From fb2cb99d93232e03adb0e329e48acd2eaadfa12f Mon Sep 17 00:00:00 2001 From: wj32 Date: Sun, 18 Jan 2009 03:50:13 +0000 Subject: [PATCH] KProcessHacker now hooks on XP git-svn-id: svn://svn.code.sf.net/p/processhacker/code@527 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- trunk/KProcessHacker/hooks.c | 61 ++++++++++++++++++++++++++- trunk/KProcessHacker/hooks.h | 8 +--- trunk/KProcessHacker/kprocesshacker.c | 22 +++++----- 3 files changed, 71 insertions(+), 20 deletions(-) diff --git a/trunk/KProcessHacker/hooks.c b/trunk/KProcessHacker/hooks.c index e34cdee1c..dade65744 100644 --- a/trunk/KProcessHacker/hooks.c +++ b/trunk/KProcessHacker/hooks.c @@ -57,6 +57,14 @@ extern PVOID *OrigKiServiceTable; #define UNHOOK_CALL(f) SsdtRestoreEntryByCall(Zw##f, OldNt##f, NewNt##f) #define UNHOOK_INDEX(f) SsdtRestoreEntryByIndex(Zw##f##Index, OldNt##f, NewNt##f) +/* Values for Vista */ +int ZwOpenThreadIndex; +int ZwQueryInformationProcessIndex; +int ZwQueryInformationThreadIndex; +int ZwQuerySystemInformationIndex; +int ZwSetInformationProcessIndex; +int ZwTerminateThreadIndex; + _ZwCreateFile OldNtCreateFile; _ZwCreateKey OldNtCreateKey; _ZwDeleteKey OldNtDeleteKey; @@ -83,6 +91,25 @@ _ZwTerminateProcess OldNtTerminateProcess; _ZwTerminateThread OldNtTerminateThread; _ZwWriteFile OldNtWriteFile; +PVOID GetSystemRoutineAddress(WCHAR *Name) +{ + PVOID address = NULL; + UNICODE_STRING unicodeName; + + RtlInitUnicodeString(&unicodeName, Name); + + __try + { + address = MmGetSystemRoutineAddress(&unicodeName); + } + __except (EXCEPTION_EXECUTE_HANDLER) + { + address = NULL; + } + + return address; +} + NTSTATUS NewNtCreateFile( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, @@ -624,8 +651,38 @@ NTSTATUS NewNtWriteFile( } } -void KPHHook() +NTSTATUS KPHHook() { + RTL_OSVERSIONINFOW version; + + version.dwOSVersionInfoSize = sizeof(version); + RtlGetVersion(&version); + + if (version.dwMajorVersion == 5 && version.dwMinorVersion == 1) + { + // XP + ZwOpenThreadIndex = 0x80; + ZwQueryInformationProcessIndex = 0x9a; + ZwQueryInformationThreadIndex = 0x9b; + ZwQuerySystemInformationIndex = 0xad; + ZwSetInformationProcessIndex = 0xe4; + ZwTerminateThreadIndex = 0x102; + } + else if (version.dwMajorVersion == 6 && version.dwMinorVersion == 0) + { + // Vista + ZwOpenThreadIndex = 0xc9; + ZwQueryInformationProcessIndex = 0xe4; + ZwQueryInformationThreadIndex = 0xe5; + ZwQuerySystemInformationIndex = 0xf8; + ZwSetInformationProcessIndex = 0x131; + ZwTerminateThreadIndex = 0x14f; + } + else + { + return STATUS_UNSUCCESSFUL; + } + #ifdef HOOK_FILE HOOK_CALL(CreateFile); HOOK_CALL(OpenFile); @@ -662,6 +719,8 @@ void KPHHook() HOOK_CALL(DuplicateObject); HOOK_INDEX(QuerySystemInformation); #endif + + return STATUS_SUCCESS; } void KPHUnhook() diff --git a/trunk/KProcessHacker/hooks.h b/trunk/KProcessHacker/hooks.h index ec6b9a2fc..d6f46d4a9 100644 --- a/trunk/KProcessHacker/hooks.h +++ b/trunk/KProcessHacker/hooks.h @@ -25,7 +25,7 @@ #include -void KPHHook(); +NTSTATUS KPHHook(); void KPHUnhook(); typedef struct _KTHREAD @@ -291,7 +291,6 @@ typedef NTSTATUS (*_ZwOpenProcess)( PCLIENT_ID ClientId ); -#define ZwOpenThreadIndex 0xc9 typedef NTSTATUS (*_ZwOpenThread)( PHANDLE ThreadHandle, ACCESS_MASK DesiredAccess, @@ -307,7 +306,6 @@ typedef NTSTATUS (*_ZwQueryInformationFile)( FILE_INFORMATION_CLASS FileInformationClass ); -#define ZwQueryInformationProcessIndex 0xe4 typedef NTSTATUS (*_ZwQueryInformationProcess)( HANDLE ProcessHandle, int ProcessInformationClass, @@ -316,7 +314,6 @@ typedef NTSTATUS (*_ZwQueryInformationProcess)( int *ReturnLength ); -#define ZwQueryInformationThreadIndex 0xe5 typedef NTSTATUS (*_ZwQueryInformationThread)( HANDLE ThreadHandle, int ThreadInformationClass, @@ -333,7 +330,6 @@ typedef NTSTATUS (*_ZwQueryKey)( PULONG ResultLength ); -#define ZwQuerySystemInformationIndex 0xf8 typedef NTSTATUS (*_ZwQuerySystemInformation)( int SystemInformationClass, PVOID SystemInformation, @@ -370,7 +366,6 @@ typedef NTSTATUS (*_ZwSetInformationFile)( FILE_INFORMATION_CLASS FileInformationClass ); -#define ZwSetInformationProcessIndex 0x131 typedef NTSTATUS (*_ZwSetInformationProcess)( HANDLE ProcessHandle, int ProcessInformationClass, @@ -399,7 +394,6 @@ typedef NTSTATUS (*_ZwTerminateProcess)( ULONG ExitCode ); -#define ZwTerminateThreadIndex 0x14f typedef NTSTATUS (*_ZwTerminateThread)( HANDLE Thread, ULONG ExitCode diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c index 097860ccc..43475fb22 100644 --- a/trunk/KProcessHacker/kprocesshacker.c +++ b/trunk/KProcessHacker/kprocesshacker.c @@ -48,15 +48,7 @@ int ClientPID = -1; PVOID *OrigKiServiceTable = NULL; extern int CurrentCallCount; - -PVOID GetSystemRoutineAddress(WCHAR *Name) -{ - UNICODE_STRING unicodeName; - - RtlInitUnicodeString(&unicodeName, Name); - - return MmGetSystemRoutineAddress(&unicodeName); -} +int Hooked = FALSE; void DriverUnload(PDRIVER_OBJECT DriverObject) { @@ -64,11 +56,13 @@ void DriverUnload(PDRIVER_OBJECT DriverObject) UNICODE_STRING dosDeviceName; int i; - KPHUnhook(); + if (Hooked) + KPHUnhook(); + SsdtDeinit(); /* wait for any syscalls to complete, otherwise it's a BSOD. */ - waitTime.QuadPart = -((signed __int64)20000000); /* 2 seconds */ + waitTime.QuadPart = -((signed __int64)50000000); /* 5 seconds */ KeDelayExecutionThread(KernelMode, FALSE, &waitTime); if (OrigKiServiceTable != NULL) @@ -96,7 +90,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) if (status != STATUS_SUCCESS) return status; - KPHHook(); + Hooked = KPHHook() == STATUS_SUCCESS; RtlInitUnicodeString(&deviceName, KPH_DEVICE_NAME); RtlInitUnicodeString(&dosDeviceName, KPH_DEVICE_DOS_NAME); @@ -134,6 +128,10 @@ NTSTATUS KPHCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) dprintf("KProcessHacker: Client (PID %d) connected\n", ClientPID); dprintf("KProcessHacker: Base IOCTL is 0x%08x\n", KPH_CTL_CODE(0)); + /* hook again to make sure our hooks work for this new client */ + KPHUnhook(); + KPHHook(); + return status; }