恢复fsd hook的问题.txt

文件系统驱动开发的文档资料（IFS DDK）

求教：关于恢复fsd hook的问题

我想得到fsd（ntfs。sys和fastfat。sys）中IRP_MJ_SET_INFORMATION派遣函数地址，我先得到ntfs。sys的内存基址base，如下结构中的base
typedef struct tagSYSTEM_MODULE_INFORMATION {
  ULONG Reserved[2];
  PVOID Base;
  ULONG Size;
  ULONG Flags;
  USHORT Index;
  USHORT Unknown;
  USHORT LoadCount;
  USHORT ModuleNameOffset;
  CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
这步应该没有问题，然后利用这个base，通过pe得到驱动入口driverentry地址，如下
PCHAR GetDriverEntryAddress(PCHAR BaseAddr)
{
   PIMAGE_DOS_HEADER       pDosHdr=NULL;
   PIMAGE_NT_HEADERS       pNtHdr=NULL;
   PIMAGE_OPTIONAL_HEADER   pOptHdr=NULL;

   pDosHdr = ( PIMAGE_DOS_HEADER )BaseAddr;

  if ( IMAGE_DOS_SIGNATURE == pDosHdr->e_magic )
   {
       pNtHdr = ( PIMAGE_NT_HEADERS )( BaseAddr + pDosHdr->e_lfanew );

    if( IMAGE_NT_SIGNATURE == pNtHdr->Signature ||   IMAGE_NT_SIGNATURE1 == pNtHdr->Signature )
       {
           pOptHdr = ( PIMAGE_OPTIONAL_HEADER )( BaseAddr + pDosHdr->e_lfanew + sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER) );
           if(pOptHdr != NULL)
           {
               //DebugPrint("MajorOperatingSystemVersion=0x%08x\n",pOptHdr->MajorOperatingSystemVersion);
               //DebugPrint("MinorOperatingSystemVersion=0x%08x\n",pOptHdr->MinorOperatingSystemVersion);
               DebugPrint("BaseAddr=0x%08x\n",BaseAddr);
               DebugPrint("AddressOfEntryPoint=0x%08x\n",pOptHdr->AddressOfEntryPoint);
               return BaseAddr + pOptHdr->AddressOfEntryPoint;
           }
       }        
   }
   return NULL;
}
这个步骤不知道是否正确，但我调试发现版本信息输出好像没有问题，然后我利用下面函数得到需要的IRP_MJ_SET_INFORMATION派遣函数地址结果总不成功，望高手赐教，多谢！
#define SearchDepth 0x100 
DWORD GetFunctionAddrByID(PCHAR pDriverEntry, BYTE MajorFunction) 
{ 
   int i=0; 
   DWORD function=0; 
   BYTE ZZ = MajorFunction*4+0x38;
   //DebugPrint("ZZ=0x%08x\n",ZZ);
   //DebugPrint("pDriverEntry=0x%08x\n",pDriverEntry);
   
   if(ZZ < 0x80) 
   { 
       for (i=0;i<SearchDepth;i++) 
       { 
           //DebugPrint("0x%08x ",*(pDriverEntry+i));
           //DebugPrint("0x%08x ",*(pDriverEntry+i+1));
           //DebugPrint("0x%08x \n",*(pDriverEntry+i+2));
           if( (*(pDriverEntry+i)==0xc7)&& 
               ( *(pDriverEntry+i+1)==0x46 || *(pDriverEntry+i+1)==0x43 ) && 
               ( *(pDriverEntry+i+2)==ZZ) 
               ) 
           { 
               DebugPrint(("GetFunctionAddrByID:0x%08x\n",pDriverEntry+i+3)); 
               function=*(DWORD*)(pDriverEntry+i+3); 
               break; 
           } 
       } 
   } 
   else 
   { 
       DebugPrint(">=0x80\n");
       for (i=0;i<SearchDepth;i++) 
       { 
           if( (*(pDriverEntry+i)==0xc7)&& 
               ( *(pDriverEntry+i+1)==0x86 || *(pDriverEntry+i+1)==0x83 ) && 
               ( *(pDriverEntry+i+2)==ZZ) 
               ) 
           { 
               DebugPrint(("GetFunctionAddrByID:0x%08x\n",pDriverEntry+i+3)); 
               function=*(DWORD*)(pDriverEntry+i+3); 
               break; 
           } 
       } 
   } 
   
   return function; 
}
=============================


ULONG get_funaddr(ULONG* pdriver_entry,ULONG major_function) 
{ 
int i=0; 
ULONG function=0; 
ULONG index = major_function*4+0x38; 
//找到所对应的函数地址
      if(index < 0x80) 
index = (index<<24)+0x43c700;
else 
index = (index<<24)+0x83c700;
for (i=0;i<SearchDepth;i++) 
{ 
((char*)pdriver_entry)++;
if((*pdriver_entry&0xffffff00) == index)
{
  if(index < 0x8083c700)
  {
  DbgPrint("GetFunctionAddrByID:0x%08x\n",(ULONG)((char*)pdriver_entry+4)); 
    function=*(ULONG*)((char*)pdriver_entry+4); 
    break;
  }
  else
  {
  DbgPrint("GetFunctionAddrByID:0x%08x\n",(ULONG)((char*)pdriver_entry+4)); 
    function=*(ULONG*)((char*)pdriver_entry+7); 
    break;
  }
} 
}
return function; 
} 
/*
0008BE6D: 8B 3D 58 2A 02 00         MOV EDI,[00022A58]
0008BE73: C7 43 38 7A E4 02 00       MOV DWORD PTR [EBX+38],0002E47A
0008BE7A: C7 43 40 F0 B8 02 00       MOV DWORD PTR [EBX+40],0002B8F0
0008BE81: C7 43 44 A3 2F 01 00       MOV DWORD PTR [EBX+44],00012FA3
0008BE88: C7 43 48 20 03 01 00       MOV DWORD PTR [EBX+48],00010320
0008BE8F: C7 43 4C 4C EB 02 00       MOV DWORD PTR [EBX+4C],0002EB4C
0008BE96: C7 43 50 27 88 02 00       MOV DWORD PTR [EBX+50],00028827
0008BE9D: C7 43 54 95 1B 06 00       MOV DWORD PTR [EBX+54],00061B95
0008BEA4: C7 43 58 DF 1C 06 00       MOV DWORD PTR [EBX+58],00061CDF
0008BEAB: C7 43 5C DF A6 03 00       MOV DWORD PTR [EBX+5C],0003A6DF
0008BEB2: C7 43 60 B8 4F 03 00       MOV DWORD PTR [EBX+60],00034FB8
0008BEB9: C7 43 64 E6 7C 08 00       MOV DWORD PTR [EBX+64],00087CE6
0008BEC0: C7 43 68 9D 06 03 00       MOV DWORD PTR [EBX+68],0003069D
0008BEC7: C7 43 6C 28 22 03 00       MOV DWORD PTR [EBX+6C],00032228
0008BECE: C7 43 70 BB FD 04 00       MOV DWORD PTR [EBX+70],0004FDBB
0008BED5: C7 43 7C F5 BA 03 00       MOV DWORD PTR [EBX+7C],0003BAF5
0008BEDC: C7 83 80 00 00 00 91 CC 02 00 MOV DWORD PTR [EBX+00000080],0002CC91
0008BEE6: C7 83 88 00 00 00 50 AC 02 00 MOV DWORD PTR [EBX+00000088],0002AC50
0008BEF0: C7 83 8C 00 00 00 F6 FF 07 00 MOV DWORD PTR [EBX+0000008C],0007FFF6
0008BEFA: C7 43 78 12 12 02 00       MOV DWORD PTR [EBX+78],00021212
0008BF01: C7 83 9C 00 00 00 52 62 07 00 MOV DWORD PTR [EBX+0000009C],00076252
0008BF0B: C7 83 A0 00 00 00 9C 63 07 00 MOV DWORD PTR [EBX+000000A0],0007639C
0008BF15: C7 83 A4 00 00 00 C2 5E 07 00 MOV DWORD PTR [EBX+000000A4],00075EC2
0008BF1F: C7 43 28 C0 5E 02 00       MOV DWORD PTR [EBX+28],00025EC0
0008BF26: A3 04 5F 02 00           MOV [00025F04],EAX
ntfs.sys反汇编出来的东西
通过查询c7 43 xx
c7 83 xx
来找到入口 */
PVOID get_object(WCHAR* name)
{
NTSTATUS status;
UNICODE_STRING file_ntfs;
  PDRIVER_OBJECT pfile_driver_object; 
RtlInitUnicodeString( &file_ntfs, name); 
status = ObReferenceObjectByName (   
                    &file_ntfs,   
                    OBJ_CASE_INSENSITIVE,   
                    NULL,   
                    0,   
                    *IoDriverObjectType,   
                    KernelMode,   
                    NULL,   
                    (void*)&pfile_driver_object);
      
    if( !NT_SUCCESS(status)) {
DbgPrint("myfsd: create failed.\n");
    return NULL;
  }
  return pfile_driver_object;
}
PVOID get_moudle(char* name)
{
  NTSTATUS status;
  PVOID pbuffer, pmodule;
  ULONG nret_size, i, n;
  PSYSTEM_MODULE_INFORMATION pmoudle_info;

  pbuffer = ExAllocatePool(PagedPool, 0x1000);
  if (NULL == pbuffer)
  {
    DbgPrint("myfsd:allocate failed: %d\n");
    return NULL;
  }

  status = ZwQuerySystemInformation(SystemModuleInformation, pbuffer, 0x1000, &nret_size);
  if (STATUS_INFO_LENGTH_MISMATCH == status)
  {
    // 缓冲区不够时，重新分配
    ExFreePool(pbuffer);
    pbuffer = ExAllocatePool(PagedPool, nret_size);
    if (NULL == pbuffer)
    {
        DbgPrint("myfsd:localalloc failed: %d\n");
        return NULL;
    }
    status = ZwQuerySystemInformation(SystemModuleInformation, pbuffer, nret_size, &nret_size);
  }
  if (!NT_SUCCESS(status))
  {
    DbgPrint("myfsd:systeminformation failed: %d\n");
    ExFreePool(pbuffer);
    return NULL;
  }

  pmoudle_info = (PSYSTEM_MODULE_INFORMATION)((ULONG)pbuffer + 4);
  n = *(ULONG*)pbuffer;
  pmodule = NULL;

  // 搜索指定的模块名
  for (i=0; i<n; i++)
  {
    if (!_stricmp(pmoudle_info->ImageName+pmoudle_info->ModuleNameOffset, name))
    {
        pmodule = pmoudle_info->Base;
        break;
    }
    pmoudle_info++;
  }

  ExFreePool(pbuffer);
  return pmodule;
}
void init_ntfs_fun(char* name,WCHAR* link_name,ULONG* map_fun,ULONG* map_base,ULONG index)
{
PVOID base_addr,fact_addr;
ULONG cause_addr;
PDRIVER_OBJECT pdriver_obj =NULL;
base_addr = get_moudle(name);
cause_addr = (ULONG)base_addr+(ULONG)map_fun-(ULONG)map_base;
  pdriver_obj = (PDRIVER_OBJECT)get_object(link_name);
  fact_addr = pdriver_obj->MajorFunction[index];
  if( (ULONG)fact_addr != cause_addr)//查看入口是否被改
{
  DbgPrint("DriverDispatcher:0x%08x\n" ,fact_addr);
fact_addr = (PVOID)cause_addr;
pdriver_obj->MajorFunction[index] = fact_addr;
}
  DbgPrint("basemoudleaddress:0x%08x\n",base_addr); 
DbgPrint("causeaddr:0x%08x\n",cause_addr); 
  DbgPrint("factaddr:0x%08x\n" ,fact_addr);
_asm{//查看前20字节是否有变动 如果有就恢复
        mov eax, cr0 
        and eax, NOT 10000H 
        mov cr0, eax 
  pushad
  mov ecx,5
  xor edx,edx
  mov edi,map_fun
  mov esi,fact_addr
      mov eax,dword ptr[edi]
  mov ebx,dword ptr[esi]
  cli
again: cmp eax,ebx
  jz next
  mov dword ptr[esi+edx*4],eax
next: inc edx
        mov eax,dword ptr[edi+4*edx]
  mov ebx,dword ptr[esi+edx*4]
    loopz again
  
    sti
      popad
        mov eax, cr0 
    or eax, 10000H 
    mov cr0, eax 
}

}
NTSTATUS init_ntfs(ULONG index)
{
UNICODE_STRING file_sys_name;
OBJECT_ATTRIBUTES ob;
NTSTATUS status;
HANDLE h_file,h_section,h_mod;
IO_STATUS_BLOCK stat;
PVOID base_address,point_address;
IMAGE_DOS_HEADER* dos_header;
  IMAGE_OPTIONAL_HEADER* op_header;
ULONG img_fun_address;
ULONG* img_fun_point;
SIZE_T size=0;
file_sys_name.Length = 0;
  RtlInitUnicodeString( &file_sys_name,L"\\??\\C:\\WINNT\\system32\\drivers\\ntfs.sys"); 
if(file_sys_name.Length == 0)
{
DbgPrint("myfsd:Unicode fails\n");
return 0;
}

  InitializeObjectAttributes( &ob,&file_sys_name,
                  OBJ_CASE_INSENSITIVE,0, NULL );
  status = ZwOpenFile ( &h_file,FILE_EXECUTE|FILE_READ_DATA, &ob, &stat, 0,0);
if( !NT_SUCCESS( status )) {
DbgPrint("fails\n");
    return status;
}
  ob.ObjectName = 0;

status = ZwCreateSection(&h_section, SECTION_ALL_ACCESS, &ob, 0,PAGE_EXECUTE, SEC_IMAGE, h_file);
if( !NT_SUCCESS(status)) {
DbgPrint("myfsd: Create Section failed.\n");
return status;
}
//把目标文件映射到内存
      //大小根据SizeOfImage而定
  status = ZwMapViewOfSection(h_section,

NtCurrentProcess(), 

&base_address, 

0,

0x7ffff,

0, 

&size, 

(SECTION_INHERIT)1, 

MEM_TOP_DOWN,

                PAGE_READWRITE); 
  if( !NT_SUCCESS(status)) {
      DbgPrint("myfsd: mapviewofsection fails.\n");
      ZwClose(h_file); 
      ZwClose(h_section);
      return status;
}
h_mod = base_address;
  dos_header = (IMAGE_DOS_HEADER *)h_mod;
  op_header =(IMAGE_OPTIONAL_HEADER *) ((char*)h_mod+dos_header->e_lfanew+24);
  DbgPrint("BaseAddress:0x%08x\n",(ULONG)base_address);
  DbgPrint("EntryPoint:0x%08x\n",(LONG)op_header->AddressOfEntryPoint);
  DbgPrint("ImageBase:0x%08x\n",(LONG)op_header->ImageBase);
  DbgPrint("SizeOfImage:0x%08x\n",op_header->SizeOfImage);
  point_address = (PVOID*)((ULONG)base_address+op_header->AddressOfEntryPoint);
  DbgPrint("FunAddr:0x%08x\n",*(ULONG*)point_address);
  img_fun_address = get_funaddr(point_address,index);
  DbgPrint("FunAddr:0x%08x\n",img_fun_address);
  img_fun_point = (ULONG*)((ULONG)base_address+img_fun_address-(LONG)op_header->ImageBase);
  DbgPrint("funaddress:0x%08x\n",img_fun_point);
  init_ntfs_fun("ntfs.sys",L"\\FileSystem\\Ntfs",img_fun_point,base_address,index);
ZwClose(h_file); 
ZwUnmapViewOfSection(h_section, base_address);
ZwClose(h_section); 
return status;
}

2000上写的 我这里没问题 可能有错 有错请告诉我。。。。。