(转载)在Windows 2003中HOOK ZwCreateProcessEx

创建时间：2005-03-09
文章属性：原创
文章提交： suei8423 (suei8423_at_163.com)

作者：ZwelL

工作需要，想控制进程的创建，于是HOOK了ZwCreateProcess，后来发现xp和2003中创建进程的都用NtCreateProcessEx(参见[1]）。
但是ZwCreateProcessEx未被ntoskrnl.exe导出，用softice的ntcall命令也没有看到,网上也没有找到相关代码。没办法，跟踪ntoskrnl!ZwCreateProcess
>u ntoskrnl!ZwCreateProcessEx

_ZwCreateProcess
0008:804e7ae2    bb32000000    mov eax, 00000032

但是ZwCreateProcessEx有9个参数，最后一个未知，4字节，猜成HANDLE型。
原型如下：
typedef NTSTATUS (*NTCREATEPROCESSEX)(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE Unknown );  
最终用硬编码HOOK 成功，代码如下：


#include "ntddk.h"
#include "stdarg.h"
#include "stdio.h"
#include "ntiologc.h"

#define DWORD unsigned long
#define WORD unsigned short
#define BOOL unsigned long

typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;

extern PServiceDescriptorTableEntry KeServiceDescriptorTable;

typedef NTSTATUS (*NTCREATEPROCESSEX)(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL,
IN HANDLE Unknown );

NTCREATEPROCESSEX    OldNtCreateProcessEx;

// Length of process name (rounded up to next DWORD)
#define PROCNAMELEN     20
// Maximum length of NT process name
#define NT_PROCNAMELEN  16
ULONG gProcessNameOffset;

void GetProcessNameOffset()
{
    
    PEPROCESS curproc;
    int i;
    curproc = PsGetCurrentProcess();
    for( i = 0; i < 3*PAGE_SIZE; i++ )
    {
        if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") ))
        {
            gProcessNameOffset = i;
        }
    }
}

BOOL GetProcessName( PCHAR theName )
{
    PEPROCESS       curproc;
    char            *nameptr;
    ULONG           i;
    KIRQL           oldirql;

    if( gProcessNameOffset )
    {
        curproc = PsGetCurrentProcess();
        nameptr   = (PCHAR) curproc + gProcessNameOffset;
        strncpy( theName, nameptr, NT_PROCNAMELEN );
        theName[NT_PROCNAMELEN] = 0; /* NULL at end */
        return TRUE;
    }
    return FALSE;
}

NTSTATUS NewNtCreateProcessEx(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL,
IN HANDLE Unknown OPTIONAL)
{
    CHAR aProcessName[PROCNAMELEN];
        
    GetProcessName( aProcessName );
    DbgPrint("rootkit: NewNtCreateProcessEx() from %s/n", aProcessName);
    //DbgPrint("ok");
    return OldNtCreateProcessEx(ProcessHandle,DesiredAccess,
            ObjectAttributes,ParentProcess,InheritObjectTable,SectionHandle,DebugPort,ExceptionPort,Unknown);
}

NTSTATUS
OnStubDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    IoCompleteRequest (Irp,
                       IO_NO_INCREMENT
                       );
    return Irp->IoStatus.Status;
}

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
    DbgPrint("ROOTKIT: OnUnload called/n");

    _asm
    {
        CLI                    //dissable interrupt
        MOV    EAX, CR0        //move CR0 register into EAX
        AND EAX, NOT 10000H //disable WP bit
        MOV    CR0, EAX        //write register back
    }

    (NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32))=OldNtCreateProcessEx;

    _asm
    {
        MOV    EAX, CR0        //move CR0 register into EAX
        OR    EAX, 10000H        //enable WP bit     
        MOV    CR0, EAX        //write register back        
        STI                    //enable interrupt
    }
}

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
    int i;

    DbgPrint("My Driver Loaded!");
    GetProcessNameOffset();

    // Register a dispatch function
    for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
    {
            theDriverObject->MajorFunction[i] = OnStubDispatch;
    }

    theDriverObject->DriverUnload  = OnUnload;

    // save old system call locations
    //OldNtCreateProcessEx=(NTCREATEPROCESSEX)(SYSTEMSERVICE(0x32));
    OldNtCreateProcessEx=(NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32));


    _asm
    {
        CLI                    //dissable interrupt
        MOV    EAX, CR0        //move CR0 register into EAX
        AND EAX, NOT 10000H //disable WP bit
        MOV    CR0, EAX        //write register back
    }

    (NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32))=  NewNtCreateProcessEx;

    _asm
    {
        MOV    EAX, CR0        //move CR0 register into EAX
        OR    EAX, 10000H        //enable WP bit     
        MOV    CR0, EAX        //write register back        
        STI                    //enable interrupt
    }
                    
    return STATUS_SUCCESS;
}

这样很不爽，每次都要这样看索引号，问了SOBEIT，可以通过从NTDLL中这样获取服务索引号：
来自rookkit:

#include
#include

BOOL GetId( char *FuncName, ULONG *FunctionID )
{
    //get the function's address
    PBYTE Function = (PBYTE)GetProcAddress( GetModuleHandle( "ntdll.dll" ), FuncName );
    /*
    do some sanity checks,
    make sure this function
    has a corresponding kernel
    level function
    */

    *FunctionID = 0;

    //func not found...
    if ( Function == NULL )
    {
        return FALSE;
    }

    /*
    77F5B438   B8 00000000    MOV EAX, _FUNCTION_ID_
    77F5B43D   BA 0003FE7F    MOV EDX,7FFE0300
    77F5B442   FFD2           CALL EDX
    77F5B444   C2 1800        RETN XX
     */

    //mov eax
    if ( *Function != 0xB8 )
    {
        return FALSE;
    }
    /*
    since the address of
    the function which
    actually makes the call
    (SYSCALL) may change, we just
    check for mov edx
    */
    if ( *(Function + 5) != 0xBA )
    {
        return FALSE;
    }

    //call edx
    /*if ( *(PWORD)(Function + 10) != 0xD2FF )
    {
        return FALSE;
    }
    //retn
    if ( *(Function + 12) != 0xC2 )
    {
        return FALSE;
    }*/

    *FunctionID = *(PDWORD)(Function + 1);
    return TRUE;
}

int main(int argc, char* argv[])
{
    ULONG Id;
    
    printf( "function name: NtCreateProcessEx/n" );

    GetId( "NtCreateProcessEx", &Id );
    printf( "function id: %08X/n", Id );
    return 0;
}
///////////////////////////////////////////////////////////////////////

这样也不爽，要从用户态传到驱动层不方便，最后，用这个代码：

#include "ntddk.h"
#include "stdarg.h"
#include "stdio.h"
#include "ntiologc.h"
#include "ntimage.h"


#define DWORD unsigned long
#define WORD unsigned short
#define BOOL unsigned long
#define BYTE unsigned char

#define SEC_IMAGE    0x01000000

typedef struct _SECTION_IMAGE_INFORMATION {
PVOID EntryPoint;
ULONG StackZeroBits;
ULONG StackReserved;
ULONG StackCommit;
ULONG ImageSubsystem;
WORD SubsystemVersionLow;
WORD SubsystemVersionHigh;
ULONG Unknown1;
ULONG ImageCharacteristics;
ULONG ImageMachineType;
ULONG Unknown2[3];
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;

DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName)
{
    HANDLE hThread, hSection, hFile, hMod;
    SECTION_IMAGE_INFORMATION sii;
    IMAGE_DOS_HEADER* dosheader;
    IMAGE_OPTIONAL_HEADER* opthdr;
    IMAGE_EXPORT_DIRECTORY* pExportTable;
    DWORD* arrayOfFunctionAddresses;
    DWORD* arrayOfFunctionNames;
    WORD* arrayOfFunctionOrdinals;
    DWORD functionOrdinal;
    DWORD Base, x, functionAddress;
    char* functionName;
    STRING ntFunctionName, ntFunctionNameSearch;
    PVOID BaseAddress = NULL;
    SIZE_T size=0;

    OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};

    IO_STATUS_BLOCK iosb;

    //_asm int 3;
    ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);

    oa.ObjectName = 0;

    ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);
    
    ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE);
    
    ZwClose(hFile);
    
    hMod = BaseAddress;
    
    dosheader = (IMAGE_DOS_HEADER *)hMod;
    
    opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24);

    pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);

    // now we can get the exported functions, but note we convert from RVA to address
    arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions);

    arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames);

    arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals);

    Base = pExportTable->Base;

    RtlInitString(&ntFunctionNameSearch, lpFunctionName);

    for(x = 0; x < pExportTable->NumberOfFunctions; x++)
    {
        functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);

        RtlInitString(&ntFunctionName, functionName);

        functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0
        // this is the funny bit.  you would expect the function pointer to simply be arrayOfFunctionAddresses[x]...
        // oh no... thats too simple.  it is actually arrayOfFunctionAddresses[functionOrdinal]!!
        functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);
        if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0)
        {
            ZwClose(hSection);
            return functionAddress;
        }
    }

    ZwClose(hSection);
    return 0;
}

NTSTATUS
OnStubDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP           Irp
    )
{
    Irp->IoStatus.Status      = STATUS_SUCCESS;
    IoCompleteRequest (Irp,
                       IO_NO_INCREMENT
                       );
    return Irp->IoStatus.Status;
}

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{
    DbgPrint("ROOTKIT: OnUnload called/n");
}

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
    int i;
    UNICODE_STRING dllName;
    DWORD functionAddress;
    int    position;
    DbgPrint("My Driver Loaded!");
    theDriverObject->DriverUnload  = OnUnload;
    RtlInitUnicodeString(&dllName, L"//Device//HarddiskVolume1//Windows//System32//ntdll.dll");
    functionAddress = GetDllFunctionAddress("ZwCreateProcessEx", &dllName);
    position = *((WORD*)(functionAddress+1));

    DbgPrint("Id:%d/n", position);
                    
    return STATUS_SUCCESS;
}

上面的代码从驱动层加载NTDLL，再从输出表中找出函数地址，mov eax,[ID]对应的b8后面的字就是索引号，其实跟前一个代码作用是相似的，
只是驱动层没有LoadLibrary,只能这样解决了。将上面的代码整合起来就比较完善了，大家看着改吧。这里顺便把2003中的服务描述表发出来，希望对大家有帮助：


Service table address:0x80567980  Number of services:280=0x127
Index       Address     Parameters  Name                                                        
-------------------------------------------------------------------------------------------------
0x0         0x8058ddce  6           NtAcceptConnectPort                                
0x1         0x80596b7e  8           NtAccessCheck                                      
0x2         0x805976ce  b           NtAccessCheckAndAuditAlarm                          
0x3         0x805a8bb7  b           NtAccessCheckByType                                
0x4         0x8059968a  10          NtAccessCheckByTypeAndAuditAlarm                    
0x5         0x80658705  b           NtAccessCheckByTypeResultList                      
0x6         0x8065a9b2  10          NtAccessCheckByTypeResultListAndAuditAlarm          
0x7         0x8065a9f5  11          NtAccessCheckByTypeResultListAndAuditAlarmByHandle  
0x8         0x8059dc4f  3           NtAddAtom                                          
0xb         0x806581e2  6           NtAdjustGroupsToken                                
0xc         0x80597836  6           NtAdjustPrivilegesToken                            
0xd         0x8065104b  2           NtAlertResumeThread                                
0xe         0x805971ea  1           NtAlertThread                                      
0xf         0x805996cc  1           NtAllocateLocallyUniqueId                          
0x10        0x80647eb9  3           NtAllocateUserPhysicalPages                        
0x11        0x805a70dc  4           NtAllocateUuids                                    
0x12        0x80583188  6           NtAllocateVirtualMemory                            
0x13        0x8058faff  2           NtApphelpCacheControl                              
0x14        0x805e92fb  2           NtAreMappedFilesTheSame                            
0x15        0x805aae6f  2           NtAssignProcessToJobObject                          
0x16        0x804ebbcc  3           NtCallbackReturn                                    
0x18        0x805eb49d  2           NtCancelIoFile                                      
0x19        0x804f7445  2           NtCancelTimer                                      
0x1a        0x8058c43a  1           NtClearEvent                                        
0x1b        0x805768ac  1           NtClose                                            
0x1c        0x80596eea  3           NtCloseObjectAuditAlarm                            
0x1d        0x80626f6f  2           NtCompactKeys                                      
0x1e        0x8065b8ff  3           NtCompareTokens                                    
0x1f        0x8058dc82  1           NtCompleteConnectPort                              
0x20        0x806271d6  1           NtCompressKey                                      
0x21        0x8058c55a  8           NtConnectPort                                      
0x22        0x804eb14b  2           NtContinue                                          
0x23        0x805b0b1e  4           NtCreateDebugObject                                
0x24        0x805aabaf  3           NtCreateDirectoryObject                            
0x25        0x80578522  5           NtCreateEvent                                      
0x26        0x80668009  3           NtCreateEventPair                                  
0x27        0x805790cb  b           NtCreateFile                                        
0x28        0x8059f5ab  4           NtCreateIoCompletion                                
0x29        0x805e09eb  3           NtCreateJobObject                                  
0x2a        0x80651805  3           NtCreateJobSet                                      
0x2b        0x80592a39  7           NtCreateKey                                        
0x2c        0x805f225d  8           NtCreateMailslotFile                                
0x2d        0x805863a1  4           NtCreateMutant                                      
0x2e        0x8058f416  e           NtCreateNamedPipeFile                              
0x2f        0x805c8e1e  4           NtCreatePagingFile                                  
0x30        0x805a32a4  5           NtCreatePort                                        
0x31        0x805bd684  8           NtCreateProcess                                    
0x32        0x8058efe3  9           NtCreateProcessEx                                  
0x33        0x806685b7  9           NtCreateProfile                                    
0x34        0x80573eca  7           NtCreateSection                                    
0x35        0x8059afa9  5           NtCreateSemaphore                                  
0x36        0x805ab548  4           NtCreateSymbolicLinkObject                          
0x37        0x80588254  8           NtCreateThread                                      
0x38        0x805a2688  4           NtCreateTimer                                      
0x39        0x805a62a4  d           NtCreateToken                                      
0x3a        0x805bc212  5           NtCreateWaitablePort                                
0x3b        0x805b12c1  2           NtDebugActiveProcess                                
0x3c        0x805b17dc  3           NtDebugContinue                                    
0x3d        0x80574c08  2           NtDelayExecution                                    
0x3e        0x8059ab90  1           NtDeleteAtom                                        
0x41        0x805b7979  1           NtDeleteFile                                        
0x42        0x805eca87  1           NtDeleteKey                                        
0x43        0x8065aa3a  3           NtDeleteObjectAuditAlarm                            
0x44        0x805a20d4  2           NtDeleteValueKey                                    
0x45        0x80586f5e  a           NtDeviceIoControlFile                              
0x46        0x805c9f0b  1           NtDisplayString                                    
0x47        0x8058051e  7           NtDuplicateObject                                  
0x48        0x8059cc7c  6           NtDuplicateToken                                    
0x4b        0x8059a085  6           NtEnumerateKey                                      
0x4c        0x80667a42  3           NtEnumerateSystemEnvironmentValuesEx                
0x4d        0x8059d849  6           NtEnumerateValueKey                                
0x4e        0x805ac037  2           NtExtendSection                                    
0x4f        0x805e41d5  6           NtFilterToken                                      
0x50        0x8059e01a  3           NtFindAtom                                          
0x51        0x805920a7  2           NtFlushBuffersFile                                  
0x52        0x8058a8b5  3           NtFlushInstructionCache                            
0x53        0x805e715b  1           NtFlushKey                                          
0x54        0x805a130d  4           NtFlushVirtualMemory                                
0x55        0x80648b20  0           NtFlushWriteBuffer                                  
0x56        0x8064852a  3           NtFreeUserPhysicalPages                            
0x57        0x8057b2bf  4           NtFreeVirtualMemory                                
0x58        0x8057f504  a           NtFsControlFile                                    
0x59        0x805e8674  2           NtGetContextThread                                  
0x5a        0x8064de05  2           NtGetDevicePowerState                              
0x5b        0x805e8ccb  4           NtGetPlugPlayEvent                                  
0x5c        0x80544ec4  7           NtGetWriteWatch                                    
0x5d        0x805f12e2  1           NtImpersonateAnonymousToken                        
0x5e        0x80597fdf  2           NtImpersonateClientOfPort                          
0x5f        0x8059b9c8  3           NtImpersonateThread                                
0x60        0x805b77c8  1           NtInitializeRegistry                                
0x61        0x8064dc59  4           NtInitiatePowerAction                              
0x62        0x8058ec31  2           NtIsProcessInJob                                    
0x63        0x8064ddf2  0           NtIsSystemResumeAutomatic                          
0x64        0x805bc19c  2           NtListenPort                                        
0x65        0x805b9dfe  1           NtLoadDriver                                        
0x66        0x805b2d8f  2           NtLoadKey                                          
0x67        0x8062758c  3           NtLoadKey2                                          
0x68        0x805b4a6c  4           NtLoadKeyEx                                        
0x69        0x805a2342  a           NtLockFile                                          
0x6a        0x805e4eaa  2           NtLockProductActivationKeys                        
0x6b        0x805de064  1           NtLockRegistryKey                                  
0x6c        0x805e4a65  4           NtLockVirtualMemory                                
0x6d        0x805ab8ba  1           NtMakePermanentObject                              
0x6e        0x805abb05  1           NtMakeTemporaryObject                              
0x6f        0x80647392  3           NtMapUserPhysicalPages                              
0x70        0x80647859  3           NtMapUserPhysicalPagesScatter                      
0x71        0x80589905  a           NtMapViewOfSection                                  
0x74        0x805ef59d  9           NtNotifyChangeDirectoryFile                        
0x75        0x80599f1c  a           NtNotifyChangeKey                                  
0x76        0x80599d2d  c           NtNotifyChangeMultipleKeys                          
0x77        0x8058ef66  3           NtOpenDirectoryObject                              
0x78        0x80599615  3           NtOpenEvent                                        
0x79        0x806680f4  3           NtOpenEventPair                                    
0x7a        0x8057909d  6           NtOpenFile                                          
0x7b        0x80634e03  3           NtOpenIoCompletion                                  
0x7c        0x805af8b0  3           NtOpenJobObject                                    
0x7d        0x80578d88  3           NtOpenKey                                          
0x7e        0x80586508  3           NtOpenMutant                                        
0x7f        0x805ed885  c           NtOpenObjectAuditAlarm                              
0x80        0x80593613  4           NtOpenProcess                                      
0x81        0x8057e110  3           NtOpenProcessToken                                  
0x82        0x8057e816  4           NtOpenProcessTokenEx                                
0x83        0x8058a94b  3           NtOpenSection                                      
0x84        0x805b3152  3           NtOpenSemaphore                                    
0x85        0x8058ea10  3           NtOpenSymbolicLinkObject                            
0x86        0x805a2a8c  4           NtOpenThread                                        
0x87        0x8057f976  4           NtOpenThreadToken                                  
0x88        0x8057f8e5  5           NtOpenThreadTokenEx                                
0x89        0x805eb40f  3           NtOpenTimer                                        
0x8a        0x805a24a2  3           NtPlugPlayControl                                  
0x8b        0x805ae364  5           NtPowerInformation                                  
0x8c        0x805a2c28  3           NtPrivilegeCheck                                    
0x8d        0x805e48ce  6           NtPrivilegeObjectAuditAlarm                        
0x8e        0x805a7bf0  5           NtPrivilegedServiceAuditAlarm                      
0x8f        0x80584a67  5           NtProtectVirtualMemory                              
0x90        0x8059f752  2           NtPulseEvent                                        
0x91        0x80585755  2           NtQueryAttributesFile                              
0x94        0x80508c75  2           NtQueryDebugFilterState                            
0x95        0x8057ffd5  2           NtQueryDefaultLocale                                
0x96        0x80587c53  1           NtQueryDefaultUILanguage                            
0x97        0x8058731c  b           NtQueryDirectoryFile                                
0x98        0x80595d65  7           NtQueryDirectoryObject                              
0x9a        0x80635410  9           NtQueryEaFile                                      
0x9b        0x805a2d89  5           NtQueryEvent                                        
0x9c        0x8059b735  2           NtQueryFullAttributesFile                          
0x9d        0x805edffe  5           NtQueryInformationAtom                              
0x9e        0x805852cf  5           NtQueryInformationFile                              
0x9f        0x805af5ab  5           NtQueryInformationJobObject                        
0xa0        0x80644a66  5           NtQueryInformationPort                              
0xa1        0x8057fdea  5           NtQueryInformationProcess                          
0xa2        0x80576dc6  5           NtQueryInformationThread                            
0xa3        0x8057e718  5           NtQueryInformationToken                            
0xa4        0x8059d58c  1           NtQueryInstallUILanguage                            
0xa5        0x80668a4e  2           NtQueryIntervalProfile                              
0xa6        0x80634ebc  5           NtQueryIoCompletion                                
0xa7        0x80580c31  5           NtQueryKey                                          
0xa8        0x80626765  6           NtQueryMultipleValueKey                            
0xa9        0x80668412  5           NtQueryMutant                                      
0xaa        0x805f1cad  5           NtQueryObject                                      
0xab        0x80626953  2           NtQueryOpenSubKeys                                  
0xac        0x80626b89  4           NtQueryOpenSubKeysEx                                
0xad        0x8057f59e  2           NtQueryPerformanceCounter                          
0xae        0x80635c9d  9           NtQueryQuotaInformationFile                        
0xaf        0x8058679a  5           NtQuerySection                                      
0xb0        0x805997e7  5           NtQuerySecurityObject                              
0xb1        0x80667325  5           NtQuerySemaphore                                    
0xb2        0x8058e816  3           NtQuerySymbolicLinkObject                          
0xb3        0x80667a76  4           NtQuerySystemEnvironmentValue                      
0xb5        0x8057cbe2  4           NtQuerySystemInformation                            
0xb6        0x80597e57  1           NtQuerySystemTime                                  
0xb7        0x8058c677  5           NtQueryTimer                                        
0xb8        0x8059e436  3           NtQueryTimerResolution                              
0xb9        0x80577d61  6           NtQueryValueKey                                    
0xba        0x80582264  6           NtQueryVirtualMemory                                
0xbb        0x8057960d  5           NtQueryVolumeInformationFile                        
0xbc        0x8058c78e  5           NtQueueApcThread                                    
0xbd        0x804eb198  3           NtRaiseException                                    
0xbe        0x80667075  6           NtRaiseHardError                                    
0xbf        0x8057d886  9           NtReadFile                                          
0xc0        0x805aeb82  9           NtReadFileScatter                                  
0xc1        0x8059859d  6           NtReadRequestData                                  
0xc2        0x805861e0  5           NtReadVirtualMemory                                
0xc3        0x80588402  1           NtRegisterThreadTerminatePort                      
0xc4        0x80574b77  2           NtReleaseMutant                                    
0xc5        0x80598eb5  3           NtReleaseSemaphore                                  
0xc6        0x80577945  5           NtRemoveIoCompletion                                
0xc7        0x8066e462  2           NtRemoveProcessDebug                                
0xc8        0x80626dec  2           NtRenameKey                                        
0xc9        0x8062748f  3           NtReplaceKey                                        
0xca        0x80580e50  2           NtReplyPort                                        
0xcb        0x8057b2a0  4           NtReplyWaitReceivePort                              
0xcc        0x8057adb0  5           NtReplyWaitReceivePortEx                            
0xcd        0x80644b39  2           NtReplyWaitReplyPort                                
0xce        0x80667a4f  1           NtModifyDriverEntry                                
0xcf        0x805985f2  2           NtRequestPort                                      
0xd0        0x8058cbc3  3           NtRequestWaitReplyPort                              
0xd1        0x8064dc04  1           NtRequestWakeupLatency                              
0xd2        0x805a4751  2           NtResetEvent                                        
0xd3        0x8054543e  3           NtResetWriteWatch                                  
0xd4        0x80627286  3           NtRestoreKey                                        
0xd5        0x80650ff5  1           NtResumeProcess                                    
0xd6        0x805806fa  2           NtResumeThread                                      
0xd7        0x80627325  2           NtSaveKey                                          
0xd8        0x806273b2  3           NtSaveKeyEx                                        
0xd9        0x80625f0d  3           NtSaveMergedKeys                                    
0xda        0x8058d4b2  9           NtSecureConnectPort                                
0xdd        0x805b16f1  2           NtSetContextThread                                  
0xde        0x8066e4f1  3           NtSetDebugFilterState                              
0xdf        0x805ca1ac  1           NtSetDefaultHardErrorPort                          
0xe0        0x805b748b  2           NtSetDefaultLocale                                  
0xe1        0x805b7433  1           NtSetDefaultUILanguage                              
0xe2        0x80667a5c  2           NtSetBootEntryOrder                                
0xe3        0x8063594e  4           NtSetEaFile                                        
0xe4        0x8057abd7  2           NtSetEvent                                          
0xe5        0x80575690  1           NtSetEventBoostPriority                            
0xe6        0x806683b0  1           NtSetHighEventPair                                  
0xe7        0x806682e6  1           NtSetHighWaitLowEventPair                          
0xe8        0x8066e255  5           NtSetInformationDebugObject                        
0xe9        0x80578747  5           NtSetInformationFile                                
0xea        0x805e0b5f  4           NtSetInformationJobObject                          
0xeb        0x80626400  4           NtSetInformationKey                                
0xec        0x8059223e  4           NtSetInformationObject                              
0xed        0x80580221  4           NtSetInformationProcess                            
0xee        0x80577629  4           NtSetInformationThread                              
0xef        0x805a6844  4           NtSetInformationToken                              
0xf0        0x806685a0  2           NtSetIntervalProfile                                
0xf1        0x8057c39a  5           NtSetIoCompletion                                  
0xf2        0x806508db  6           NtSetLdtEntries                                    
0xf3        0x8066834f  1           NtSetLowEventPair                                  
0xf4        0x8066827d  1           NtSetLowWaitHighEventPair                          
0xf5        0x80635c7e  4           NtSetQuotaInformationFile                          
0xf6        0x805a5626  3           NtSetSecurityObject                                
0xf7        0x80667d39  2           NtSetSystemEnvironmentValue                        
0xf8        0x80667a35  5           NtSetSystemEnvironmentValueEx                      
0xf9        0x80597238  3           NtSetSystemInformation                              
0xfa        0x8067b325  3           NtSetSystemPowerState                              
0xfb        0x8066697b  2           NtSetSystemTime                                    
0xfc        0x805abc19  2           NtSetThreadExecutionState                          
0xfd        0x804ee9bf  7           NtSetTimer                                          
0xfe        0x805acb3b  3           NtSetTimerResolution                                
0xff        0x805bc73c  1           NtSetUuidSeed                                      
0x100       0x80592859  6           NtSetValueKey                                      
0x101       0x806361ed  5           NtSetVolumeInformationFile                          
0x102       0x8066614b  1           NtShutdownSystem                                    
0x103       0x80546d9e  4           NtSignalAndWaitForSingleObject                      
0x104       0x806687ec  1           NtStartProfile                                      
0x105       0x80668999  1           NtStopProfile                                      
0x106       0x80650fa0  1           NtSuspendProcess                                    
0x107       0x805b0163  2           NtSuspendThread                                    
0x108       0x80668af2  6           NtSystemDebugControl                                
0x109       0x80651a9b  2           NtTerminateJobObject                                
0x10a       0x80590cba  2           NtTerminateProcess                                  
0x10b       0x80576714  2           NtTerminateThread                                  
0x10c       0x8057e4f8  0           NtTestAlert                                        
0x10d       0x8051ed5e  4           NtTraceEvent                                        
0x10e       0x80667a69  4           NtTranslateFilePath                                
0x10f       0x806383c5  1           NtUnloadDriver                                      
0x110       0x8062747c  1           NtUnloadKey                                        
0x111       0x80625fc6  2           NtUnloadKey2                                        
0x112       0x806261cb  2           NtUnloadKeyEx                                      
0x113       0x805a220b  5           NtUnlockFile                                        
0x114       0x805ae977  4           NtUnlockVirtualMemory                              
0x115       0x80589e79  2           NtUnmapViewOfSection                                
0x116       0x805c5aa2  2           NtVdmControl                                        
0x117       0x805b07c8  4           NtWaitForDebugEvent                                
0x118       0x80574d38  5           NtWaitForMultipleObjects                            
0x119       0x8057428d  3           NtWaitForSingleObject                              
0x11a       0x8066821c  1           NtWaitHighEventPair                                
0x11b       0x806681bb  1           NtWaitLowEventPair                                  
0x11c       0x80578248  9           NtWriteFile                                        
0x11d       0x805aefe1  9           NtWriteFileGather                                  
0x11e       0x805990a6  6           NtWriteRequestData                                  
0x11f       0x805862d7  5           NtWriteVirtualMemory                                
0x120       0x805091c1  0           NtYieldExecution                                    
0x121       0x805d7d7f  4           NtCreateKeyedEvent                                  
0x122       0x8058f5cf  3           NtOpenKeyedEvent                                    
0x123       0x8066922f  4           NtReleaseKeyedEvent                                
0x124       0x806694aa  4           NtWaitForKeyedEvent                                
0x125       0x8064f170  0           NtQueryPortInformationProcess                      
0x126       0x8064f1a4  0           NtGetCurrentProcessorNumber    

参考资料：
1.MSDN系列(3)--Administrator用户直接获取SYSTEM权限  scz
     http://www.nsfocus.net/index.php?act=magazine&do=view&mid=1900

2.hooking functions not exported by ntoskrnl
     http://www.rootkit.com/newsread.php?newsid=151

3.Simple Hooking of Functions not Exported by Ntoskrnl.exe
     http://www.rootkit.com/newsread.php?newsid=248