[内核编程] 4.5 HOOK分发函数

//这个数组用来保存所有旧的指针
ULONG i;
PDRIVER_DISPATH OldDispatchFunctions[IRP_MJ_MAXIMUM_FUNCTION + ]; ... ... //把所有的分发函数指针都替换成我们自己编写的同一个分发函数
for( i=; i <= IRP_MJ_MAXIMUM_FUNCTION; ++I)
{
//假设MyFilterDipatch是作者已经写好的一个分发函数
OldDispatchFunction[i] = KbdDriverObject->MajorFunction[i];
//进行原子交换操作
InterlockedExchangePointer(
&KbdDriverObject->Majorfunction[i],
MyFilterDipatch);
}

PVOID addrss;
size_t KbdDriverStart = KbdDriverObject->DriverStart;
size_t KbdDriverSize = KbdDriverObject->DriverSize;...if( (addrss > KbdDriverStart) && (addrss < (PBYTE)KbdDriverStart + KbdDriverSize) )
{
//说明在这个驱动中
}

//键盘类驱动的名字
#define KBD_DRIVER_NAME L"\\Driver\\kbdclass"
//USB键盘端口驱动名
#define USBKBD_DRIVER_NAME L"\\Driver\\kbdhid"
//PS/2键盘驱动名
#define PS2KBD_DRIVER_NAME L"\\Driver\\i8042prt"

typedef VOID
(_stdcall *KEYBOARDCLASSSERVICECALLBACK)(
IN PDEVICE_OBJECT DeviceObject,
IN PKEYBOARD_INPUT_DATA InputDataStar,
IN PKEYBOARD_INPUT_DATA InputDataEnd,
IN OUT PULONG InputDataConsumed);

typedef struct _KBD_CALLBACK
{
PDEVICE_OBJECT classDeviceObject;//类驱动生成的一个设备对象
KEYBOARDCLASSSERVICECALLBACK serviceCallBack;//回调函数
}KBD_CALLBACK,*PKBD_CALLBACK;
KBD_CALLBACK gKbdCallBack = {};

NTSTATUS
SearchServiceCallBack(
IN PDRIVER_OBJECT DriverObject
)
{
//定义用到的一组局部变量。这些变量大多是顾名思义的
NTSTATUS status = STATUS_UNSUCCESSFUL;
int i = ;
UNICODE_STRING uniNtNameString;
PDEVICE_OBJECT pTargetDeviceObject = NULL;
PDRIVER_OBJECT KbdDriverObject = NULL;
PDRIVER_OBJECT KbdhidDriverObject = NULL;
PDRIVER_OBJECT Kbd8042DriverObject = NULL;
PDRIVER_OBJECT UsingDriverObject = NULL;
PDEVICE_OBJECT UsingDeviceObject = NULL;
PVOID KbdDriverStart = NULL;
ULONG KbdDriverSize = NULL;
PVOID UsingDeviceExt = NULL; //这里的代码用来打开USB键盘端口驱动的驱动对象
RtlInitUnicodeString(&uniNtNameString,USBKBD_DRIVER_NAME);
status = ObReferenceObjectByName(
&uniNtNameString,
OBJ_CASE_INSENSITIVE,
NULL,
,
IoDriverObjectType,
KernelMode,
NULL,
&KbdhidDriverObject
);
if( !NT_SUCCESS(status) )
{
DbgPrint(("Couldn't get the USB driver Object\n"));
}
else
{
ObDereferenceObject(KbdhidDriverObject);
DbgPrint("get the USB driver Object\n");
} //打开PS/2键盘的驱动对象
RtlInitUnicodeString(&uniNtNameString,PS2KBD_DRIVER_NAME);
status = ObReferenceObjectByName(
&uniNtNameString,
OBJ_CASE_INSENSITIVE,
NULL,
,
IoDriverObjectType,
KernelMode,
NULL,
&Kbd8042DriverObject
);
if( !NT_SUCCESS(status))
{
DbgPrint(("Couldn't get the PS/2 driver Object\n"));
}
else
{
ObDereferenceObject(Kbd8042DriverObject);
DbgPrint("get the PS/2 driver Object");
} //这段代码只考虑有一个键盘起作用的情况。如果USB键盘和PS/2键盘
//同时存在，则直接返回失败即可
if( Kbd8042DriverObject && KbdhidDriverObject)
{
DbgPrint("more than two kbd!\n");
} //找到合适的驱动对象。不管是USB还是PS/2，反正是一定要找到一个的
UsingDriverObject = Kbd8042DriverObject ? Kbd8042DriverObject : KbdhidDriverObject;
//找到这个驱动对象下的第一个设备对象
UsingDeviceObject = UsingDriverObject->DeviceObject;
//找到这个设备对象的设备扩展
UsingDeviceExt = UsingDeviceObject->DeviceExtension; //至此，已经把设备扩展的地址放到UsingDeviceExt里面了。根据前面的预测，这里
//面应该有一个函数指针，其地址是在驱动Kbdclass中的，找到它我们就成功了 //首先必须打开驱动KbdClass，以便从驱动对象中得到其开始地址和大小
RtlInitUnicodeString(&uniNtNameString,KBD_DRIVER_NAME);
status = ObReferenceObjectByName(
&uniNtNameString,
OBJ_CASE_INSENSITIVE,
NULL,
,
IoDriverObjectType,
KernelMode,
NULL,
&KbdDriverObject
);
if( !NT_SUCCESS(status))
{
//如果没有成功，就直接返回失败即可
DbgPrint(("MyAttach: Couldn't get the kbd driver Object\n"));
return STATUS_UNSUCCESSFUL;
}
else
{
ObDereferenceObject(KbdDriverObject);
//如果成功了，就找到了KbdClass的开始地址和大小
KbdDriverStart = KbdDriverObject->DriverStart;
KbdDriverSize = KbdDriverObject->DriverSize; } //下面就是搜索过程 //遍历KbdDriverObject下的设备对象
pTargetDeviceObject = KbdDriverObject->DeviceObject;
PBYTE DeviceExt;
PVOID *AddrServiceCallBack;
while(pTargetDeviceObject)
{
DeviceExt = (PBYTE)UsingDeviceExt;
//遍历我们先找到的端口驱动的设备扩展下的每一个指针
for(; i<; i++,DeviceExt+=sizeof(PBYTE))
{
PVOID tmp;
if(!MmIsAddressValid(DeviceExt))
{
break;
} //找到后悔填写到这个全局变量中。这里检测是否已经填好了
//如果已经填好了就不用继续找，可以直接跳出了
if(gKbdCallBack.classDeviceObject && gKbdCallBack.serviceCallBack)
{
status = STATUS_SUCCESS;
break;
} //在端口驱动的设备扩展中，找到了类驱动的设备对象，填好类驱动
//设备对象后继
tmp = *(PVOID*)DeviceExt;
if(tmp == pTargetDeviceObject)
{
gKbdCallBack.classDeviceObject = (PDEVICE_OBJECT)tmp;
DbgPrint("classDeviceObject %8x\n",tmp);
continue;
} //如果在设备扩展中找到一个地址位于KbdClass这个驱动中，就可以认为
//这就是我们要找的回调函数地址
if(
(tmp > KbdDriverStart) &&
(tmp < (PBYTE)KbdDriverStart+KbdDriverSize)&&
MmIsAddressValid(tmp)
)
{
//将这个回调函数记录下来
gKbdCallBack.serviceCallBack = (KEYBOARDCLASSSERVICECALLBACK)tmp;
AddrServiceCallBack = (PVOID*)DeviceExt;
DbgPrint(("serviceCallBack :%8x AddrServiceCallBack: %8x\n",tmp,AddrServiceCallBack));
} }
//换成下一个设备，继续遍历
pTargetDeviceObject = pTargetDeviceObject->NextDevice;
} //如果成功地找好了，就把这个函数替换成我们自己的回调函数
//之后的过滤就可以自己想做什么就做什么了
if (AddrServiceCallBack && gKbdCallBack.serviceCallBack)
{
DbgPrint(("Hook KeyboardClassServiceCallback\n"));
*AddrServiceCallBack = MyKeyboardClassServiceCallback;
} //这个函数到这里就结束了
return status;
}//值得注意的是，这些到吗只是研究性代码，不适合作为商业代码使用，因为里面使用了未公开的数据结构。

extern POBJECT_TYPE IoDriverObjectType;
typedef unsigned char BYTE;
typedef BYTE * PBYTE;
// 这个函数是事实存在的，只是文档中没有公开。声明一下
// 就可以直接使用了。
NTSTATUS
ObReferenceObjectByName(
PUNICODE_STRING ObjectName,
ULONG Attributes,
PACCESS_STATE AccessState,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID ParseContext,
PVOID *Object
);