (Hooked)
+        KPHUnhook();
+    
     SsdtDeinit();
     
     /* wait for any syscalls to complete, otherwise it's a BSOD. */
-    waitTime.QuadPart = -((signed __int64)20000000); /* 2 seconds */
+    waitTime.QuadPart = -((signed __int64)50000000); /* 5 seconds */
     KeDelayExecutionThread(KernelMode, FALSE, &waitTime);
     
     if (OrigKiServiceTable != NULL)
@@ -96,7 +90,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
     if (status != STATUS_SUCCESS)
         return status;
     
-    KPHHook();
+    Hooked = KPHHook() == STATUS_SUCCESS;
     
     RtlInitUnicodeString(&deviceName, KPH_DEVICE_NAME);
     RtlInitUnicodeString(&dosDeviceName, KPH_DEVICE_DOS_NAME);
@@ -134,6 +128,10 @@ NTSTATUS KPHCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
     dprintf("KProcessHacker: Client (PID %d) connected\n", ClientPID);
     dprintf("KProcessHacker: Base IOCTL is 0x%08x\n", KPH_CTL_CODE(0));
     
+    /* hook again to make sure our hooks work for this new client */
+    KPHUnhook();
+    KPHHook();
+    
     return status;
 }