├── tinyKernelHook ├── x64 │ ├── Debug │ │ └── tinyKernelHook.tlog │ │ │ ├── unsuccessfulbuild │ │ │ └── tinyKernelHook.lastbuildstate │ └── Release │ │ ├── hook.obj │ │ ├── hooks.obj │ │ ├── test.obj │ │ ├── vc143.pdb │ │ ├── trapHook.obj │ │ ├── trapAsmTools.obj │ │ ├── tinyKernelHook.tlog │ │ └── tinyKernelHook.lastbuildstate │ │ └── tinyKernelHook.sys.recipe ├── hook.c ├── hook.h ├── hooks.asm ├── test.c ├── trapHook.c ├── trapHook.h ├── trapAsmTools.asm ├── tinyKernelHook.vcxproj.user ├── tinyKernelHook.vcxproj.filters └── tinyKernelHook.vcxproj ├── .gitignore ├── x64 └── Release │ ├── tinyKernelHook.pdb │ ├── tinyKernelHook.sys │ └── tinyKernelHook │ └── tinyKernelHook.sys ├── img_passwd ├── 详细 │ ├── image-20250517102910851.png │ ├── image-20250517104125803.png │ ├── image-20250517104318050.png │ ├── image-20250517105151002.png │ ├── image-20250517105827160.png │ ├── image-20250517110301589.png │ ├── image-20250517193703095.png │ ├── image-20250517200220096.png │ ├── image-20250517200319619.png │ ├── image-20250517201549321.png │ ├── image-20250517201614445.png │ ├── image-20250517210209008.png │ └── image-20250517210352702.png └── README │ ├── image-20250516112150234.png │ ├── image-20250516112516224.png │ ├── image-20250516112919924.png │ └── image-20250516113323347.png ├── README.md └── tinyKernelHook.sln /tinyKernelHook/x64/Debug/tinyKernelHook.tlog/unsuccessfulbuild: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .vs/ 2 | *.log 3 | *.tlog 4 | *.inf 5 | *.cer 6 | .gitignore 7 | statistics.py -------------------------------------------------------------------------------- /tinyKernelHook/hook.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/hook.c -------------------------------------------------------------------------------- /tinyKernelHook/hook.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/hook.h -------------------------------------------------------------------------------- /tinyKernelHook/hooks.asm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/hooks.asm -------------------------------------------------------------------------------- /tinyKernelHook/test.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /tinyKernelHook/trapHook.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/trapHook.c -------------------------------------------------------------------------------- /tinyKernelHook/trapHook.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/trapHook.h -------------------------------------------------------------------------------- /tinyKernelHook/trapAsmTools.asm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/trapAsmTools.asm -------------------------------------------------------------------------------- /x64/Release/tinyKernelHook.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/x64/Release/tinyKernelHook.pdb -------------------------------------------------------------------------------- /x64/Release/tinyKernelHook.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/x64/Release/tinyKernelHook.sys -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/hook.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/hook.obj -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/hooks.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/hooks.obj -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/test.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/test.obj -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/vc143.pdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/vc143.pdb -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/trapHook.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/trapHook.obj -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517102910851.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517102910851.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517104125803.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517104125803.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517104318050.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517104318050.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517105151002.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517105151002.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517105827160.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517105827160.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517110301589.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517110301589.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517193703095.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517193703095.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517200220096.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517200220096.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517200319619.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517200319619.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517201549321.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517201549321.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517201614445.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517201614445.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517210209008.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517210209008.png -------------------------------------------------------------------------------- /img_passwd/详细/image-20250517210352702.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/详细/image-20250517210352702.png -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/trapAsmTools.obj: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/tinyKernelHook/x64/Release/trapAsmTools.obj -------------------------------------------------------------------------------- /img_passwd/README/image-20250516112150234.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/README/image-20250516112150234.png -------------------------------------------------------------------------------- /img_passwd/README/image-20250516112516224.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/README/image-20250516112516224.png -------------------------------------------------------------------------------- /img_passwd/README/image-20250516112919924.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/README/image-20250516112919924.png -------------------------------------------------------------------------------- /img_passwd/README/image-20250516113323347.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/img_passwd/README/image-20250516113323347.png -------------------------------------------------------------------------------- /x64/Release/tinyKernelHook/tinyKernelHook.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/ResetMineMind/tinyKernelHook/HEAD/x64/Release/tinyKernelHook/tinyKernelHook.sys -------------------------------------------------------------------------------- /tinyKernelHook/tinyKernelHook.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /tinyKernelHook/x64/Debug/tinyKernelHook.tlog/tinyKernelHook.lastbuildstate: -------------------------------------------------------------------------------- 1 | PlatformToolSet=WindowsKernelModeDriver10.0:VCToolArchitecture=Native64Bit:VCToolsVersion=14.43.34808:TargetPlatformVersion=10.0.22621.0: 2 | Debug|x64|D:\tools\Visual Studio\projects\tinyKernelHook\| 3 | -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/tinyKernelHook.tlog/tinyKernelHook.lastbuildstate: -------------------------------------------------------------------------------- 1 | PlatformToolSet=WindowsKernelModeDriver10.0:VCToolArchitecture=Native64Bit:VCToolsVersion=14.43.34808:TargetPlatformVersion=10.0.22621.0: 2 | Release|x64|D:\tools\Visual Studio\projects\tinyKernelHook\| 3 | -------------------------------------------------------------------------------- /tinyKernelHook/x64/Release/tinyKernelHook.sys.recipe: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | D:\tools\Visual Studio\projects\tinyKernelHook\x64\Release\tinyKernelHook.sys 6 | 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # tinyKernelHook 2 | 3 | ​ 项目介绍：https://bbs.kanxue.com/thread-286868.htm 4 | 5 | #### 1. 基本原理 6 | 7 | ​ 借用windows使用的`int 2e`异常劫持控制流。 8 | 9 | #### 2. 用法 10 | 11 | ​ Hook的目的是劫持控制流，引导其执行预定义的操作，因此需要使用者自定义Hook函数。 12 | 13 | ![image-20250516113323347](https://raw.githubusercontent.com/ResetMineMind/note-picture/main/img-all/win_authimage-20250516113323347.png) 14 | 15 | ![image-20250516112150234](https://raw.githubusercontent.com/ResetMineMind/note-picture/main/img-all/win_authimage-20250516112150234.png) 16 | 17 | ​ 上图中使用`HOOKENTRY`宏，注册自定义的Hook函数；注意，不需要在Hook函数中再次调用被Hook的函数，因为在Hook函数执行完毕后，会自动恢复原函数的执行流。 18 | 19 | ​ ![image-20250516112516224](https://raw.githubusercontent.com/ResetMineMind/note-picture/main/img-all/win_authimage-20250516112516224.png) 20 | 21 | ​ `hook.c`文件，用于存储用户自定的Hook函数，其参数是全体通用寄存器组成的栈帧。 22 | 23 | ![image-20250516112919924](https://raw.githubusercontent.com/ResetMineMind/note-picture/main/img-all/win_authimage-20250516112919924.png) 24 | 25 | ​ 最后，使用`InstallHook`，指定函数所在模块、函数地址、自定义Hook的wrapper函数地址，就可以将控制流转移到自定义Hook函数，建议使用`KeGenericCallDpc`在多核间同步Hook。 26 | 27 | #### 3. 总结 28 | 29 | ​ Hook注册流程如下： 30 | 31 | 1. 用户定义`INT64 __stdcall (*)(PREGContext pushedAqs)`类型的Hook函数。 32 | 2. 使用`HOOKENTRY`宏，在`hooks.asm`中进行记录。 33 | 3. 使用`InstallHook`函数，在`trapHook.c`文件`KeGenericCallDpc`回调例程`InitAndInstallHook`，正式注册Hook。 34 | 35 | -------------------------------------------------------------------------------- /tinyKernelHook.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.13.35931.197 d17.13 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "tinyKernelHook", "tinyKernelHook\tinyKernelHook.vcxproj", "{507C54A4-CA69-C89C-0346-1119A435F4B6}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|ARM64 = Debug|ARM64 11 | Debug|x64 = Debug|x64 12 | Release|ARM64 = Release|ARM64 13 | Release|x64 = Release|x64 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|ARM64.ActiveCfg = Debug|ARM64 17 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|ARM64.Build.0 = Debug|ARM64 18 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|ARM64.Deploy.0 = Debug|ARM64 19 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|x64.ActiveCfg = Debug|x64 20 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|x64.Build.0 = Debug|x64 21 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Debug|x64.Deploy.0 = Debug|x64 22 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|ARM64.ActiveCfg = Release|ARM64 23 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|ARM64.Build.0 = Release|ARM64 24 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|ARM64.Deploy.0 = Release|ARM64 25 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|x64.ActiveCfg = Release|x64 26 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|x64.Build.0 = Release|x64 27 | {507C54A4-CA69-C89C-0346-1119A435F4B6}.Release|x64.Deploy.0 = Release|x64 28 | EndGlobalSection 29 | GlobalSection(SolutionProperties) = preSolution 30 | HideSolutionNode = FALSE 31 | EndGlobalSection 32 | GlobalSection(ExtensibilityGlobals) = postSolution 33 | SolutionGuid = {1E86ECC9-4A30-4E22-B01E-40030163485D} 34 | EndGlobalSection 35 | EndGlobal 36 | -------------------------------------------------------------------------------- /tinyKernelHook/tinyKernelHook.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {8E41214B-6785-4CFE-B992-037D68949A14} 18 | inf;inv;inx;mof;mc; 19 | 20 | 21 | 22 | 23 | Header Files 24 | 25 | 26 | Header Files 27 | 28 | 29 | Header Files 30 | 31 | 32 | 33 | 34 | Source Files 35 | 36 | 37 | Source Files 38 | 39 | 40 | Source Files 41 | 42 | 43 | 44 | 45 | Source Files 46 | 47 | 48 | Source Files 49 | 50 | 51 | -------------------------------------------------------------------------------- /tinyKernelHook/tinyKernelHook.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | x64 7 | 8 | 9 | Release 10 | x64 11 | 12 | 13 | Debug 14 | ARM64 15 | 16 | 17 | Release 18 | ARM64 19 | 20 | 21 | 22 | {507C54A4-CA69-C89C-0346-1119A435F4B6} 23 | {1bc93793-694f-48fe-9372-81e2b05556fd} 24 | v4.5 25 | 12.0 26 | Debug 27 | x64 28 | tinyKernelHook 29 | 30 | 31 | 32 | Windows10 33 | true 34 | WindowsKernelModeDriver10.0 35 | Driver 36 | KMDF 37 | Universal 38 | 39 | 40 | Windows10 41 | false 42 | WindowsKernelModeDriver10.0 43 | Driver 44 | KMDF 45 | Universal 46 | 47 | 48 | Windows10 49 | true 50 | WindowsKernelModeDriver10.0 51 | Driver 52 | KMDF 53 | Universal 54 | 55 | 56 | Windows10 57 | false 58 | WindowsKernelModeDriver10.0 59 | Driver 60 | KMDF 61 | Universal 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | DbgengKernelDebugger 74 | 75 | 76 | DbgengKernelDebugger 77 | 78 | 79 | DbgengKernelDebugger 80 | 81 | 82 | DbgengKernelDebugger 83 | 84 | 85 | 86 | sha256 87 | 88 | 89 | false 90 | Disabled 91 | 92 | 93 | 94 | 95 | sha256 96 | 97 | 98 | false 99 | Disabled 100 | 101 | 102 | 103 | 104 | sha256 105 | 106 | 107 | 108 | 109 | sha256 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | --------------------------------------------------------------------------------