简单驱动编写与windbg调试(3)

NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp)
{
NTSTATUS ntStatus;
PIO_STACK_LOCATION IrpStack;
ULONG IoControlCode;
ULONG inSize;
ULONG outSize;
ULONG *buff;
IrpStack=IoGetCurrentIrpStackLocation(Irp);
IoControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;
switch(IoControlCode)
{
case IOCTL_PROTECT_CONTROL:
inSize = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
outSize = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;
buff = (ULONG*)Irp->AssociatedIrp.SystemBuffer ;
pid=*buff;  //获得要影藏进程的ID
strcpy(Irp->UserBuffer,"Driver Start");
break;
default:
break;
}
ntStatus=Irp->IoStatus.Status;
IoCompleteRequest(Irp,IO_NO_INCREMENT);
return ntStatus;
}

NTSTATUS NewZwOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL
)
{
NTSTATUS ntStatus;
if(pid==(ULONG)ClientId->UniqueProcess)
{
DbgPrint("保护进程 PID :%d \n",pid);
return STATUS_ACCESS_DENIED;
}
ntStatus=OldZwOpenProcess(
 ProcessHandle,
 DesiredAccess,
 ObjectAttributes,
 ClientId 
);
return STATUS_SUCCESS;
}

#pragma pack(1)
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;
#pragma pack()

extern ServiceDescriptorTableEntry KeServiceDescriptorTable; 
#define SYSTEMSERVICE(_function)KeServiceDescriptorTable.ServiceTableBase
[*(PUCHAR)((PUCHAR)_function+1)]

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL
);
typedef NTSTATUS (*ZWOPENPROCESS)(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL
);
ZWOPENPROCESS OldZwOpenProcess;
/////////////////////////////////////////////////////////////////////

NTSTATUS NewZwOpenProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID ClientId OPTIONAL
);
在DriverEntry中对CR0进行修改然后修改 SSDT表。
_asm
    {
        CLI                  
        MOV    EAX, CR0       
        AND EAX, NOT 10000H 
        MOV    CR0, EAX       
    }

OldZwOpenProcess = (ZWOPENPROCESS)(SYSTEMSERVICE(ZwOpenProcess)) ;

(ZWOPENPROCESS)(SYSTEMSERVICE(ZwOpenProcess)) = NewZwOpenProcess;
_asm
{

MOV    EAX, CR0        
OR    EAX, 10000H          
MOV    CR0, EAX            
STI                   
}