LoadDriver SSDT Hook - نسخة قابلة للطباعة

LoadDriver SSDT Hook.
Compile it with Meerlat 1.1 (http://www.delphi4arab.net/forum/showthread.php?p=22034)
Use DbgView to catch informations.
Only for Windows XP.

Delphi project link: hxxp://www.mediafire.com/?klfd7ozqliawq6f

الملفات المصدرية:

PHP كود :
unit ZwLoadDriverHook;
interface

uses
  nt_status,
  ntoskrnl,
  fcall,
  KernelUtils,
  NtoskrnlCustom;

function _DriverEntry(
  DriverObject: PDriverObject;
  RegistryPath: PUnicodeString
  ): NTSTATUS; stdcall;

implementation
type
  TZwLoadDriver = function(DriverServiceName: PUnicodeString): NTSTATUS; stdcall;
var
  HookActive: Boolean;
  ZwLoadDriverNextHook: TZwLoadDriver;

function ZwLoadDriverHookProc(DriverServiceName: PUnicodeString): NTSTATUS; stdcall;
begin
  DbgPrint('Driver service name :%wZ', DriverServiceName);
  Result := ZwLoadDriverNextHook(DriverServiceName);
end;

procedure DriverUnload(DriverObject: PDriverObject); stdcall;
begin
  if HookActive then
  begin
    ZwLoadDriverNextHook :=  TZwLoadDriver(InterlockedExchange(SystemServiceName(GetImportFunAddr(@ZwLoadDriver)),  LONG(@ZwLoadDriverNextHook)));
    DbgPrint('ZwLoadDriver New Address: 0x%.8X', SystemServiceName(GetImportFunAddr(@ZwLoadDriver))^);
    DbgPrint('ZwLoadDriver Old Address: 0x%.8X', DWORD(@ZwLoadDriverNextHook));

    HookActive := False;
  end;
  DbgPrint('DriverUnload(-)');
end;

function _DriverEntry(DriverObject: PDriverObject; RegistryPath: PUnicodeString): NTSTATUS; stdcall;
begin
  DriverObject^.DriverUnload := @DriverUnload;
  Result := STATUS_SUCCESS;
  DbgPrint('DriverEntry(-):0x%.8X', Result);
  HookActive := False;

  DbgPrint('ZwLoadDriver Import Address: 0x%.8X', GetImportFunAddr(@ZwLoadDriver));
  DbgPrint('KeServiceDescriptorTable() Address 1: 0x%.8X', @KeServiceDescriptorTable);
  DbgPrint('KeServiceDescriptorTable() Address 2: 0x%.8X', PPointer(@KeServiceDescriptorTable)^);

  DbgPrint('ZwLoadDriver Ord Address: 0x%.8X', SystemServiceOrd($7A)^); //  XP Ord!
  DbgPrint('ZwLoadDriver Name Address: 0x%.8X', SystemServiceName(GetImportFunAddr(@ZwLoadDriver))^);

  DbgPrint('ZwLoadDriver HookProc Address: 0x%.8X', @ZwLoadDriverHookProc);

  if not HookActive then
  begin
    ZwLoadDriverNextHook :=  TZwLoadDriver(InterlockedExchange(SystemServiceName(GetImportFunAddr(@ZwLoadDriver)),  LONG(@ZwLoadDriverHookProc)));

    DbgPrint('ZwLoadDriver New Address: 0x%.8X', SystemServiceName(GetImportFunAddr(@ZwLoadDriver))^);
    DbgPrint('ZwLoadDriver Old Address: 0x%.8X', DWORD(@ZwLoadDriverNextHook));

    HookActive := True;
  end else
  begin
    DbgPrint('ZwLoadDriver Hooked');
  end;
end;
end. 

PHP كود :
unit KernelUtils;
interface

uses
  nt_status,
  ntoskrnl;

function SystemServiceName(AFunc: Pointer): PLONG; stdcall;
function GetImportFunAddr(lpImportAddr: Pointer): Pointer; stdcall;
function SystemServiceOrd(iOrd: ULONG): PLONG; stdcall;

implementation

function GetImportFunAddr(lpImportAddr: Pointer): Pointer; stdcall;
begin
  Result := PPointer(PPointer(Cardinal(lpImportAddr) + 2)^)^;
end;

function SystemServiceName(AFunc: Pointer): PLONG; stdcall;
var lpKeServiceDescriptorTable: PServiceDescriptorEntry;
begin
  lpKeServiceDescriptorTable := GetImportFunAddr(@KeServiceDescriptorTable);
  Result := PLONG(Cardinal(lpKeServiceDescriptorTable^.ServiceTableBase) + (SizeOf(ULONG) * PULONG(ULONG(AFunc) + 1)^));
end;

function SystemServiceOrd(iOrd: ULONG): PLONG; stdcall;
var lpKeServiceDescriptorTable: PServiceDescriptorEntry;
begin
  lpKeServiceDescriptorTable := GetImportFunAddr(@KeServiceDescriptorTable);
  Result := PLONG(PLONG(Cardinal(lpKeServiceDescriptorTable^.ServiceTableBase) + (SizeOf(ULONG) * iOrd)));
end;
end. 

بالتوفيق ان شاء الله