在windbg中测试shadow ssdt , win32k!NtUserGetForegroundWindow , hook shadow ssdt

在windbg中查看shadow ssdt：

0: kd> lm
start    end        module name
804d8000 806e3000   nt         (pdb symbols)          I:\Symbols\ntkrpamp.pdb\966DF78E558F483199141B029DF5A9D51\ntkrpamp.pdb

Unloaded modules:
f56ab000 f56d6000   kmixer.sys
f7b59000 f7b5a000   drmkaud.sys
f6fc8000 f6fd5000   DMusic.sys
f7018000 f7026000   swmidi.sys
f56d6000 f56f9000   aec.sys 
f7ad9000 f7adb000   splitter.sys
f70dd000 f70e0000   wmiacpi.sys
f79fb000 f79ff000   kbdhid.sys
f78cf000 f78d4000   Cdaudio.SYS
f79ef000 f79f2000   Sfloppy.SYS
0: kd> x win32k!*      win32k.sys的symbol文件没有被载入，此时无法查看win32k.sys的内容 。
               ^ Couldn't resolve 'x win32k'
0: kd> uf win32k!NtUserGetForegroundWindow
Couldn't resolve error at 'win32k!NtUserGetForegroundWindow '
0: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 861b5660 SessionId: none Cid: 0004    Peb: 00000000 ParentCid: 0000
    DirBase: 069c0020 ObjectTable: e1003e40 HandleCount: 255.
    Image: System

PROCESS 85c99298 SessionId: none Cid: 0220    Peb: 7ffde000 ParentCid: 0004
    DirBase: 069c0040 ObjectTable: e1366228 HandleCount: 21.
    Image: smss.exe

PROCESS 85f92ca8 SessionId: 0 Cid: 025c    Peb: 7ffde000 ParentCid: 0220
    DirBase: 069c0060 ObjectTable: e13bfd50 HandleCount: 368.
    Image: csrss.exe
......

PROCESS 85b61020 SessionId: 0 Cid: 0794    Peb: 7ffdd000 ParentCid: 02a0
    DirBase: 069c0280 ObjectTable: e184ce98 HandleCount: 63.
    Image: VMwareService.exe

PROCESS  85c9ab38  SessionId: 0 Cid: 06cc    Peb: 7ffd4000 ParentCid: 060c
    DirBase: 069c01c0 ObjectTable: e1043768 HandleCount: 49.
    Image:  notepad.exe


0: kd> .process 85c9ab38 
Implicit process is now 85c9ab38
WARNING: .cache forcedecodeuser is not enabled
0: kd> .reload     重新载入符号
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE
Loading Kernel Symbols
........................................................................................................................
Loading User Symbols
............................
Loading unloaded module list
..........
0: kd> x win32k!*      现在可以查看shadow ssdt了
bf9346be win32k!EngQueryLocalTime =
bf938572 win32k!NtGdiCreateEllipticRgn =
bf9ab110 win32k!ghwndSwitch =
bf9248f9 win32k!SearchAndSetKbdTbl =
bf92602a win32k!xxxUnlatchStickyKeys =
bf814d93 win32k!NtUserInvalidateRect =
bf98c678 win32k!_imp__IoGetStackLimits =
bf944f4a win32k!vTransparentCopyS32D8 =
bf8778da win32k!xxxMoveThumb =
bf85ef37 win32k!KillTooltipTimer =
bf8d3308 win32k!fsg_CompositeInnerGridFit =
bf98c49c win32k!_imp__RtlSetOwnerSecurityDescriptor =
bf8687ef win32k!bCalcMeshExtent =
bf842cf7 win32k!xxxClientLoadMenu =
bf8a1307 win32k!ParkIcon =
......


uf一个函数试试：

0: kd> uf win32k!NtUserGetForegroundWindow     （win32k!NtUserGetForegroundWindow是win32 api GetForegroundWindow()的内核实现 ）
win32k!NtUserGetForegroundWindow:
bf823d3d 8bff            mov     edi,edi
bf823d3f 56              push    esi
bf823d40 e8a4cefdff      call    win32k!EnterSharedCrit (bf800be9)
bf823d45 a160b59abf      mov     eax,dword ptr [win32k!gpqForeground (bf9ab560)]
bf823d4a 85c0            test    eax,eax
bf823d4c 7429            je      win32k!NtUserGetForegroundWindow+0x33 (bf823d77)

win32k!NtUserGetForegroundWindow+0x11:
bf823d4e 83782800        cmp     dword ptr [eax+28h],0
bf823d52 7423            je      win32k!NtUserGetForegroundWindow+0x33 (bf823d77)

win32k!NtUserGetForegroundWindow+0x17:
bf823d54 8b7028          mov     esi,dword ptr [eax+28h]
bf823d57 ff1560c298bf    call    dword ptr [win32k!_imp__PsGetCurrentThread (bf98c260)]
bf823d5d 50              push    eax
bf823d5e ff15f8c798bf    call    dword ptr [win32k!_imp__PsGetThreadWin32Thread (bf98c7f8)]
bf823d64 8b403c          mov     eax,dword ptr [eax+3Ch]
bf823d67 3b460c          cmp     eax,dword ptr [esi+0Ch]
bf823d6a 750b            jne     win32k!NtUserGetForegroundWindow+0x33 (bf823d77)
PVOID
PsGetThreadWin32Thread(
    __in PETHREAD Thread
     )
{
    return Thread->Tcb.Win32Thread;
}

PW32THREAD W32Thread;
PETHREAD PEThread = PsGetCurrentThread(); 
W32Thread = PsGetThreadWin32Thread(PEThread);
//不知道W32Thread和W32Thread->3Ch是什么结构
/*
0: kd> dt _W32THREAD
win32k!_W32THREAD
   +0x000 pEThread         : Ptr32 _ETHREAD
   +0x004 RefCount         : Uint4B
   +0x008 ptlW32           : Ptr32 _TL
   +0x00c pgdiDcattr       : Ptr32 Void
   +0x010 pgdiBrushAttr    : Ptr32 Void
   +0x014 pUMPDObjs        : Ptr32 Void
   +0x018 pUMPDHeap        : Ptr32 Void
   +0x01c dwEngAcquireCount : Uint4B
   +0x020 pSemTable        : Ptr32 Void
   +0x024 pUMPDObj         : Ptr32 Void
3Ch是什么？
*/
if( W32Thread->3Ch != [   [win32k!gpqForeground]+28h +0Ch ] ){
return 0; //hwnd=0
}  
win32k!NtUserGetForegroundWindow+0x2f:
bf823d6c 8b36            mov     esi,dword ptr [esi]

win32k!NtUserGetForegroundWindow+0x35:
bf823d6e e8a3cdfdff      call    win32k!LeaveCrit (bf800b16)
bf823d73 8bc6            mov     eax,esi
bf823d75 5e              pop     esi
bf823d76 c3              ret

win32k!NtUserGetForegroundWindow+0x33:
bf823d77 33f6            xor     esi,esi
bf823d79 ebf3            jmp     win32k!NtUserGetForegroundWindow+0x35 (bf823d6e)



可以看到win32k!NtUserGetForegroundWindow()返回的值其实是 [   [win32k!gpqForeground]+28h ]，我们在windbg就可以查看这个值：

0: kd> dd poi(poi(win32k!gpqForeground) +28h)
bc6542b0  00030100  00000009 e24102c8 85c4d480
bc6542c0 bc6542b0 40020049 80000300 00000910
bc6542d0 14cf0000 01000000 00000000 bc66d800
bc6542e0 bc66e010 bc6506e8 bc66e820 00000000
bc6542f0 00000041 00000045 00000299 000001d9
bc654300 00000045 00000077 00000295 000001d5
bc654310 01003429 bc654230 00000000 bc66e1c8
bc654320 00000000 00000000 bc654478 03040587

其中00030100 便是win32k!NtUserGetForegroundWindow()的返回值。
在驱动中可以这样实现：  

ULONG ASM_GetForeground(){

    //win32k.sys不常驻内存，调用它的函数前一定要先载入gui进程
    KeAttachProcess(crsEProc);
    DbgPrint("==hwnd:%x \n",g_OriginalNtUserGetForegroundWindow());//
    __asm{
        ;call    win32k!EnterSharedCrit (bf800be9)
        ;mov        eax,0bf800be9h 
        ;call    eax
        
        mov     eax,0bf9ab560h        ;win32k!gpqForeground.我用的是硬编码
        mov     eax,dword ptr [eax]
        test    eax,eax
        je      _failed

        cmp     dword ptr [eax+28h],0
        je      _failed

        mov     esi,dword ptr [eax+28h]
        mov        esi,[esi]
        jmp        _end

_failed:
        mov        esi,0
_end:
        ;call    win32k!LeaveCrit (bf800b16)
        ;mov        eax,0bf800b16h
        ;call    eax

        call KeDetachProcess

        mov        eax,esi
    }
}



------------------------------------------------------

尝试一下下断点

0: kd> bu win32k!_imp__PsGetThreadWin32Thread
WARNING: Software breakpoints on session addresses can cause bugchecks.
Use hardware execution breakpoints (ba e) if possible.
0: kd> bc *
0: kd> ba e1 win32k!_imp__PsGetThreadWin32Thread  必须下硬件断点，否则会导致异常！
0: kd> bl
0 e bf98c7f8 e 1 0001 (0001) win32k!_imp__PsGetThreadWin32Thread

至此下断点成功

------------------------------------------------------

最后是测试hook shadow ssdt 。 《Hook Shadow SSDT》 里面有参考代码.我测试了一下添加对NtUserInternalGetWindowText()的hook：

if ( majorVersion == 5 && minorVersion == 1 )
    {
    DbgPrint("comint32: Running on Windows XP\n");
      NtUserFindWindowEx_callnumber = 0x17A;
    NtUserGetForegroundWindow_callnumber = 0x194;
    NtUserBuildHwndList_callnumber = 0x138;
    NtUserQueryWindow_callnumber = 0x1E3;
    NtUserWindowFromPoint_callnumber = 0x250;
    NtUserInternalGetWindowText_callnumber = 0x1c1;

    }

INT MyNtUserInternalGetWindowText(
                                IN HWND hwnd,
                                OUT LPWSTR lpString,
                                IN int nMaxCount){
    INT result;
    result=g_OriginalNtUserInternalGetWindowText(hwnd,lpString,nMaxCount);
    DbgPrint("MyNtUserInternalGetWindowText() hwnd:%x, lpString:%x-\"%S\", %d, %d\n",hwnd,lpString,lpString,nMaxCount,result);
    return result;
}

参考：
《shadow ssdt学习笔记(一)(二)》 http://bbs.pediy.com/showthread.php?t=56955
《Hook Shadow SSDT》  http://bbs.pediy.com/showthread.php?t=65931

转载于:https://www.cnblogs.com/marryZhan/archive/2012/06/27/2797290.html