popad ret
ShowDrRegInfo endp
;恢复被隐藏的dr寄存器
RecoveryDrReg proc ptrContext, pHandle pushad
;定位到LinkTable
mov ebx, threadCxtLink NEXT:
test ebx, ebx
jne @F ;如果没有遍历完 popad ret @@:
mov eax, (LinkTable ptr [ebx]).ThreadHandle cmp eax, pHandle
je @F ;如果找到匹配项
mov ebx, (LinkTable ptr [ebx]).NextLinkPtr jmp NEXT @@:
;拷贝完毕后立即结束
invoke CopyContextToLinkTable, ebx, ptrContext xor ebx, ebx jmp NEXT
RecoveryDrReg endp
;清空Context的dr寄存器 ClearDrReg proc ptrContext pushad
mov ebx, ptrContext mov ecx, 4 @@:
mov DWORD ptr [ebx + ecx], 0 add ecx, 4 cmp ecx, 18h jbe @B pushad
invoke DbgPrint, $CTA0(\ popad
invoke ShowDrRegInfo, ptrContext popad ret
ClearDrReg endp
;NtGetContextThread钩子代码 NtGetContextThreadHookCode proc ;ebx存放CONTEXT指针
mov ebx, DWORD ptr [ebp + 10h] ;线程句柄
mov edx, DWORD ptr [ebp + 0ch] pushad
invoke ShowDrRegInfo, ebx invoke IsFilterProcess .if eax ;如果是DNF.exe
invoke AddLinkTable, edx, ebx invoke ClearDrReg, ebx .else ;如果不是DNF.exe
invoke RecoveryDrReg, ebx, edx .endif
invoke ShowDrRegInfo, ebx ;执行被覆盖的代码 popad
mov eax, esi pop esi leave ret
NtGetContextThreadHookCode endp
;NtGetContextThread加跳转 HookNtGetContextThread proc pushad
;头5字节跳转
mov eax, offset NtGetContextThreadHookCode
sub eax, NtGetContextThreadAddr;805c13e0h;805c13edh sub eax, 5
mov ebx, NtGetContextThreadAddr;805c13e0h;805c13edh mov cl, 0E9h
mov BYTE PTR [ebx], cl
mov DWORD PTR [ebx + 1], eax popad ret
HookNtGetContextThread endp
DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING invoke DbgPrint, $CTA0(\ invoke PsGetCurrentProcess invoke GetNameOffset, eax
mov nameOffset, eax cmp eax, -1 je @F
mov nameOffset, eax cli
mov eax, cr0
and eax, not 10000h mov cr0, eax
call Hook
call HookThread call Dbg
call HookNtGetContextThread
mov eax, pDriverObject
assume eax : ptr DRIVER_OBJECT
mov [eax].DriverUnload, offset DriverUnload assume eax : nothing
mov eax, cr0
or eax, 10000h mov cr0, eax sti
invoke DbgPrint, $CTA0(\@@:
mov eax, STATUS_SUCCESS ret
DriverEntry endp end DriverEntry