一、LDasm.h Qhq' %LR
jF}-dfe
=%B5TBG
#ifndef _LDASM_ ,v<7O_A/e
#define _LDASM_ ?I[*{}@n"
+Bf?35LP
#ifdef __cplusplus gYCr,-_i
extern "C" { 5X f]j=_
#endif 1< Sg @
/w1M%10
unsigned long __fastcall SizeOfCode(void *Code, unsigned char **pOpcode); g ) 5mr:\
`BQv;NtP
unsigned long __fastcall SizeOfProc(void *Proc); '4nJ*X a
*s,[Uy ![
char __fastcall IsRelativeCmd(unsigned char *pOpcode); _6Y+E"@zs
X@"G1j >/
#ifdef __cplusplus ei<0,w[V1{
} S3:AitGJ
#endif F#>00b{Q
<n4` #d
#endif F~8'3!<9
}b1FB<e]
kDE-GX"Y
#define OP_NONE 0x00 ~L"$(^/
#define OP_MODRM 0x01 UWF \Vx*)b
#define OP_DATA_I8 0x02 N(Ru/9!y"
#define OP_DATA_I16 0x04 d ?8OY
#define OP_DATA_I32 0x08 R7/S SuG6\
#define OP_DATA_PRE66_67 0x10 0k5 -S~_\
#define OP_WORD 0x20 l[Z o,4*
#define OP_REL32 0x40 >I|8yqbfm
$ ]s^M=8
#define UCHAR unsigned char tL$,]I$1+
#define ULONG unsigned long n.&7lg^X
#define PVOID void* WM'!|lg
#define PUCHAR unsigned char* c,xdkiy3
#define BOOLEAN char 5c` ;~
#define FALSE 0 { c#US
#define TRUE 1 F qH) )2
2iG+Ek-?"
UCHAR OpcodeFlags[256] = rLsY_7!
{ f~ NS{gL*
OP_MODRM, // 00 ]q1w@)]n}
OP_MODRM, // 01 J\y^T3 Z
OP_MODRM, // 02 YB"gLv?
OP_MODRM, // 03 X5iD <Lh
OP_DATA_I8, // 04 ,D;8~l lM
OP_DATA_PRE66_67, // 05 FBXktSg
OP_NONE, // 06 juR>4SH
OP_NONE, // 07 IU8zi dn&
OP_MODRM, // 08 Gd 4S7J E
OP_MODRM, // 09 1Vy8eI`4
OP_MODRM, // 0A {N2GRF~c-y
OP_MODRM, // 0B FEk9a^Xyx
OP_DATA_I8, // 0C L ci?
OP_DATA_PRE66_67, // 0D mfj{_fR3
OP_NONE, // 0E c +]r
OP_NONE, // 0F JPDxzp
OP_MODRM, // 10 5S4 Nx>
OP_MODRM, // 11 /(~ HHNnh
OP_MODRM, // 12 bSIY|/d+
OP_MODRM, // 13 %`$bQU
OP_DATA_I8, // 14 ()|e xWW
OP_DATA_PRE66_67, // 15 @lzq`SzM
OP_NONE, // 16 !S<p"
OP_NONE, // 17 <\~@l^lU
OP_MODRM, // 18 Zdrniae ah
OP_MODRM, // 19 IYe[IHny1
OP_MODRM, // 1A :Lu A6
OP_MODRM, // 1B p!E*A NwX
OP_DATA_I8, // 1C d1yLDj?
OP_DATA_PRE66_67, // 1D LI-ewea
OP_NONE, // 1E [?6+ r
OP_NONE, // 1F D8k >f ]
OP_MODRM, // 20 &x r(Kb
OP_MODRM, // 21 HZ(giAyjq
OP_MODRM, // 22 DFwiBB6
OP_MODRM, // 23 PYCG#U
OP_DATA_I8, // 24 e9\_H=t+
OP_DATA_PRE66_67, // 25 k-4z2qB
OP_NONE, // 26 _+}o /449
OP_NONE, // 27 KfK5e{yT
OP_MODRM, // 28 &w=ul'R98
OP_MODRM, // 29 $5#DU__F/
OP_MODRM, // 2A ;5|d[r}k3
OP_MODRM, // 2B A'uubFRL2[
OP_DATA_I8, // 2C Eb'M< ZY
OP_DATA_PRE66_67, // 2D B_@p@6z
OP_NONE, // 2E `/G9*tIR8g
OP_NONE, // 2F Ix @nRc'
OP_MODRM, // 30 T7Y+ WfYh
OP_MODRM, // 31 Y6j gAq
OP_MODRM, // 32 *I9O63
OP_MODRM, // 33 kK &A K2
OP_DATA_I8, // 34 h5n@SE>G
OP_DATA_PRE66_67, // 35 'O 7>w%#
OP_NONE, // 36 ] < ;y_
OP_NONE, // 37 }+:X=@Z@
OP_MODRM, // 38 >+%0|6VSb
OP_MODRM, // 39 a 4? c~bs
OP_MODRM, // 3A ?%T]V+40
OP_MODRM, // 3B R$2\Xl@qQF
OP_DATA_I8, // 3C M dnapxuS
OP_DATA_PRE66_67, // 3D 5',&8
OP_NONE, // 3E BWkT Qd<t
OP_NONE, // 3F !#4b#l(e6
OP_NONE, // 40 }?6gj%$c
OP_NONE, // 41 c O dgBi
OP_NONE, // 42 ]_m (q`_
OP_NONE, // 43 <,t6A?YoMP
OP_NONE, // 44 Cv< s|
OP_NONE, // 45 gS!zaD7Nr
OP_NONE, // 46 rDLgQ{Sea
OP_NONE, // 47 /b."d\
OP_NONE, // 48 }Rq{9j,%
OP_NONE, // 49 j HEt
OP_NONE, // 4A V?n=yg
OP_NONE, // 4B 9bUFxSH
OP_NONE, // 4C tPFj[Y~Iy
OP_NONE, // 4D j;EH[3
OP_NONE, // 4E Lwo9s)j<e
OP_NONE, // 4F B| r'
OP_NONE, // 50 ;e W \41w
OP_NONE, // 51 5I/lFoy7
OP_NONE, // 52 {n(/ c3 3
OP_NONE, // 53 E^m;Ab=
OP_NONE, // 54 rXq{WS`
OP_NONE, // 55 )Cd.1X8
OP_NONE, // 56 !gJw? (8"
OP_NONE, // 57 l\ Vr D2j8
OP_NONE, // 58 P[tYu:
OP_NONE, // 59 I5ZM U
OP_NONE, // 5A 6!wk5#
OP_NONE, // 5B e/ }4Pt
OP_NONE, // 5C ]8 8qjKL
OP_NONE, // 5D N! I$Qtr,
OP_NONE, // 5E .AZwVP<
OP_NONE, // 5F d{Owz&PL
OP_NONE, // 60 /@I`V?Q!a
OP_NONE, // 61 nk f7Fq}
OP_MODRM, // 62 |#'n VN.;
OP_MODRM, // 63 rR 86D
OP_NONE, // 64 73Hm:"Eqd
OP_NONE, // 65 %Aqf=R_^
OP_NONE, // 66 ARE jS $
OP_NONE, // 67 nv\K!wZI=b
OP_DATA_PRE66_67, // 68 @0d "^
OP_MODRM | OP_DATA_PRE66_67, // 69 3#Bb4\_v
OP_DATA_I8, // 6A IdK<:)Q
OP_MODRM | OP_DATA_I8, // 6B " m13HS
OP_NONE, // 6C 8QoxU" c&
OP_NONE, // 6D 5 7-Hx;
OP_NONE, // 6E Pc2!OQC'""
OP_NONE, // 6F T6QRr}8`/J
OP_DATA_I8, // 70 /K NDo^P
OP_DATA_I8, // 71 aU^6FI
OP_DATA_I8, // 72 ^'a#FbMtt
OP_DATA_I8, // 73 X%3 ?sH
OP_DATA_I8, // 74 ],k~t5+
OP_DATA_I8, // 75 n:P:im?,y*
OP_DATA_I8, // 76 L!lmy&1
OP_DATA_I8, // 77 -5 D<zP/
OP_DATA_I8, // 78 N+@ Ff3M
OP_DATA_I8, // 79 cw {TS
OP_DATA_I8, // 7A F K593z
OP_DATA_I8, // 7B 9$HBKcO
OP_DATA_I8, // 7C (u} /( Ux
OP_DATA_I8, // 7D o3/o2[s
OP_DATA_I8, // 7E ,1#? 0q
OP_DATA_I8, // 7F Z17b=x Jw
OP_MODRM | OP_DATA_I8, // 80 I Bo
OP_MODRM | OP_DATA_PRE66_67, // 81 abQ. N
OP_MODRM | OP_DATA_I8, // 82 n@RmH>"
OP_MODRM | OP_DATA_I8, // 83 + w^,!gA&
OP_MODRM, // 84 ,"(G
OP_MODRM, // 85 #A z#_0=
OP_MODRM, // 86 LSou]{R
OP_MODRM, // 87 XNWtX-[ ^@
OP_MODRM, // 88 Zek@ xr;]
OP_MODRM, // 89 ,s#~00C|
OP_MODRM, // 8A RTcxZ/\" #
OP_MODRM, // 8B Hyy b0c^=
OP_MODRM, // 8C ["EXSptB
OP_MODRM, // 8D UJI2L-;Ul
OP_MODRM, // 8E "kyCY9) %
OP_MODRM, // 8F GpeW<% \P
OP_NONE, // 90 x950,`zy
OP_NONE, // 91 eUA] OF @
OP_NONE, // 92 .d1ff] ;
OP_NONE, // 93 ^~YT<cJ1h
OP_NONE, // 94 U|} ?{x
OP_NONE, // 95 v74 5F Iy<
OP_NONE, // 96 N;g@ly o
OP_NONE, // 97 t@qf/1
OP_NONE, // 98 ]y0Y(
OP_NONE, // 99 y/Xs+ {x
OP_DATA_I16 | OP_DATA_PRE66_67,// 9A >$4# G)s
OP_NONE, // 9B bE_8NA"2
OP_NONE, // 9C @j/2 $
OP_NONE, // 9D L^sjV/\oW
OP_NONE, // 9E Xqf,_I =V
OP_NONE, // 9F `L'g<VK;
OP_DATA_PRE66_67, // A0 h aAY=:
OP_DATA_PRE66_67, // A1 ;+9OzF ;
OP_DATA_PRE66_67, // A2 |b Y@HpMp
OP_DATA_PRE66_67, // A3 $h#sb4ek
OP_NONE, // A4 xlI =)ak{
OP_NONE, // A5 IVR%H_uz
OP_NONE, // A6 s <O$ Y
OP_NONE, // A7 "_{NdV|a
OP_DATA_I8, // A8 [X (4( 1i
OP_DATA_PRE66_67, // A9 }%|ewy9|CW
OP_NONE, // AA }v ZOPTP
OP_NONE, // AB / F0q8j0
OP_NONE, // AC b($hp%+yJ
OP_NONE, // AD :`bC3Mr
OP_NONE, // AE #H Un~r
OP_NONE, // AF iGyetFqKw
OP_DATA_I8, // B0 @*6fEG{,q
OP_DATA_I8, // B1 c!6D{(sfh
OP_DATA_I8, // B2 nS+Rbhs
OP_DATA_I8, // B3 ai !u+L
OP_DATA_I8, // B4 FQZ*i\G>>
OP_DATA_I8, // B5 -C=0Pg]ga
OP_DATA_I8, // B6 =?i?-6 M
OP_DATA_I8, // B7 M:+CW;||!
OP_DATA_PRE66_67, // B8 `ecseBn3d
OP_DATA_PRE66_67, // B9 S=@+qcI
OP_DATA_PRE66_67, // BA ^z?b6kTC
OP_DATA_PRE66_67, // BB !<[+ u
OP_DATA_PRE66_67, // BC bLc5$U$!I
OP_DATA_PRE66_67, // BD X4;U4pU#
OP_DATA_PRE66_67, // BE #6 M] tr
OP_DATA_PRE66_67, // BF MO`Y&<g~A
OP_MODRM | OP_DATA_I8, // C0 o m G2p
OP_MODRM | OP_DATA_I8, // C1 CK_d Eh2c
OP_DATA_I16, // C2 DB v M.'b$
OP_NONE, // C3 aV;|2}q "
OP_MODRM, // C4 fc#9e9R
OP_MODRM, // C5 &;PxDlY5
OP_MODRM | OP_DATA_I8, // C6 >y%H2][
OP_MODRM | OP_DATA_PRE66_67, // C7 :jiEn y
OP_DATA_I8 | OP_DATA_I16, // C8 Wt.DL mO
OP_NONE, // C9 pW] j.JM
OP_DATA_I16, // CA |$WHw*F^
OP_NONE, // CB E$"NOR
OP_NONE, // CC yR$_ZXsd
OP_DATA_I8, // CD @?B+|*cm
OP_NONE, // CE NaR} 0
OP_NONE, // CF wNa5qp 0
OP_MODRM, // D0 2Zu9? L ,I
OP_MODRM, // D1 _zj^k$ j
OP_MODRM, // D2 >}SEU-7&\
OP_MODRM, // D3 ( )lgd7|+
OP_DATA_I8, // D4 8xy8/UBIk0
OP_DATA_I8, // D5 *Y>w0k
OP_NONE, // D6 poz_=,c
OP_NONE, // D7 UyGo0POW
OP_WORD, // D8 w:\} B'u
OP_WORD, // D9 -Y_, .'ex
OP_WORD, // DA <Jgcj 4D
OP_WORD, // DB Nj9A-*0g6N
OP_WORD, // DC :jTSO d[r
OP_WORD, // DD .IW`?9O $E
OP_WORD, // DE qO{z{@jo55
OP_WORD, // DF TFXBN.?9T
OP_DATA_I8, // E0 %+*=Vr
OP_DATA_I8, // E1 |=;hQ2H yF
OP_DATA_I8, // E2 Z],j|r Wy6
OP_DATA_I8, // E3 .n<vhLDQn
OP_DATA_I8, // E4 /A{ Zf'DI
OP_DATA_I8, // E5 um,f!ho-U
OP_DATA_I8, // E6 &=lc]sk
OP_DATA_I8, // E7 7d;|?R-8D
OP_DATA_PRE66_67 | OP_REL32, // E8 8'PZA,CW
OP_DATA_PRE66_67 | OP_REL32, // E9 atyvo0fNd
OP_DATA_I16 | OP_DATA_PRE66_67,// EA 5/"$ _7"{a
OP_DATA_I8, // EB E+]}KX:
OP_NONE, // EC HLWff O/
OP_NONE, // ED /DAR'9@h
OP_NONE, // EE .!3e$mhV
OP_NONE, // EF `nF SJlr&
OP_NONE, // F0 = wz}yfdrC
OP_NONE, // F1 >V6 t L;+
OP_NONE, // F2 KQr+VQdq>
OP_NONE, // F3 n\+ c3
OP_NONE, // F4 3"x_Y
OP_NONE, // F5 f"s_dR
OP_MODRM, // F6 pw Fdfp
OP_MODRM, // F7 *D|a`R!Y
OP_NONE, // F8 |0[Buh[_:c
OP_NONE, // F9 6*Z7JiQ 0
OP_NONE, // FA cQEUHhRg!
OP_NONE, // FB 72, m c
OP_NONE, // FC TsFhrtnx&X
OP_NONE, // FD X$!fR >Zc
OP_MODRM, // FE T?RY~GA
OP_MODRM | OP_REL32 // FF |u>V> PN
}; w'T AM"D`
<1* kXTN(
vbmt0d f
UCHAR OpcodeFlagsExt[256] = v aeQ}F
{ /5sn *,
OP_MODRM, // 00 A}lxJ5h0
OP_MODRM, // 01 1WtE] D
OP_MODRM, // 02 DzR,ou
OP_MODRM, // 03 cq[9#@ 4=
OP_NONE, // 04 #]d m/WzY
OP_NONE, // 05 '#c# .O
OP_NONE, // 06 E7O3$B8
OP_NONE, // 07 /Q st :q
OP_NONE, // 08 2{j$1EdI@-
OP_NONE, // 09 _S) K+C|@
OP_NONE, // 0A N)mZ!K44
OP_NONE, // 0B ?jR# txR
OP_NONE, // 0C u43Mo\"<&%
OP_MODRM, // 0D %fF ,Fnf2
OP_NONE, // 0E 9<3( QR
OP_MODRM | OP_DATA_I8, // 0F 'TYO-'aC
OP_MODRM, // 10 8` L ]<Dm
OP_MODRM, // 11 2:|vJ<Q
OP_MODRM, // 12 6Mk#) ebM
OP_MODRM, // 13 B= *0
OP_MODRM, // 14 [NE!
OP_MODRM, // 15 Vl+UC1M}B>
OP_MODRM, // 16 :JSxsA6 k
OP_MODRM, // 17 dm/3{\ 4
OP_MODRM, // 18 5@l5exuG*m
OP_NONE, // 19 0fstEExw
OP_NONE, // 1A [>`.,k
OP_NONE, // 1B A)~ oD_ooQ
OP_NONE, // 1C Up%XBA
OP_NONE, // 1D #rW -jW=A
OP_NONE, // 1E &(<>} r
OP_NONE, // 1F fwUv FK1G
OP_MODRM, // 20 i5(qJ/u
OP_MODRM, // 21 Ma\%uEgTD
OP_MODRM, // 22 2Rys :$
OP_MODRM, // 23 {_ W8Qm`.
OP_MODRM, // 24 _ LgP
OP_NONE, // 25 fiC0'4.,
OP_MODRM, // 26 R%LFFMVn
OP_NONE, // 27 6VQQ I9
OP_MODRM, // 28 C!547(l [
OP_MODRM, // 29 <x$nw'H9
OP_MODRM, // 2A RJ3uu NK7
OP_MODRM, // 2B Tn,_0
OP_MODRM, // 2C > mCH!ey
OP_MODRM, // 2D [V /f{y~ {
OP_MODRM, // 2E {B#w9> 'b
OP_MODRM, // 2F }X])055S
OP_NONE, // 30 kDJq T
OP_NONE, // 31 vnf2Z,f%
OP_NONE, // 32 ;j~%11
OP_NONE, // 33 ( !m6>m2
OP_NONE, // 34 _lT'nFe =Q
OP_NONE, // 35 p4\sKF8-
OP_NONE, // 36 D@5h$ m5
OP_NONE, // 37 8t< X
OP_NONE, // 38 X16O 9qsh
OP_NONE, // 39 iVVR$uzhH
OP_NONE, // 3A j, %i.[8S
OP_NONE, // 3B u46Z}~xfb
OP_NONE, // 3C f;+.j/ +
OP_NONE, // 3D d@8: f
OP_NONE, // 3E _h,X3P
OP_NONE, // 3F AU}|o0Ur
OP_MODRM, // 40 } nIYNeP?D
OP_MODRM, // 41 [P6A $HC<
OP_MODRM, // 42 ?J+ *i d
OP_MODRM, // 43 q)@;8Z=_c
OP_MODRM, // 44 5>H&0> \
OP_MODRM, // 45 N!tNRMTi
OP_MODRM, // 46 x a\~(B.
OP_MODRM, // 47 3fE0cVG *
OP_MODRM, // 48 gtY7N>e
OP_MODRM, // 49 i gnOF
OP_MODRM, // 4A Mx 3fT >?
OP_MODRM, // 4B }`2+`w%uZ
OP_MODRM, // 4C wk=s3^
OP_MODRM, // 4D _?$')P|
OP_MODRM, // 4E UpiZd/K
OP_MODRM, // 4F ^Y8G}Z|
OP_MODRM, // 50 a6d|Ps.\!
OP_MODRM, // 51 e)L!4Y44K
OP_MODRM, // 52 gaU^l73 ,C
OP_MODRM, // 53 :X1Y
OP_MODRM, // 54 F=UW[zy/[
OP_MODRM, // 55 'Rv.6>xqc
OP_MODRM, // 56 CF+:v(NL
OP_MODRM, // 57 PhmtCp0-7-
OP_MODRM, // 58 X(]J \?n'
OP_MODRM, // 59 |A H@W#7j
OP_MODRM, // 5A U71A#OD^U
OP_MODRM, // 5B c,*a|@
OP_MODRM, // 5C od3b, Q
OP_MODRM, // 5D 4DGK Zh'm"
OP_MODRM, // 5E u3PM 7z!~
OP_MODRM, // 5F L%.=Sb mS
OP_MODRM, // 60 )U2%kmt
OP_MODRM, // 61 ? z K>[L
OP_MODRM, // 62 rT{ 2
OP_MODRM, // 63 \ &s$?r
OP_MODRM, // 64 z| N*Gs>,
OP_MODRM, // 65 l{3ZN"`I
OP_MODRM, // 66 ^aL> /'Y#|
OP_MODRM, // 67 z vbz3a
OP_MODRM, // 68 9OM&&Ue<E
OP_MODRM, // 69 pR~" p#Y
OP_MODRM, // 6A zm^ 5WH
OP_MODRM, // 6B z&A # d
OP_MODRM, // 6C W o$ UV
OP_MODRM, // 6D DOW Z hD
OP_MODRM, // 6E <D( |}5qR
OP_MODRM, // 6F Z4PA dT
OP_MODRM | OP_DATA_I8, // 70 M cbiO)@I
OP_MODRM | OP_DATA_I8, // 71 7 8u=Jz6
OP_MODRM | OP_DATA_I8, // 72 Z+! 96LR
OP_MODRM | OP_DATA_I8, // 73 Wi!$b L`l
OP_MODRM, // 74 aW$))J)0
OP_MODRM, // 75 I$Fr 8R$
OP_MODRM, // 76 uWerC?da
OP_NONE, // 77 BjbpRQ,
OP_NONE, // 78 3x~AaC.j
OP_NONE, // 79 k X]p;C
OP_NONE, // 7A 82Nw 6om6i
OP_NONE, // 7B b 'y W+
OP_MODRM, // 7C q e;O Ox
OP_MODRM, // 7D [$(/H;
OP_MODRM, // 7E G@]|/kN1y
OP_MODRM, // 7F ~6:y@4&F
OP_DATA_PRE66_67 | OP_REL32, // 80 W /| C
OP_DATA_PRE66_67 | OP_REL32, // 81 'l3K*lck
OP_DATA_PRE66_67 | OP_REL32, // 82 <S%kwS
OP_DATA_PRE66_67 | OP_REL32, // 83 HxH=~B1"P
OP_DATA_PRE66_67 | OP_REL32, // 84 B[Fuyy?
OP_DATA_PRE66_67 | OP_REL32, // 85 1)f~OL8o
OP_DATA_PRE66_67 | OP_REL32, // 86 E$8 4c+
OP_DATA_PRE66_67 | OP_REL32, // 87 ( KxL*gB
OP_DATA_PRE66_67 | OP_REL32, // 88 H/6GD,0
OP_DATA_PRE66_67 | OP_REL32, // 89 IW'2+EGc
OP_DATA_PRE66_67 | OP_REL32, // 8A J]| lCwF
OP_DATA_PRE66_67 | OP_REL32, // 8B nu#_,x<LS
OP_DATA_PRE66_67 | OP_REL32, // 8C /RmHG H!
OP_DATA_PRE66_67 | OP_REL32, // 8D / 8` S}g+
OP_DATA_PRE66_67 | OP_REL32, // 8E 3y Azt*dZ
OP_DATA_PRE66_67 | OP_REL32, // 8F H19CVc\B
OP_MODRM, // 90 l AwOp
OP_MODRM, // 91 ZkJYPXdn?
OP_MODRM, // 92 ,{{uRs/
OP_MODRM, // 93 z A xwM-`
OP_MODRM, // 94 9R"bo*RIS
OP_MODRM, // 95 9J?G"JV?
OP_MODRM, // 96 1& k_&o
OP_MODRM, // 97 X~Li`
OP_MODRM, // 98 mdOF0b%-]
OP_MODRM, // 99 K`@GN T&
OP_MODRM, // 9A Iy](?b
OP_MODRM, // 9B >=2nAv/(
OP_MODRM, // 9C O329Bkg
OP_MODRM, // 9D 'PlKCn`(w
OP_MODRM, // 9E [pmZ0/l
OP_MODRM, // 9F ~ S R:,R
OP_NONE, // A0 OZ_'& CZ
OP_NONE, // A1 ZBJYpeGe
OP_NONE, // A2 =? xA*_^
OP_MODRM, // A3 HqU"i Y>b
OP_MODRM | OP_DATA_I8, // A4 -?!Z/#i4
OP_MODRM, // A5 >.#uoW4ZV
OP_NONE, // A6 jo<[|ZD
OP_NONE, // A7 0 sq/_S
OP_NONE, // A8 i[^?24~ c
OP_NONE, // A9 mxQS9y
OP_NONE, // AA Qkk~{OuC
OP_MODRM, // AB q?Q"Ab
OP_MODRM | OP_DATA_I8, // AC u3 ?+Hu|*T
OP_MODRM, // AD S,3e|-&$
OP_MODRM, // AE J*,Ed51& 7
OP_MODRM, // AF S5v>WI^0h
OP_MODRM, // B0 YT, 1E>rd
OP_MODRM, // B1 }.2pR*W
OP_MODRM, // B2 0V}vVAa(B
OP_MODRM, // B3 {)ZbOq2
OP_MODRM, // B4 =[t([DG
OP_MODRM, // B5 )R9>;CuC9?
OP_MODRM, // B6 x}N+ vK
OP_MODRM, // B7 ( rZq0*
OP_NONE, // B8 vxr3|2`
OP_NONE, // B9 0gO2^m)W
OP_MODRM | OP_DATA_I8, // BA ;5" r)F+P
OP_MODRM, // BB Mk|h ><Q"
OP_MODRM, // BC fn#b3ee
OP_MODRM, // BD O%(:8nIgZ
OP_MODRM, // BE xE;fM\7pu
OP_MODRM, // BF \ )y5~te*
OP_MODRM, // C0 B`RbXk68q
OP_MODRM, // C1 5>}L3r>a;
OP_MODRM | OP_DATA_I8, // C2 $Xz9xzOR
OP_MODRM, // C3 )u\"xxcV
OP_MODRM | OP_DATA_I8, // C4 rm3 ~]
OP_MODRM | OP_DATA_I8, // C5 _QY0j%W
OP_MODRM | OP_DATA_I8, // C6 lOd[ 8|/
OP_MODRM, // C7 m>zU wGYEu
OP_NONE, // C8 QnaMj Dh$6
OP_NONE, // C9 I \ vu?$w
OP_NONE, // CA z<^HohT
OP_NONE, // CB ;M"hX
OP_NONE, // CC mqq~&n I
OP_NONE, // CD iOki ZN+d>
OP_NONE, // CE ,"j |0Q
OP_NONE, // CF f*oL8"?u&
OP_MODRM, // D0 wG^{Jf&@$
OP_MODRM, // D1 *e _ /D$SC
OP_MODRM, // D2 _4%+TN6z
OP_MODRM, // D3 ?"qU.}kGL
OP_MODRM, // D4 *QAK9mc
OP_MODRM, // D5 dLQ!hKD~
OP_MODRM, // D6 "V?U^L>SF
OP_MODRM, // D7 SwSBQq%h]M
OP_MODRM, // D8 G'{4ec0<{
OP_MODRM, // D9 pmQ9i A@=
OP_MODRM, // DA @Cw<wrem
OP_MODRM, // DB ;znIY&Z
OP_MODRM, // DC `+]4C +w
OP_MODRM, // DD lm]4zs /A
OP_MODRM, // DE Z$HYXm
OP_MODRM, // DF ivw2EEo,
OP_MODRM, // E0 ; 'R{b$B;|
OP_MODRM, // E1 `C] t2^
OP_MODRM, // E2 ,}`II|.oB
OP_MODRM, // E3 AP/5, M<
OP_MODRM, // E4 pS*vwYA
OP_MODRM, // E5 !*+~R2&b
OP_MODRM, // E6 <E$5LP;:
OP_MODRM, // E7 (K^9$w]tf
OP_MODRM, // E8 K ^s!0[6
OP_MODRM, // E9 MCL5a@BX)
OP_MODRM, // EA . CrahV1G
OP_MODRM, // EB s 6vsV
OP_MODRM, // EC i&{8a3B
OP_MODRM, // ED rc 9 \
OP_MODRM, // EE )k <ON~x
OP_MODRM, // EF |UBR8
OP_MODRM, // F0 9't d}S
OP_MODRM, // F1 Aj SIM.
OP_MODRM, // F2 YDC[s ^d5
OP_MODRM, // F3 {$oZR" MP
OP_MODRM, // F4 iV( B0z
OP_MODRM, // F5 u <D&R T
OP_MODRM, // F6 G@ BrU q
OP_MODRM, // F7 R%8nR6iG"
OP_MODRM, // F8 cC&R~h]|
OP_MODRM, // F9 W ^60BZ
OP_MODRM, // FA v3Te+oLg
OP_MODRM, // FB ZRsD n
OP_MODRM, // FC E9! IGci
OP_MODRM, // FD ~}$:iyJV(>
OP_MODRM, // FE {~[H"h537t
OP_NONE // FF FavU"QU&|
}; TB*g$ *
Bl3G_Ep
k_-=:(Z
unsigned long __fastcall SizeOfCode(void *Code, unsigned char **pOpcode) t \Fc <
{ --D w8FR9
PUCHAR cPtr; (GMKIw2
UCHAR Flags; Iwize,J~X
BOOLEAN PFX66, PFX67; V`pTl3
BOOLEAN SibPresent; >Y1?`
UCHAR iMod, iRM, iReg; fP&F$"o8
UCHAR OffsetSize, Add; y@nWa\i G
UCHAR Opcode; F,11 \j
=yz#L@\!
OffsetSize = 0; )>\ J~{
PFX66 = FALSE; *O)_D bj
PFX67 = FALSE; ":Kn@S'{(
cPtr = (PUCHAR)Code; KQJn\#>
HsR#dp+s~
while ( (*cPtr == 0x2E) || (*cPtr == 0x3E) || (*cPtr == 0x36) || U4 m[@wF
(*cPtr == 0x26) || (*cPtr == 0x64) || (*cPtr == 0x65) || Ua5m2&U1
(*cPtr == 0xF0) || (*cPtr == 0xF2) || (*cPtr == 0xF3) || q&<#)#+
(*cPtr == 0x66) || (*cPtr == 0x67) ) c 72Oy+#
{ Jtd@8fVi
if (*cPtr == 0x66) PFX66 = TRUE; htX'bA
if (*cPtr == 0x67) PFX67 = TRUE; I%e7:cs>
cPtr++; J}._v\Q7P
if (cPtr > (PUCHAR)Code + 16) return 0; >h[tHM O
} &I'~:nWpt
Opcode = *cPtr; c`doR(oZ
if (pOpcode) *pOpcode = cPtr; >z>UtT:
if (*cPtr == 0x0F) By3dRiM=,2
{ u%XFFt5
cPtr++; <Cg;l<$`b
Flags = OpcodeFlagsExt[*cPtr]; _9!Ru!u~
} else OiM{@
{ LaN4%[;X1-
Flags = OpcodeFlags[Opcode]; ^ / f*5k
if (Opcode >= 0xA0 && Opcode <= 0xA3) PFX66 = PFX67; 3qpk Mu3
} $ZcmE<7k
cPtr++; ; Jx ^
if (Flags & OP_WORD) cPtr++; }ZVNDvGH
if (Flags & OP_MODRM) cLR8U1k'
{ \F1n Ej
iMod = *cPtr >> 6; a#u JzYB0
iReg = (*cPtr & 0x38) >> 3; SCGQo .~,
iRM = *cPtr & 7; Z :Kob b
cPtr++; =WO{h48]
kQ'G+Kw~F
if ((Opcode == 0xF6) && !iReg) Flags |= OP_DATA_I8; jWU)y)$
if ((Opcode == 0xF7) && !iReg) Flags |= OP_DATA_PRE66_67; 4 Qw; r
\ g0
SibPresent = !PFX67 & (iRM == 4); \[D"W{9 l
switch (iMod) -C8awtbC
{ GbL,k? ey
case 0: /1OhW>W3eH
if ( PFX67 && (iRM == 6)) OffsetSize = 2; 4p1{Ady
if (!PFX67 && (iRM == 5)) OffsetSize = 4; $}\. )^[}
break; eA+6-'qN
case 1: OffsetSize = 1; q-!m|<Z
break; i\t4TdEx(
case 2: if (PFX67) OffsetSize = 2; else OffsetSize = 4; Ur@'X-
break; Ybok [5
case 3: SibPresent = FALSE; 9^aMmN&6N2
} YHAy+S
if (SibPresent) BGA.8qWR4
{ i4uUvZ f
if (((*cPtr & 7) == 5) && ( (!iMod) || (iMod == 2) )) OffsetSize = 4; QGYmQ9m{kL
cPtr++; Uq[NO JC
} WJg?R ^
cPtr = (PUCHAR)(ULONG)cPtr + OffsetSize; |#MA?oz3T
} XLzHm&;
3|@Ske1%Y
if (Flags & OP_DATA_I8) cPtr++; Ao=.=0os
if (Flags & OP_DATA_I16) cPtr += 2; 0h#' 3z<
if (Flags & OP_DATA_I32) cPtr += 4; A3h[VnuG,
if (PFX66) Add = 2; else Add = 4; B '&%EW]
if (Flags & OP_DATA_PRE66_67) cPtr += Add; G#K=n
return (ULONG)cPtr - (ULONG)Code; Rb\\6 BU0
} CxwZ$0
qL3*H\9N
uE+]] ir
\J:/l|h
unsigned long __fastcall SizeOfProc(void *Proc) Xg c@cwd
{ CYs:P8^
ULONG Length; <{7B ^'
PUCHAR pOpcode; vMDV%E S1t
ULONG Result = 0; hcwK i
{_l@ws
do \h?C G_|]
{ iIA&\'|;i
Length = SizeOfCode(Proc, &pOpcode); $#8dtF
Result += Length; ytK h[Uo
if ((Length == 1) && (*pOpcode == 0xC3)) break; CsJw;]dYI
Proc = (PVOID)((ULONG)Proc + Length); O| ) [j@7
} while (Length); }RDGk+x7|
return Result; ehV`@ss
} \f5$L`
v&;q4b4
`rN,*kcP
Xk8+m>
char __fastcall IsRelativeCmd(unsigned char *pOpcode) 9,sj,A1
{ '%vb&a!.6
UCHAR Flags; ?~Fk_#jz,@
if (*pOpcode == 0x0F) Flags = OpcodeFlagsExt[*(PUCHAR)((ULONG)pOpcode + 1)]; %O#) =M~
else Flags = OpcodeFlags[*pOpcode]; <Wn={1Ts"
return (Flags & OP_REL32); ( sHqzWh
} lTBPq?4{
]3u ErnI
unsigned long GetPatchSize(void* Proc,unsigned long dwNeedSize) }OZp[V
{ ) j v]Oz
ULONG Length; ]r8t^bqe
PUCHAR pOpcode; AIgJ,=9K
ULONG PatchSize = 0; =NMT H[
uu@Y]0-
do Eh L 8rR
{ $<cio X
Length = SizeOfCode(Proc, &pOpcode); qk VGa%^
if ((Length == 1) && (*pOpcode == 0xC3)) break; sL rSi
if ((Length == 3) && (*pOpcode == 0xC2)) break; INtt0Cm9"
Proc = (PVOID)((ULONG)Proc + Length); K =T ]@ix$
~'> R K
PatchSize += Length; b~dm+5W7
if (PatchSize >= dwNeedSize) acr@erk
{ ii&{gC
break; l}o d W
} /^ * GoB
C/V{&/5w
} while (Length); J A0$Fz
tTrUVuZ
return PatchSize; NC bl|v=
} u=^0n2ez
3?|gBi X
kcT ?< r
qZRx,^gd
二、SSDTSHADOW.h Z- [nHSf
. 2_t/2
| rJ_
#include <NTDDK.H> XvBEC_xWZ
PRm Z 3
$$C5Q;7w!
typedef struct _System_Service_Table{ ,Ie~zZE &
PVOID ServiceTableBase; d Iv/.x/V
PVOID ServiceCounterTableBase; KLBV(`MS
ULONG NumberOfServices; js )G
PVOID ParamTableBase; Gjuc"JR7
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE; #|^7{TN
Y+N^_2@+C
F=
typedef struct _SERVICE_DESCRIPTOR_TABLE{ J)(H-xvV
SYSTEM_SERVICE_TABLE ntoskrnl; // ntoskrnl.exe (native api) , u QLXF2
SYSTEM_SERVICE_TABLE win32k; // win32k.sys (gdi/user) e 1{t qNJ
SYSTEM_SERVICE_TABLE Table3; // not used Jl3l\I'
SYSTEM_SERVICE_TABLE Table4; // not used RLY Ae
}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE; P,AS`=z
rPK?p J
?zUV3Qgzj
S}e*~^1J
) ?'sw5C
//---------------------------------------------------------------------------------- QHr 3J
`6j?2plZ
typedef ULONG (*NTUSERWINDOWFROMPOINT)( LONG, LONG ); ^w2n
)Tngtt D
typedef UINT_PTR (*NTUSERQUERYWINDOW) S rK;b .
( <)Kjf/ x
IN ULONG WindowHandle, S,AZrgh,"X
IN ULONG TypeInformation ?O4Dhu
); nIph[Vs-Z
TOMvJ>bF
typedef ULONG (*NTUSERFINDWINDOWEX) s>~&: GUwR
( N _pJE?
IN HWND hwndParent, Zy*} C,Z
IN HWND hwndChild, vW$] :).
IN PUNICODE_STRING pstrClassName OPTIONAL, 8"8{Nf-"
IN PUNICODE_STRING pstrWindowName OPTIONAL, =Bo0O ei
IN DWORD dwType 1b|<
); vy|}\%*r~
dJ24J+9}]j
typedef NTSTATUS (*NTUSERBUILDHWNDLIST) /-|x xy
( *"zE,Bp"
IN HDESK hdesk, ;4qalxzu
IN HWND hwndNext, :He:Bdk
IN ULONG fEnumChildren, {Z?!*Ow
IN DWORD idThread, ~Q%QA._R?
IN UINT cHwndMax, X4/r#<Da
OUT HWND *phwndFirst, A1'I K.
OUT ULONG *pcHwndNeeded 6kDU}]c:H]
); 0?`#ko7~d
=G72`]#-
typedef NTSTATUS (*NTDUPLICATEOBJECT) 7olA@;$
( Xs?> 6i@$$
IN HANDLE SourceProcessHandle, d*AV(g#B
IN HANDLE SourceHandle, m76]IN q
IN HANDLE TargetProcessHandle, Wex4>J<`/
OUT PHANDLE TargetHandle OPTIONAL, . LS .Z 4@
IN ACCESS_MASK DesiredAccess, * l Tu-
IN ULONG Attributes, 9"aTF,'F/
IN ULONG Options w##Fpv<m
); W>Kwl*Cis"
jGWLYI=V2
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess KWYG\#S0]
( IpP0|:}
IN HANDLE ProcessHandle, 7/yd@#$X
IN PROCESSINFOCLASS ProcessInformationClass, :({<"H)!'
OUT PVOID ProcessInformation, !(~>-;A8
IN ULONG ProcessInformationLength, ][mc^eI0s|
OUT PULONG ReturnLength OPTIONAL u rOGOa$
); +!Ltn
h.^DRR^S
:6 fQE#(s&
typedef NTSTATUS(*OBOPENOBJECTBYPOINTER) a Fym&n\
( 6. jZy~
IN PVOID Object, 5HN<*u % z
IN ULONG HandleAttributes, a3 x~B =E
IN PACCESS_STATE PassedAccessState OPTIONAL, E0Djo'64
IN ACCESS_MASK DesiredAccess OPTIONAL, R'/ wOE2
IN POBJECT_TYPE ObjectType OPTIONAL, ;`B35K
IN KPROCESSOR_MODE AccessMode, "BRE0Ir:
OUT PHANDLE Handle 3c3Z"JV
); 8tMte!E
gxM 8IQ
NTKERNELAPI HANDLE PsGetProcessId( PEPROCESS Process ); BT3O_X`u
NTKERNELAPI KeAddSystemServiceTable(PVOID, PVOID, PVOID, PVOID, PVOID); j!\0Fyr
NTKERNELAPI PEPROCESS IoThreadToProcess ( IN PETHREAD Thread); l`&6W?C
sV[Z|$&Z
U _'q -*W
extern PSYSTEM_SERVICE_TABLE KeServiceDescriptorTable; (N|xDl &;
PSYSTEM_SERVICE_TABLE KeServiceDescriptorTableShadow; 3SDWR@x&
extern NtBuildNumber;// 该项会被填充当前系统的BuildNumber +c`C9RXk
B:4qW[U#
KSPIN_LOCK spinLock; i%PHYSJ.
-_DiD^UcXn
Q 02??W
-#;VFSz,9*
KH>sCEt
NTUSERQUERYWINDOW NtUserQueryWindow=NULL,Old_NtUserQueryWindow=NULL; ({ kGK0
NTUSERFINDWINDOWEX NtUserFindWindowEx=NULL,Old_NtUserFindWindowEx=NULL; _8pkejg
NTUSERBUILDHWNDLIST NtUserBuildHwndList=NULL,Old_NtUserBuildHwndList=NULL; X/,1]
NTUSERWINDOWFROMPOINT NtUserWindowFromPoint=NULL,Old_NtUserWindowFromPoint=NULL; "rDzrz
O\F^@;] F6
NTDUPLICATEOBJECT NtDuplicateObject=NULL,Old_NtDuplicateObject=NULL; FJ,\?ooGf
OBOPENOBJECTBYPOINTER ObOpenObjectByPointer=NULL,Old_ObOpenObjectByPointer=NULL; 9hLmrYNM1
^=Tu>{uD
&Yk s,2:P
//判断当前系统自行编号 //下面是XP 的调用号 |XA aKZA
ULONG NtUserQueryWindow_Index=483; ]#-/i2-K
ULONG NtUserFindWindowEx_Index=378; <_{4-Q>S3#
ULONG NtUserBuildHwndList_Index=312; 2\CkX
ULONG NtUserWindowFromPoint_Index=592; q,,>:]f#
(zro7gKked
ULONG NtDuplicateObject_Index=68; `_g?y)
0m YZ7S5g
~)m t&
73s3-DS ,
//主要保护对象 1进程 和1线程 Zj+}T
PEPROCESS ProtectedProcess=NULL; $L&9x3+?Kg
PETHREAD ProtectedThread=NULL; ?ZuD _L-i
lfpt:5a9&
G_,t\
" ,aT<lw.
\l=KWa3Q
//下面函数实现都很简单 较为依赖NtUserQueryWindow 函数 关联窗口和进程ID 2 ) /k`Na
Xx y Bg!R
NTSTATUS fake_NtUserFindWindowEx( )*TW\v`B
IN HWND hwndParent, n2y/zP>TC
IN HWND hwndChild, vA "`0
IN PUNICODE_STRING pstrClassName OPTIONAL, L %o65
IN PUNICODE_STRING pstrWindowName OPTIONAL, Vr/` \441
IN DWORD dwType) z"s%# /#
\\2k}TsB
{ Kixr6 \
ULONG hWnd; ,yM}]pwlB
hWnd = Old_NtUserFindWindowEx(hwndParent, hwndChild, pstrClassName, pstrWindowName, dwType);//执行原函数 94p:|5@
[`hE^chd
DbgPrint("当前被调用程序的进程ID: %d\n",PsGetCurrentProcessId()); /+x#V!zM
if (PsGetCurrentProcess()!= ProtectedProcess)//操作进程不是自身则 i!1ho T$
{ {XDY:`vZ}
ULONG ProcessID = Old_NtUserQueryWindow(hWnd, 0);//查询返回窗口的进程ID _X,[]+ziu%
jIx8k8
if (ProcessID == (ULONG)PsGetProcessId(ProtectedProcess))//是保护进程 则返回0 I+Ncmg )>
{ qLQ <1>u
return FALSE; V9fGVDl ;
} Ge^zX$.'
} z. 2r@Psk
return hWnd; kCaO\#ta
} T~i%j@Q.6
e2] 4a3
mF[o*N*
S=0"f}Jo.
NTSTATUS fake_NtUserBuildHwndList( eu# ,WwlG
IN HDESK hdesk, G(U9rJ9
IN HWND hwndNext, G'ij?^?
IN ULONG fEnumChildren, =N YgGEFq.
IN DWORD idThread, f~w>v
IN UINT cHwndMax, FJP< bREQ
OUT HWND *phwndFirst, `I5O4|K)
OUT ULONG* pcHwndNeeded) ?Bo?JMV
{ >[ eW">:>K
NTSTATUS ntStatus; Zy^=fM
ULONG i=0; *)u? ~r(F
DbgPrint("当前被调用程序的进程ID: %d\n",PsGetCurrentProcessId()); QE|`&~sme
if (PsGetCurrentProcess()!= ProtectedProcess) Q"40#RFA
{ $@_{p*q
if (fEnumChildren==1)//是否是枚举子窗口 ;HDZ+B
{ //如果是枚举本程序子窗体 返回失败 \[yr=X
if (Old_NtUserQueryWindow((ULONG)hwndNext, 0) == (ULONG)PsGetProcessId(ProtectedProcess)) m`z7fi7u
{ zD D4m` 2
return STATUS_UNSUCCESSFUL; ?v:Z U~i
} CEuWw:)
} +Mk#9 r
//枚举顶层窗口 OO n X`
ntStatus = Old_NtUserBuildHwndList(hdesk, hwndNext, fEnumChildren, idThread, cHwndMax, phwndFirst, pcHwndNeeded); wd[eJcQ,
if (NT_SUCCESS(ntStatus)) wJe?t$ac?
{ B:< ]Hl$
while (i<*pcHwndNeeded)//循环查询是否为本程序窗体 从数组中擦掉 rEdY>\'
{ rAb&I"\ZY
lT'9u,6
if (Old_NtUserQueryWindow((ULONG)phwndFirst
,0) == (ULONG)PsGetProcessId(ProtectedProcess)) ]N^*tO
{ //直接置0就好了 前面代码有问题 KVkMU?6
phwndFirst=0; =b LY /
} G,XPT,:%
i++; . $!{-v[
} ['q&@_d7
} P:C2G(V1AR
return ntStatus; x[Im%k
} -r<#rITH"
return Old_NtUserBuildHwndList(hdesk, hwndNext, fEnumChildren, idThread, cHwndMax, phwndFirst, pcHwndNeeded); jZpa0grA
} ~Rpm-^
=JS;;PzX[
UINT_PTR __stdcall fake_NtUserQueryWindow(IN ULONG WindowHandle,IN ULONG TypeInformation) +Qxu$#
{DbgPrint("当前被调用程序的进程ID: %d\n",PsGetCurrentProcessId()); LD>\#q8a*
if( PsGetCurrentProcess() != ProtectedProcess ) @U{<a#
{ A"v{~
if (Old_NtUserQueryWindow(WindowHandle, TypeInformation) == (ULONG)PsGetProcessId(ProtectedProcess)) ; CHi\+` 5
{//试图关联保护的PID 返回0 ^|!I +
return FALSE; hm*cw[#O1x
} q Zv =
} nmU_N:Y
return Old_NtUserQueryWindow(WindowHandle, TypeInformation); <A5 ]]{9 +
} ^Xb7[ +I6
DQ#H,\ ^<
G!N{NCq
ULONG fake_NtUserWindowFromPoint(LONG x, LONG y) 7dG 79H
{ X? :o;wB
ULONG hWnd; CT9
hWnd=Old_NtUserWindowFromPoint(x,y); ._w 8J"E5
DbgPrint("当前被调用程序的进程ID: %d\n",PsGetCurrentProcessId()); 2aw&YZ&X o
if (PsGetCurrentProcess() != ProtectedProcess) {GDmVWG0q
{ <ljI;xE
if (Old_NtUserQueryWindow(hWnd, 0) == (ULONG)PsGetProcessId(ProtectedProcess)) \Ng\B.IQ
{ ; 8WZx
return FALSE; D4eTTfQ
} )#|<w9uec
} CQ`=V2:"ON
return hWnd; =S'%`]f?
} 6u`F d#
E$ 9 Ys
o1&:ry
l`kWz5[~
/bj <Ft\
//思路很简单 执行原函数后 直接判断输出句柄 如果是我们的 直接close掉 然后返回失败 h )~=Dm
//还好NtDuplicateObject 系统调用不是很频繁 如果是调用频繁的系统函数 不建议这样乱来.^_^ EbeI{ -'aF
NTSTATUS fake_NtDuplicateObject( `V)Z )uN{0
IN HANDLE SourceProcessHandle, Q L6C,#6
IN HANDLE SourceHandle, UA R5^
IN HANDLE TargetProcessHandle, S'oGt &Z<
OUT PHANDLE TargetHandle OPTIONAL, r{L4]|(utY
IN ACCESS_MASK DesiredAccess, I`z@2Z+pJ
IN ULONG Attributes, %|G"-%_E
IN ULONG Options) \om%Q[F7a
{ Sq:0w
NTSTATUS ntStatus,Tmp; }j ,[ 1@S
//PVOID pObj=NULL; 3\T2?w9u(
PROCESS_BASIC_INFORMATION PBI; s=?g\oR
ntStatus=Old_NtDuplicateObject(SourceProcessHandle,SourceHandle,TargetProcessHandle, 9&RFO$WH
TargetHandle,DesiredAccess,Attributes,Options); p4p@^@<>X
yV) la@c
!mXxAo
if (NT_SUCCESS(ntStatus) ) KR7@[
{ //在当前进程上下文 直接查询输出句柄所属ID 是我们的直接CLOSE掉 pRSOYTebP
//这里 用内核提供的查询句柄函数似乎更精确 可以直接获取对象 然后对比是否是我们的进线程对象. _)]CzBRq\6
Tmp=ZwQueryInformationProcess(*TargetHandle,ProcessBasicInformation,&PBI,sizeof(PBI),NULL); Zw wqSyuGf
//Tmp=ObReferenceObjectByHandle(*TargetHandle, 0, NULL, KernelMode, &pObj, NULL ); m|OO,gR
ah~Y eJp
if (NT_SUCCESS(Tmp)) C* nB
{ /* //需要自己替换 可防止COPY 进线程句柄 I@\OaUGr+
if (pObj==(PVOID)ProtectedProcess|pObj==(PVOID)ProtectedThread) Y2'cs~~$Ce
{ ,]b~t0|B
ZwClose(*TargetHandle); %c[V
*TargetHandle=0; vOg#Dqn-
ntStatus= STATUS_UNSUCCESSFUL; n("0%@ov
}*/ fU!<HD h
0@AAulRl
fxT-j s#S
if (PBI.UniqueProcessId ==(ULONG)PsGetProcessId(ProtectedProcess)) .H,xle
{ E\C9|1)
ZwClose(*TargetHandle); 6S~sVUL9`
*TargetHandle=0; |2KAo! PI
ntStatus= STATUS_UNSUCCESSFUL; 'MY/*k7 :
} >a }f{\Q
&d|r~Nh P
} yBI'djL~>
} "Y \_ TtY
return ntStatus; YQY%M>F@d%
} 0tU. (
M|R b&6O
5L!y-3
NTSTATUS fake_ObOpenObjectByPointer( y:6; LZ9[
IN PVOID Object, y99mC$"Ee`
IN ULONG HandleAttributes, #_u~/jhX
IN PACCESS_STATE PassedAccessState OPTIONAL, >FkWH7
IN ACCESS_MASK DesiredAccess OPTIONAL, YD7Oao4:o
IN POBJECT_TYPE ObjectType OPTIONAL, }+sT4'Ah>
IN KPROCESSOR_MODE AccessMode, [W7CXZDd
OUT PHANDLE Handle) &c,kQo+pA
,KFap z!
{yExQbN
{ >m$ 1+30X
8#g1 P4
if ((Object != NULL) && (MmIsAddressValid(Object))) ;-qO 'V:;
{ >o=-$g z`
if ((ProtectedThread !=PsGetCurrentThread())) //当前操作者不是本程序自身的线程 _BP&n
{ 6g)G Y"49
if (Object == IoThreadToProcess(ProtectedThread)|| Object==ProtectedThread) 9'X7w G
{//目标是否为我们保护的对象 ?o |f':
return STATUS_ACCESS_DENIED;// 是则拒绝访问 gK'1ZLdZ2
} z+n,uHs
} P&^;656r
~ r4 38&
} CmoE _8U>
return Old_ObOpenObjectByPointer (Object, HandleAttributes,PassedAccessState, Su/6Q$0 t
DesiredAccess,ObjectType,AccessMode,Handle); -^hWM}F
Lo N< oj5
} eEv@}1~
^<a t'jk6
//该函数是网上COPY来的 做法很标准 什么时候自己写的也有这么标准就好了 ^_^ Ss ou
ULONG GetShadowTableAddress() a C \MJ 9
{ E^/t$M| H
ULONG dwordatbyte,i; SVh 7zh
PUCHAR p = (PUCHAR) KeAddSystemServiceTable; PIoLywpRn
for(i = 0; i < PAGE_SIZE; i++, p++)// 往下找一页 指针递增1 CF Mo)"
{ jZ~n[ f+Q
__try iXVe.n
{ IYS)7`{]
dwordatbyte = *(PULONG)p; v4`"1Ss,K
} F@'Jbd`
__except(EXCEPTION_EXECUTE_HANDLER) 7XTkX"zKj
{ "$+Jnc!!
return FALSE; fzb29 -
} 5 ZGNz1)?V
if(MmIsAddressValid((PVOID)dwordatbyte)) ODNM+#} `
{ vNV/eB8#S
if(memcmp((PVOID)dwordatbyte, KeServiceDescriptorTable, 16) == 0)//对比前16字节 相同则找到 c'>/
{ B%)%
if((PVOID)dwordatbyte == KeServiceDescriptorTable)//排除自己 &C, 'x4c"
{ GP!?^r:en
continue; QdH\LL^8R4
} s C% &cRQD
return dwordatbyte; 2&:f&"
} *}F3M\
} \r;# g{ _
} & gVN&
return FALSE; BZ94NOOdw
} 8;b( 0^
1n >X[! 8x
ULONG GetSSDTCurAddr(IN ULONG Index,BOOL IsShadow) hm84Aq= f
{ .*@;@0 6?
ULONG ServiceCount,BaseAddr; "cE7 5
SN9kFFIPb=
if (KeServiceDescriptorTableShadow!=NULL) /7a BDc-v
{ nHnK)9\N
ServiceCount=KeServiceDescriptorTableShadow[IsShadow?1:0].NumberOfServices; Ye"o6_U "
BaseAddr = (ULONG)KeServiceDescriptorTableShadow[IsShadow?1:0].ServiceTableBase; bZnuNYty75
Buf/@B7+\
if (Index>=ServiceCount) return FALSE; opY@ RJ]
fV &KM*W*@
return *(PULONG)(BaseAddr+Index * 4); MuYk};f
} $h2){*5 E{
return FALSE; 6%'.A]"
} j|4<i9^}
C\S3Gs
6TQoqH8@U
三、Xacker.h Lrta/SU*
H2&@shOOQJ
DNOueU
#include <NTDDK.H> I~q#eO)
#include <windef.h> _a5 d?Q9Z
s:OFVlC %\
#include "LDasm.h" dq7x3v^"ZG
]Uw<$!$-]s
#include "SSDTSHADOW.h" &%8'8,.
L; T8?+x
#define NT_DEVICE_NAME L"\\Device\\Hook" !;EjB*&
#define DOS_DEVICE_NAME L"\\DosDevices\\Hook" Ipf|")*
:}yi -/_8!
#define IOCTL_Hook CTL_CODE(FILE_DEVICE_UNKNOWN, 0x1, METHOD_BUFFERED, FILE_ANY_ACCESS) w mk *h-
#define IOCTL_UnHook CTL_CODE(FILE_DEVICE_UNKNOWN, 0x2, METHOD_BUFFERED, FILE_ANY_ACCESS) q`|LRz&al
3t`P@nL0;
void MemOpen() 2Gz}T _e
{ dI*pDDq#
__asm { h "Xg;(K
cli AcS|c:3MUy
mov eax,cr0 UQ8M~x5$3%
and eax,not 10000h +)k b(
mov cr0,eax 7x#Ckep:I
} wDcj,:h`
} 7 ]^M>#
i7 ] 4W
void MemClose() (]b! {kS
{ Q&MZN);.
__asm { pV.Av
mov eax,cr0 KQacoUHrK?
or eax,10000h +cIUGF p}
mov cr0,eax D|@/yDQ
sti ZPiq-q
} a D=a,
} 3m YiQ2
*_R]*o!W'
bSsh^Z
// 不做任何异常处理 需要自行处理环境偏移 <.pU ,T/
void Hook (PVOID Func,PVOID New_Func,PVOID Proxy_Func) hy}8Aji &
{ >2~+.WePu
ULONG PatchSize; Of{/t1o?
cs T2B[f9D
BYTE g_HookCode[5] = { 0xE9, 0, 0, 0, 0 };//相对跳转 ~\=1'D^6CK
BYTE Jmp_Orig_Code[7] = { 0xEA, 0, 0, 0, 0, 0x08, 0x00 }; //绝对地址跳转 QA 2borfy
&C_' p{G
PatchSize=GetPatchSize(Func,5);//获得要Patch的字节数 4 !+pc-}-
Vl_:c75"
//构造Proxy_Func YhOlx ON
memcpy( (PBYTE)Proxy_Func,(PBYTE)Func,PatchSize);//实现原函数头 { .Z}5K
*( (PULONG)(Jmp_Orig_Code + 1) ) = (ULONG) ( (PBYTE)Func + PatchSize );//原函数+N 地址 PH?#)l D
memcpy( (PBYTE)Proxy_Func+ PatchSize, Jmp_Orig_Code, 7);//绝对地址跳转 \"CZI<=TB
2WtRJi?b|
MS0Fl|YA
*( (ULONG*)(g_HookCode + 1) ) = (ULONG)New_Func - (ULONG)Func - 5;//计算JMP 地址 y]J89
)K,F]fc+O
1AG=%F|.
MemOpen(); D[_|*9BC
memcpy(Func, g_HookCode, 5); QmLF[\Oo_
MemClose(); ]%BWIqbr
} $aN-Y?U%
qduWzxB
void UnHook (PVOID Func,PVOID Proxy_Func) P( XaTU&-
{ D\[h: 8k
|1ST=O7.LH
MemOpen(); >. '<J]
memcpy(Func,Proxy_Func,5); ^s@8VAwi
MemClose(); br0++}vwL
} %I-+Ead0i
X= Ys<TM,
W-.pmU e2
em\ 9'L ^
//方便起见 不做任何判断 需要的自己加强 :^Fh!br==
!'j?.F $}
//不喜欢硬编码 自行解决SSDTSHADOW 表的其他系统服务号硬编码 ^Ve<>b
//其实在SSDTSHADOW中HOOK 一个函数即可达到保护窗体的目的 Q}!m x7b0]
//ICY 的PSNULL3里好 像就是这样的 因为窗体名称是随机的 所以 只要防止窗体与进程关联 就可以达到保护窗体的效果了 j:,NE(DF
mk3_
VOID StartHook () O Ki \ zS
{ k51Eyy50(
UNICODE_STRING uniFuncName; F e.t/amS/
RtlInitUnicodeString(&uniFuncName,L"ObOpenObjectByPointer"); iSFuT7; %
ObOpenObjectByPointer = MmGetSystemRoutineAddress(&uniFuncName); M @3"<[g
} g3+{\x8
6<'r G''
//当前SSDTSHADOW 函数指针 需要的自己加 P7 PB t
NtUserQueryWindow=(PVOID)GetSSDTCurAddr(NtUserQueryWindow_Index,TRUE); Mwf Oy@|N
NtUserFindWindowEx=(PVOID)GetSSDTCurAddr(NtUserFindWindowEx_Index,TRUE); K9vIm4::d$
NtUserBuildHwndList=(PVOID)GetSSDTCurAddr(NtUserBuildHwndList_Index,TRUE); <BO )E(
NtUserWindowFromPoint=(PVOID)GetSSDTCurAddr(NtUserWindowFromPoint_Index,TRUE); 5OO'v07b
U~W?s(Cy%
NtDuplicateObject=(PVOID)GetSSDTCurAddr(NtDuplicateObject_Index,FALSE); Y =`
A/ 7X9ir
l c_E!"1
x+]!m/
LTJc,3\,
//代理函数指针 6l$L~>
Old_ObOpenObjectByPointer=ExAllocatePool(NonPagedPool, 20); 6{ ,HiY
1 5$4&=O
Old_NtUserQueryWindow=ExAllocatePool(NonPagedPool, 20); _/S?#
Old_NtUserFindWindowEx=ExAllocatePool(NonPagedPool, 20); Y%|@R3[Nk
Old_NtUserBuildHwndList=ExAllocatePool(NonPagedPool, 20); }tPk@$
Old_NtUserWindowFromPoint=ExAllocatePool(NonPagedPool, 20); &TG5rUUg
Old_NtDuplicateObject=ExAllocatePool(NonPagedPool, 20); =`Y.=RL+'n
w[_x(Ojq;
0F#>Cm D
5 efxEt>U
H0a /(4/xg
memset(Old_ObOpenObjectByPointer,0x90,20); 4yaxl\2
memset(Old_NtUserQueryWindow,0x90,20);//NOP一下 #Fu>|2F|
memset(Old_NtUserFindWindowEx,0x90,20); fag^7rz
memset(Old_NtUserBuildHwndList,0x90,20); nK3 k]gLc{
memset(Old_NtUserWindowFromPoint,0x90,20); ~#}Dx :HH
memset(Old_NtDuplicateObject,0x90,20); aFY_:.o2k`
/,5Z-Z*wq
kW6%32
//HOOK k llQca|$4
Hook(ObOpenObjectByPointer,fake_ObOpenObjectByPointer,Old_ObOpenObjectByPointer); nzX@:7g
Hook(NtUserQueryWindow,fake_NtUserQueryWindow,Old_NtUserQueryWindow); ZX b}91rzt
Hook(NtUserFindWindowEx,fake_NtUserFindWindowEx,Old_NtUserFindWindowEx); /T0nLp`gi
Hook(NtUserBuildHwndList,fake_NtUserBuildHwndList,Old_NtUserBuildHwndList); y?30_#[dN
Hook(NtUserWindowFromPoint,fake_NtUserWindowFromPoint,Old_NtUserWindowFromPoint); %u p}p/?
Hook(NtDuplicateObject,fake_NtDuplicateObject,Old_NtDuplicateObject); 6S?x D5 (
} TTI81:fku
vxN0,l
!- ~ X?s~L
a0Oe:]mo\
VOID StopHook() 4ax|Vb)D
{ }dSFAKI2dM
UnHook(ObOpenObjectByPointer,Old_ObOpenObjectByPointer); i 6no;}j
UnHook(NtUserQueryWindow,Old_NtUserQueryWindow); ~krS#\
UnHook(NtUserFindWindowEx,Old_NtUserFindWindowEx); c ^I0y!
UnHook(NtUserBuildHwndList,Old_NtUserBuildHwndList); BQgoVnQo_c
UnHook(NtUserWindowFromPoint,Old_NtUserWindowFromPoint); u@ N~1@RT|
UnHook(NtDuplicateObject,Old_NtDuplicateObject); 6`nR5fh
W= -|`
ahIE;Y\j'
ExFreePool(Old_ObOpenObjectByPointer); -6EK#!+
ExFreePool(Old_NtUserQueryWindow); LPE )
ExFreePool(Old_NtUserFindWindowEx); Y_H/3?b%
ExFreePool(Old_NtUserBuildHwndList); ;El <%{(
ExFreePool(Old_NtUserWindowFromPoint); 3o8\/-*<
ExFreePool(Old_NtDuplicateObject); VWvoQf^+
W,NL*($^
} n9}R W;N+u
M<oA<#IW
Di.;<v#FL
四、Xacker.c ,/o(|sks
YN#XmX %
1_3?R }$Wl
,ep9V ,+|
//本代码 只在XP SP2下测试通过 其他系统 除去SSDTSHADOW 编号问题 应该都可以正常运行 T|+$@o
//需要的自行测试 代码需要放在系统SYSTEM32目录下 5b fb!7-[i
lPS*-p#IZ
#WEq-0L
"^"'uO$
#include <NTDDK.H> ,9vJtP+T+!
u\5g3BH
#include "Xacker.h" |Mlh;
@YB85p"]J.
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath); T/Q==Q{W:
NTSTATUS DispatchCreateClose(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp); w`Xg%*]}
NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp); ^Fvr f`A'
VOID UnloadDriver(IN PDRIVER_OBJECT DriverObject ); z5ZKks
I4ct xMVP
PvuAg(?
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryPath) ;"SZ}
{ ? q6Z's[
6d};|#}
UNICODE_STRING uniDeviceName; Nkoo fhZ
UNICODE_STRING uniSymLink; c-`37. J
NTSTATUS ntStatus; ' DeW<Sa~
PDEVICE_OBJECT deviceObject = NULL; HoV{Uzm
DbgPrint("当前被调用程序的进程ID: %d\n",PsGetCurrentProcessId()); 3 Mxz_~
DbgPrint("Hello I am Loading.....\n"); b.@ H1L
RtlInitUnicodeString(&uniDeviceName, NT_DEVICE_NAME); v10mDr
RtlInitUnicodeString(&uniSymLink, DOS_DEVICE_NAME); 1O23"o5=
G~`' E&/
DriverObject->MajorFunction[IRP_MJ_CREATE] = TG4^_nRl
DriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchCreateClose; 4p?+LdL
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl; T^d#hl.U
DriverObject->DriverUnload = UnloadDriver; gj[z ka0_
gO9'q='5l
ntStatus = IoCreateDevice(DriverObject, 0,&uniDeviceName,FILE_DEVICE_UNKNOWN, loR,XW7z
FILE_DEVICE_SECURE_OPEN, FALSE,&deviceObject); L,E-z_<p
?rAi =w&c
if (!NT_SUCCESS(ntStatus)) return ntStatus; @ ;g` +:=
l&\t f`~
ntStatus = IoCreateSymbolicLink(&uniSymLink, &uniDeviceName); ~ w a %fM
G~JC gi
if (!NT_SUCCESS(ntStatus)) mgk64}K[n
{ qw9e) `3$
IoDeleteDevice(deviceObject); _e;N'DZ
return ntStatus; A$%@fO.b
} Fsnw3/Nr
(PRaiE
KeInitializeSpinLock(&spinLock); jK& Nkp
9m%7dsv
KeServiceDescriptorTableShadow=(PSYSTEM_SERVICE_TABLE)GetShadowTableAddress(); emGV]A%nss
if (!KeServiceDescriptorTableShadow) 6lB{Ao?|
{ <1ztj #B
return STATUS_UNSUCCESSFUL; @C!JtgO%
} P58\+9d_
DbgPrint("%d",NtBuildNumber); QT7w:: ht
//DbgPrint("driver loaded!\n"); .F{}~ K]
return STATUS_SUCCESS; >=.ch5h3J)
} 9+WY@du+
$bF`PGR_
NTSTATUS DispatchCreateClose(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp) bAA'=z <
{ f~n' Ki+'
pIrp->IoStatus.Information = 0; e#7 6h;
pIrp->IoStatus.Status = STATUS_SUCCESS; ;ph +ZV
IoCompleteRequest(pIrp, IO_NO_INCREMENT); z9 OMC$,V
return STATUS_SUCCESS; xc3Ov9`8%
} )[^:]}%r
Q@3 ld6y
NTSTATUS DispatchIoctl(IN PDEVICE_OBJECT pDevObj,IN PIRP pIrp) Z(Ls#hp
{ 9I^H)~S
{kY`X[fvZ
NTSTATUS ntStatus = STATUS_INVALID_DEVICE_REQUEST;//STATUS_UNSUCCESSFUL;// Z;dw n~Tw
PIO_STACK_LOCATION pIrpStack = IoGetCurrentIrpStackLocation(pIrp); T8M[e SbZ
ULONG uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode; Ri%Of:zZ
ULONG inBufLength = pIrpStack->Parameters.DeviceIoControl.InputBufferLength; k^vmRe<lk
ULONG outBufLength =pIrpStack->Parameters.DeviceIoControl.OutputBufferLength; m8j#{[NE
y+~Aw"J}
PVOID OutputBuffer = pIrp->UserBuffer; s3f G X|;
PVOID InputBuffer = pIrp->AssociatedIrp.SystemBuffer; ;*85'WcS
G@l|u
switch(uIoControlCode) H603L|4
{ s#8{: ko
case IOCTL_Hook: {3 yws 4
{ //不要输入任何信息 直接取IO线程的信息 gs2&0rnOy\
if (!ProtectedProcess&&!ProtectedThread) f<x t3
{ D\i8rqU/l
ProtectedProcess=PsGetCurrentProcess(); ZB h@%A
ProtectedThread=PsGetCurrentThread(); i\c^h;wX
StartHook(); v+, w{~7RH
ntStatus=STATUS_SUCCESS; 1,sO =p)Yg
} cVt$#A)
break; [O =)FiY-
} L``mF(R^
case IOCTL_UnHook: O"w_ sw
{ 7B>cmi
if (ProtectedProcess&&ProtectedThread) {s^n|b}
{ D_`)T;<Sp
StopHook(); +vY`?k`
ProtectedProcess=NULL; N=}Z #
ProtectedThread=NULL; G7#~=W 2M
ntStatus=STATUS_SUCCESS; _ -FQ78C
} ( 3HgI
break; K>E!W!-PJ
} st^N QL
} .ceU @^
gG| 1$
pIrp->IoStatus.Status = ntStatus; Y V+d Uvz
//pIrp->IoStatus.Information = outBufLength; l3 Bc g
IoCompleteRequest(pIrp, IO_NO_INCREMENT); C)dYAq3,8
return ntStatus; `SpS?mWA
} bGLp0\0[
6>^k9cJp
ed2 &9E>9b
//卸载驱动前 一定要先通过IO线程把钩子卸载了 否则必蓝. _A~gqOe
VOID UnloadDriver( IN PDRIVER_OBJECT DriverObject ) gDBQ\vM8
{ tXuxTVhoT
PDEVICE_OBJECT deviceObject = DriverObject->DeviceObject; zIm!8a
UNICODE_STRING uniSymLink; X+ BSneu
nWsz0v3'9
RtlInitUnicodeString(&uniSymLink, DOS_DEVICE_NAME); {it eC
Kt0Tuj@CY
WHT%m|yn
//DbgPrint("driver unloaded.\n"); !Z)^c&
IoDeleteSymbolicLink(&uniSymLink); w#b2iE+Bw
IoDeleteDevice(deviceObject); 8hA=$}y&x
} m @ ?e <$
用户系统信息：Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.33 Safari/534.3 SE 2.X MetaSr 1.0
