├── sources ├── HookGDI.c ├── Base.h ├── RootKit.c ├── SSDT.suo ├── RootKit.suo ├── SSDTHook.c ├── HookProcess.c ├── HookGDI.h ├── SSDT.rc ├── SSDTHook.h ├── ShadowHook.h ├── HookProcess.h ├── HookFile.h ├── RootKit.sln ├── ShadowHook.c ├── RootKit.h ├── HookFile.c └── RootKit.vcproj └── README.md /sources/HookGDI.c: -------------------------------------------------------------------------------- 1 | #include "HookGDI.h" -------------------------------------------------------------------------------- /sources/Base.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/Base.h -------------------------------------------------------------------------------- /sources/RootKit.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/RootKit.c -------------------------------------------------------------------------------- /sources/SSDT.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/SSDT.suo -------------------------------------------------------------------------------- /sources/RootKit.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/RootKit.suo -------------------------------------------------------------------------------- /sources/SSDTHook.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/SSDTHook.c -------------------------------------------------------------------------------- /sources/HookProcess.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/yawenok/SSDT-Hook/HEAD/sources/HookProcess.c -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SSDT-Hook 2 | 2011年参加信息安全比赛时候写的项目，提取出Windows内核钩子示例程序，采用Hook“SSDT表”的方式: 3 | 1. 含有完整的内核钩子框架,在此基础上可以很方便的扩展； 4 | 2. 含有文件隐藏和进程隐藏的示例。 5 | -------------------------------------------------------------------------------- /sources/HookGDI.h: -------------------------------------------------------------------------------- 1 | #ifndef __HOOKGDI_H 2 | #define __HOOKGDI_H 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | #endif // __HOOKGDI_H 14 | -------------------------------------------------------------------------------- /sources/SSDT.rc: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | #include 4 | 5 | #define VER_FILETYPE VFT_DRV 6 | #define VER_FILESUBTYPE VFT2_DRV_SYSTEM 7 | #define VER_FILEDESCRIPTION_STR "SSDT" 8 | #define VER_INTERNALNAME_STR "SSDT.sys" 9 | 10 | #include "common.ver" 11 | 12 | -------------------------------------------------------------------------------- /sources/SSDTHook.h: -------------------------------------------------------------------------------- 1 | #ifndef __SSDTHOOK_H__ 2 | #define __SSDTHOOK_H__ 3 | 4 | #include "Base.h" 5 | 6 | BOOLEAN InitSSDTHook(); 7 | 8 | NTSTATUS InstallSSDTHook(ULONG oldService, ULONG newService); 9 | 10 | NTSTATUS UnInstallSSDTHook(ULONG oldService); 11 | 12 | #endif // __SSDTHOOK_H__ 13 | -------------------------------------------------------------------------------- /sources/ShadowHook.h: -------------------------------------------------------------------------------- 1 | #ifndef __SHADOWHOOK_H__ 2 | #define __SHADOWHOOK_H__ 3 | 4 | #include "Base.h" 5 | 6 | BOOLEAN InitShadowHook(); 7 | 8 | NTSTATUS InstallShadowHook(ULONG oldService, ULONG newService); 9 | 10 | NTSTATUS UnInstallShadowHook(ULONG oldService); 11 | 12 | #endif // __SHADOWHOOK_H__ 13 | -------------------------------------------------------------------------------- /sources/HookProcess.h: -------------------------------------------------------------------------------- 1 | #ifndef __HOOKPROCESS_H 2 | #define __HOOKPROCESS_H 3 | 4 | #include "SSDTHook.h" 5 | 6 | NTSTATUS HookNtTerminateProcess( 7 | IN HANDLE ProcessHandle, 8 | IN NTSTATUS ExitStatus 9 | ); 10 | 11 | NTSTATUS OpenProcess( 12 | IN ULONG uPID, 13 | OUT PHANDLE pHandle, 14 | IN ACCESS_MASK DesiredAccess); 15 | 16 | ULONG TerminateProcess(HANDLE hProcess); 17 | 18 | ULONG KillProcess(ULONG uPID); 19 | 20 | #endif // __HOOKPROCESS_H 21 | -------------------------------------------------------------------------------- /sources/HookFile.h: -------------------------------------------------------------------------------- 1 | #ifndef __HOOKFILE_H 2 | #define __HOOKFILE_H 3 | 4 | #include "SSDTHook.h" 5 | 6 | NTSTATUS 7 | HookNtDeleteFile( 8 | IN POBJECT_ATTRIBUTES ObjectAttributes 9 | ); 10 | 11 | NTSTATUS 12 | HookNtReadFile( 13 | IN HANDLE FileHandle, 14 | IN HANDLE Event OPTIONAL, 15 | IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 16 | IN PVOID ApcContext OPTIONAL, 17 | OUT PIO_STATUS_BLOCK IoStatusBlock, 18 | OUT PVOID Buffer, 19 | IN ULONG Length, 20 | IN PLARGE_INTEGER ByteOffset OPTIONAL, 21 | IN PULONG Key OPTIONAL 22 | ); 23 | 24 | NTSTATUS 25 | HookNtSetInformationFile( 26 | IN HANDLE FileHandle, 27 | OUT PIO_STATUS_BLOCK IoStatusBlock, 28 | IN PVOID FileInformation, 29 | IN ULONG Length, 30 | IN FILE_INFORMATION_CLASS FileInformationClass 31 | ); 32 | 33 | 34 | #endif // __HOOKFILE_H 35 | -------------------------------------------------------------------------------- /sources/RootKit.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 9.00 3 | # Visual Studio 2005 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RootKit", "RootKit.vcproj", "{A8E192AF-03B3-4CC5-A1EB-A9A32612949C}" 5 | EndProject 6 | Global 7 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 8 | Debug|Win32 = Debug|Win32 9 | Release|Win32 = Release|Win32 10 | EndGlobalSection 11 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 12 | {A8E192AF-03B3-4CC5-A1EB-A9A32612949C}.Debug|Win32.ActiveCfg = Debug|Win32 13 | {A8E192AF-03B3-4CC5-A1EB-A9A32612949C}.Debug|Win32.Build.0 = Debug|Win32 14 | {A8E192AF-03B3-4CC5-A1EB-A9A32612949C}.Release|Win32.ActiveCfg = Release|Win32 15 | {A8E192AF-03B3-4CC5-A1EB-A9A32612949C}.Release|Win32.Build.0 = Release|Win32 16 | EndGlobalSection 17 | GlobalSection(SolutionProperties) = preSolution 18 | HideSolutionNode = FALSE 19 | EndGlobalSection 20 | EndGlobal 21 | -------------------------------------------------------------------------------- /sources/ShadowHook.c: -------------------------------------------------------------------------------- 1 | #include "ShadowHook.h" 2 | 3 | BOOLEAN __declspec(dllimport) _stdcall KeAddSystemServiceTable(PVOID, BOOLEAN, PVOID, PVOID, PVOID); 4 | 5 | ULONG GetCsrssProcessId() 6 | { 7 | 8 | return 0; 9 | } 10 | 11 | ULONG GetAddressOfShadowTable() 12 | { 13 | ULONG uAddress = 0; 14 | ULONG i = 0; 15 | PULONG pAddress = (PULONG)KeAddSystemServiceTable; 16 | 17 | for (i = 0; i < 4096; i++, pAddress++) 18 | { 19 | __try 20 | { 21 | uAddress = *pAddress; 22 | } 23 | __except(EXCEPTION_EXECUTE_HANDLER) 24 | { 25 | return 0; 26 | } 27 | 28 | if (MmIsAddressValid((PVOID)uAddress)) 29 | { 30 | if (RtlEqualMemory((PVOID)uAddress, &KeServiceDescriptorTable, sizeof(ULONG))) 31 | { 32 | if ((PVOID)uAddress == &KeServiceDescriptorTable) 33 | { 34 | continue; 35 | } 36 | return uAddress; 37 | } 38 | } 39 | } 40 | 41 | return 0; 42 | } 43 | 44 | BOOLEAN InitShadowHook() 45 | { 46 | return TRUE; 47 | } 48 | 49 | NTSTATUS InstallShadowHook(ULONG oldService, ULONG newService) 50 | { 51 | return STATUS_SUCCESS; 52 | } 53 | 54 | NTSTATUS UnInstallShadowHook(ULONG oldService) 55 | { 56 | return STATUS_SUCCESS; 57 | } 58 | -------------------------------------------------------------------------------- /sources/RootKit.h: -------------------------------------------------------------------------------- 1 | #ifndef __ROOTKIT_H 2 | #define __ROOTKIT_H 3 | 4 | #ifdef __cplusplus 5 | extern "C" 6 | { 7 | #endif 8 | 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | #ifdef __cplusplus 16 | } 17 | #endif 18 | 19 | #include 20 | #include "SSDTHook.h" 21 | #include "ShadowHook.h" 22 | #include "HookFile.h" 23 | 24 | #define DEVICE_NAME_PROCESS L"\\Device\\RootKit_Grd" 25 | #define SYMBOLINK_NAME_PROCESS L"\\??\\RootKit_Grd" 26 | 27 | #define ROOTKIT_DEVICE_TYPE FILE_DEVICE_UNKNOWN 28 | 29 | #define IO_INSERT_ADD_PROTECTED (ULONG) CTL_CODE(ROOTKIT_DEVICE_TYPE, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS) 30 | #define IO_INSERT_DEL_PROTECTED (ULONG) CTL_CODE(ROOTKIT_DEVICE_TYPE, 0x802, METHOD_BUFFERED, FILE_ANY_ACCESS) 31 | #define IO_INSERT_QUE_PROTECTED (ULONG) CTL_CODE(ROOTKIT_DEVICE_TYPE, 0x803, METHOD_BUFFERED, FILE_ANY_ACCESS) 32 | 33 | 34 | NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath); 35 | 36 | VOID DriverUnload(IN PDRIVER_OBJECT pDriverObject); 37 | 38 | NTSTATUS Create(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 39 | NTSTATUS Close(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 40 | NTSTATUS Read(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 41 | NTSTATUS Write(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 42 | NTSTATUS Dispatch(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 43 | NTSTATUS IoControl(IN PDEVICE_OBJECT pDeviceObject, IN PIRP pIrp); 44 | 45 | 46 | #endif // __ROOTKIT_H 47 | -------------------------------------------------------------------------------- /sources/HookFile.c: -------------------------------------------------------------------------------- 1 | #include "HookFile.h" 2 | 3 | typedef NTSTATUS 4 | (* PHookNtDeleteFile)( 5 | IN POBJECT_ATTRIBUTES ObjectAttributes 6 | ); 7 | 8 | typedef NTSTATUS 9 | (* PHookNtReadFile)( 10 | IN HANDLE FileHandle, 11 | IN HANDLE Event OPTIONAL, 12 | IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 13 | IN PVOID ApcContext OPTIONAL, 14 | OUT PIO_STATUS_BLOCK IoStatusBlock, 15 | OUT PVOID Buffer, 16 | IN ULONG Length, 17 | IN PLARGE_INTEGER ByteOffset OPTIONAL, 18 | IN PULONG Key OPTIONAL 19 | ); 20 | 21 | typedef NTSTATUS 22 | (* PHookNtSetInformationFile)( 23 | IN HANDLE FileHandle, 24 | OUT PIO_STATUS_BLOCK IoStatusBlock, 25 | IN PVOID FileInformation, 26 | IN ULONG Length, 27 | IN FILE_INFORMATION_CLASS FileInformationClass 28 | ); 29 | 30 | NTSTATUS 31 | HookNtDeleteFile( 32 | IN POBJECT_ATTRIBUTES ObjectAttributes 33 | ) 34 | { 35 | PHookNtDeleteFile pReal = (PHookNtDeleteFile)GetAddressFromBackupSSDT((ULONG)ZwDeleteFile); 36 | 37 | return pReal(ObjectAttributes); 38 | } 39 | 40 | NTSTATUS 41 | HookNtReadFile( 42 | IN HANDLE FileHandle, 43 | IN HANDLE Event OPTIONAL, 44 | IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, 45 | IN PVOID ApcContext OPTIONAL, 46 | OUT PIO_STATUS_BLOCK IoStatusBlock, 47 | OUT PVOID Buffer, 48 | IN ULONG Length, 49 | IN PLARGE_INTEGER ByteOffset OPTIONAL, 50 | IN PULONG Key OPTIONAL 51 | ) 52 | { 53 | PFILE_OBJECT pfile_Obj; 54 | NTSTATUS rtStatus = ObReferenceObjectByHandle(FileHandle, GENERIC_READ, *IoFileObjectType, KernelMode, (PVOID*)&pfile_Obj, 0); 55 | PHookNtReadFile pReal = (PHookNtReadFile)GetAddressFromBackupSSDT((ULONG)ZwReadFile); 56 | 57 | KdPrint(("==>:%s\r\n",__FUNCTION__)); 58 | 59 | if (NT_SUCCESS(rtStatus)) 60 | { 61 | if (NT_SUCCESS(rtStatus)) 62 | { 63 | KdPrint(("FileName:%ws\r\n",pfile_Obj->FileName.Buffer)); 64 | } 65 | } 66 | 67 | KdPrint(("<==:%s\r\n",__FUNCTION__)); 68 | 69 | return pReal(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key); 70 | } 71 | 72 | NTSTATUS 73 | HookNtSetInformationFile( 74 | IN HANDLE FileHandle, 75 | OUT PIO_STATUS_BLOCK IoStatusBlock, 76 | IN PVOID FileInformation, 77 | IN ULONG Length, 78 | IN FILE_INFORMATION_CLASS FileInformationClass 79 | ) 80 | { 81 | PFILE_OBJECT pfile_Obj; 82 | NTSTATUS rtStatus = ObReferenceObjectByHandle(FileHandle, GENERIC_READ, *IoFileObjectType, KernelMode, (PVOID*)&pfile_Obj, 0); 83 | PHookNtSetInformationFile pReal = (PHookNtSetInformationFile)GetAddressFromBackupSSDT((ULONG)ZwSetInformationFile); 84 | 85 | KdPrint(("==>:%s\r\n",__FUNCTION__)); 86 | 87 | if (NT_SUCCESS(rtStatus)) 88 | { 89 | KdPrint(("FileName:%ws\r\n",pfile_Obj->FileName.Buffer)); 90 | } 91 | 92 | KdPrint(("<==:%s\r\n",__FUNCTION__)); 93 | 94 | return pReal(FileHandle,IoStatusBlock,FileInformation,Length,FileInformationClass); 95 | } 96 | -------------------------------------------------------------------------------- /sources/RootKit.vcproj: -------------------------------------------------------------------------------- 1 | 2 | 9 | 10 | 13 | 14 | 15 | 16 | 17 | 23 | 26 | 29 | 32 | 35 | 38 | 54 | 57 | 60 | 63 | 77 | 80 | 83 | 86 | 89 | 92 | 95 | 98 | 101 | 102 | 108 | 111 | 114 | 117 | 120 | 123 | 143 | 146 | 149 | 152 | 168 | 171 | 174 | 177 | 180 | 183 | 186 | 189 | 192 | 193 | 194 | 195 | 196 | 197 | 201 | 204 | 205 | 206 | 209 | 212 | 213 | 216 | 217 | 220 | 221 | 224 | 225 | 228 | 229 | 230 | 233 | 236 | 237 | 240 | 241 | 242 | 245 | 248 | 249 | 252 | 253 | 254 | 257 | 260 | 261 | 264 | 265 | 266 | 269 | 272 | 273 | 276 | 277 | 278 | 281 | 282 | 283 | 284 | 285 | 286 | --------------------------------------------------------------------------------