zoukankan      html  css  js  c++  java
  • 多核发dpc安全inline hook

    VOID 
    OpSafeInlineHook(PVOID TargetAddress, PVOID ReadyOpCode, ULONG OpCodeLength)
    {
        PMDL MdlFuncAddress;
    
        ASSERT(TargetAddress && ReadyOpCode && OpCodeLength);
    
        if (ScmMapVirtualAddress(TargetAddress, 0x400, &MdlFuncAddress)) 
        {
            WPOFF();
            RtlCopyMemory(TargetAddress, ReadyOpCode, OpCodeLength);
            WPON();
            ScmUnmapVirtualAddress(MdlFuncAddress);
        }
    }
    
    VOID SafeHookDpcRoutine (
        __in struct _KDPC *Dpc,
        __in_opt PDPC_CONTEXT DeferredContext,
        __in_opt PVOID SystemArgument1,
        __in_opt PVOID SystemArgument2
        )
    {
        InterlockedIncrement(&DeferredContext->LockedProcessors);
        do {
            __asm   pause;
        } while (DeferredContext->ReleaseFlag == FALSE);
        InterlockedDecrement(&DeferredContext->LockedProcessors);
    }
    
    BOOL ScHeSafeInlineHook(PVOID TargetAddress, PVOID ReadyOpCode, ULONG OpCodeLength)
    {
        BOOL result = FALSE;
        DPC_CONTEXT DpcContext;
        KAFFINITY OrigAffinity;
        UNICODE_STRING NameString;
        CCHAR CurrentProcessor;
        CCHAR Processor;
        PKDPC Dpc;
        ULONG i;
        KIRQL OrigIrql;
        pFnKeSetAffinityThread KeSetAffinityThread = NULL;
        
        RtlInitUnicodeString(&NameString, L"KeSetAffinityThread");
        KeSetAffinityThread = (pFnKeSetAffinityThread)MmGetSystemRoutineAddress(&NameString);
    
        OrigAffinity = KeSetAffinityThread(KeGetCurrentThread(), 1); 
        OrigIrql = KeRaiseIrqlToDpcLevel();
    
        if (KeNumberProcessors > 1) {
    
            CurrentProcessor = (CCHAR)KeGetCurrentProcessorNumber();
            DpcContext.Dpcs = ExAllocatePoolWithTag(NonPagedPool, KeNumberProcessors * sizeof(KDPC), MEM_TAG);
            DpcContext.LockedProcessors = 1;
            DpcContext.ReleaseFlag = FALSE;
    
            for (Processor = 0; Processor < KeNumberProcessors; Processor++)
            {
                if (Processor == CurrentProcessor)  continue;
                Dpc = &DpcContext.Dpcs[Processor];
                KeInitializeDpc(Dpc, SafeHookDpcRoutine, &DpcContext);
                KeSetTargetProcessorDpc(Dpc, Processor);
                KeInsertQueueDpc(Dpc, NULL, NULL);
            }
    
            for (i = 0; i < 0x800000; i++) {
                __asm   pause;
                if (DpcContext.LockedProcessors == (ULONG)KeNumberProcessors) break;
            }
            
            if (DpcContext.LockedProcessors != (ULONG)KeNumberProcessors) {
                KdPrint(("[ScSafeInlineHook] Failed to insert dpc to other processors"));
                DpcContext.ReleaseFlag = TRUE;
                for (Processor = 0; Processor < KeNumberProcessors; Processor++) 
                {
                    if (Processor != CurrentProcessor) {
                        KeRemoveQueueDpc(&DpcContext.Dpcs[Processor]);
                    }
                }
            } else {
                KdPrint(("[ScSafeInlineHook] Insert dpc succeed, now start inline hook"));
                OpSafeInlineHook(TargetAddress, ReadyOpCode, OpCodeLength);
                result = TRUE;
                DpcContext.ReleaseFlag = TRUE;  
            }
            do {
                __asm   pause;
            } while (DpcContext.LockedProcessors != 1);
    
            ExFreePoolWithTag(DpcContext.Dpcs, MEM_TAG);
    
        } else {
    
            OpSafeInlineHook(TargetAddress, ReadyOpCode, OpCodeLength);
            result = TRUE;
        }
        KeLowerIrql(OrigIrql);
        KeSetAffinityThread(KeGetCurrentThread(), OrigAffinity); 
        return result;
    }
    -------------------------------------------------------

    kedebug

    Department of Computer Science and Engineering,

    Shanghai Jiao Tong University

    E-mail: kedebug0@gmail.com

    GitHub: http://github.com/kedebug

    -------------------------------------------------------

  • 相关阅读:
    多图详解!10大高性能开发核心技术(转发)
    从 Spring Cloud 看一个微服务框架的「五脏六腑」
    eclipse中的springBoot项目 执行maven build 和maven install 报错
    Mysql怎么删除某表中的一条数据
    eclipse 中需要配置jdk、需要配置jre吗? 以及安装eclipse后需要做的一些配置
    IntelliJ IDEA 2019.2最新版本免费激活码(亲测可用)
    在springBoot项目配置项目的访问路径的时候 server.context-path不起作用的原因
    共享类型的基站概念
    oracle创建索引
    ORACLE中的DBLINK概念及使用DBLINK对远程数据库的连接
  • 原文地址:https://www.cnblogs.com/kedebug/p/2791752.html
Copyright © 2011-2022 走看看