#include<ntifs.h>

//Windows7 sp1

//PAGE:00000001403532EC                                         ; NTSTATUS __stdcall NtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
//PAGE:00000001403532EC                                         public NtOpenProcess
//PAGE : 00000001403532EC                                         NtOpenProcess proc near
//PAGE : 00000001403532EC
//PAGE : 00000001403532EC                                         var_18 = byte ptr - 18h
//PAGE : 00000001403532EC                                         PreviousMode = byte ptr - 10h
//PAGE : 00000001403532EC
//PAGE : 00000001403532EC 000 48 83 EC 38                         sub     rsp, 38h
//PAGE : 00000001403532F0 038 65 48 8B 04 25 88 01 00 00          mov     rax, gs:188h
//PAGE : 00000001403532F9 038 44 8A 90 F6 01 00 00                mov     r10b, [rax + 1F6h]
//PAGE:0000000140353300 038 44 88 54 24 28                      mov[rsp + 38h + PreviousMode], r10b; PreviousMode
//PAGE : 0000000140353305 038 44 88 54 24 20                      mov[rsp + 38h + var_18], r10b; char
//PAGE : 000000014035330A 038 E8 51 FC FF FF                      call    PsOpenProcess
//PAGE : 000000014035330F 038 48 83 C4 38                         add     rsp, 38h
//PAGE : 0000000140353313 000 C3                                  retn

//00007FF9959406C0 | 48:B8 2222222211111111                 | mov rax,1111111122222222                                    |
//00007FF9959406CA | FFE0 | jmp rax |

//00007FF95BB10935 | FF25 00000000 | jmp qword ptr ds : [7FF95BB1093B] |
//00007FF95BB1093B | 1111 | adc dword ptr ds : [rcx] , edx |
//00007FF95BB1093D | 1111 | adc dword ptr ds : [rcx] , edx |
//00007FF95BB1093F | 1111 | adc dword ptr ds : [rcx] , edx |
//00007FF95BB10941 | 1111 | adc dword ptr ds : [rcx] , edx |

typedef NTSTATUS (*pNtOpenProcess)(
PHANDLE            ProcessHandle,
ACCESS_MASK        DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID         ClientId
);

PVOID pOldCode = NULL;

PULONG64 ReturnCode = NULL;

PVOID pApiAddr = NULL;

NTSTATUS MyNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);

KIRQLUpIRQL();

VOIDDownIRQL(KIRQL OldIrql);

VOIDRestoreCode();

VOIDDriverUnload(PDRIVER_OBJECT pDriverObject)
{
DbgPrint("UnLoad\n");
//恢复钩子
RestoreCode();
//释放创建的内存
ExFreePool(pOldCode, 0x100);

return;
}

NTSTATUSDriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath)
{
pDriverObject->DriverUnload = DriverUnload;

NTSTATUS status = STATUS_SUCCESS;

CHAR JmpCode[12] = { 0x48,0xB8,0x22,0x22,0x22,0x22,0x11,0x11,0x11,0x11,0xFF,0xE0 };

CHAR SpringBoard[14] = { 0xFF,0x25,0x00,0x00,0x00,0x00,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11};

UNICODE_STRING puApiName = { 0 };

KIRQL OldIrql = 0;

RtlInitUnicodeString(&puApiName, L"NtOpenProcess");
//获取函数地址
pApiAddr = MmGetSystemRoutineAddress(&puApiName);

if (pApiAddr == NULL) {
return STATUS_NOT_FOUND;
}

//构建shellcode
*((PULONG64)(JmpCode+2)) = (PULONG64)MyNtOpenProcess;

*((PULONG64)(SpringBoard + 6)) = (ULONG64)pApiAddr + 13;

pOldCode = ExAllocatePool(NonPagedPool, 0x100);

if (!pOldCode) {
DbgPrint("ExAllocatePool Failed!\n");
}
//进行旧数据保存
RtlZeroMemory(pOldCode, 0x100);

RtlCopyMemory(pOldCode, pApiAddr, 12);

//辅助跳板构建
RtlCopyMemory((PVOID)((ULONG64)pOldCode + 13), SpringBoard, sizeof(SpringBoard));

//提升中断权限
OldIrql = UpIRQL();
//Hook
RtlCopyMemory(pApiAddr, JmpCode, sizeof(JmpCode));

//降低中断权限
DownIRQL(OldIrql);

return status;
}

NTSTATUS MyNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId)
{
if (ClientId->UniqueProcess == 3628) 
{
DbgPrint("OpenProcess Pid:%d\n", ClientId->UniqueProcess);

return STATUS_ACCESS_DENIED;
}

pNtOpenProcess pFunc = pOldCode;

return pFunc(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}

//提升中断权限，防止被打断
//关闭写保护 操作Cr0标志位
//关中断 当前执行不被中断
KIRQL UpIRQL()
{
KIRQL OldIrql = KeRaiseIrqlToDpcLevel();

UINT64 cr0 = __readcr0();

cr0 &= 0xfffffffffffeffff;

__writecr0(cr0);

_disable();

return OldIrql;
}
//恢复中断短线
//打开写保护
//开中断
VOID DownIRQL(KIRQL OldIrql)
{
KeLowerIrql(OldIrql);

UINT64 cr0 = __readcr0();

cr0 |= 0x10000;

__writecr0(cr0);

_enable();

return;
}
VOIDRestoreCode() {

KIRQL OldIrql = UpIRQL();

RtlCopyMemory(pApiAddr, pOldCode, 12);

DownIRQL(OldIrql);
return;
}

typedef struct _KSERVICE_TABLE_DESCRIPTOR {
PULONG_PTR ServiceTableBase;//SSDT基址
PVOID ServiceCounterTableBase;//SSDT中服务被调用次数计数器
ULONG NumberOfService;//SSDT服务个数
PUCHAR ParamTableBase;
} KSERVICE_TABLE_DESCRIPTOR, * PKSERVICE_TABLE_DESCRIPTOR;

NTSTATUS FindSSDT() {
NTSTATUSstatus = STATUS_SUCCESS;
PUCHARpSystemCall = 0;
ULONGuCodeOffset = 0;
ULONGuFuncOffset = 0;
PULONGuFuncNum = 0;
DWORD dwNum = 2;
PKSERVICE_TABLE_DESCRIPTOR KeServiceDescriptorTable = NULL;
PULONG_PTR pBaseAddr = NULL;
ULONG64 pFuncAddr = NULL;


pSystemCall = (PUCHAR)__readmsr(0xC0000082);

//.text:FFFFF80003E98772                                         KiSystemServiceRepeat:                  ; CODE XREF: KiSystemCall64+47B↓j
//.text:FFFFF80003E98772 000 4C 8D 15 C7 20 23 00                lea     r10, KeServiceDescriptorTable
for (int i = 0; i < 1000; i++) {
if (*(pSystemCall + i) == 0x4c && *(pSystemCall + i + 1) == 0x8D && *(pSystemCall + i + 2) == 0x15) {
pSystemCall += i;
uCodeOffset = *((PULONG32)(pSystemCall + 3));
KeServiceDescriptorTable = (PKSERVICE_TABLE_DESCRIPTOR)((ULONG64)pSystemCall + 7 + uCodeOffset);

break;
}
}

pBaseAddr = KeServiceDescriptorTable->ServiceTableBase;
uFuncNum = (PULONG)pBaseAddr;
uFuncOffset = uFuncNum[dwNum] >> 4;
pFuncAddr = (ULONG64)pBaseAddr + uFuncOffset;

DbgPrint("Function Address: %p\n", pFuncAddr);

return status;
}

VOID EnumerateModule(HANDLE hPid)
{
    KAPC_STATE ks;
    PEPROCESS eproc = LookupProcess(hPid);
    if (eproc == NULL)
    {
        DbgPrint("Can't find the EPROCESS...\n");
        return;
    }
 
 
    __try
    {
        // Get the peb address, the PEB structure in the EPROCESS is a pointer to PEB, named PPEB.
        // So the "(ULONG64)eproc + PEB_OFFSET_IN_EPROCESS" is the address the pointer to PEB.
        // And finally, use the "*" to get the address to the PEB structure.
        ULONG64 peb = *(PULONG64)((ULONG64)eproc + PEB_OFFSET_IN_EPROCESS);
 
        KeStackAttachProcess(eproc, &ks);
 
 
        // The LDR structure in PEB is also a pointer to PEB_LDR_DATA
        // So, "(ULONG64)peb + LDR_OFFSET_IN_PEB" is the address of pointer to PEB_LDR_DATA.
        // And the ULONG64 ldr is finally get the address of PEB_LDR_DATA structure.
        ULONG64 ldr = *(PULONG64)((ULONG64)peb + LDR_OFFSET_IN_PEB);
 
        // Get the address of "InLoadOrderModuleList" which in the PEB_LDR_DATA structure.
        PLIST_ENTRY pListHead = (PLIST_ENTRY)(ldr + InLoadOrderModuleList_OFFSET);
        PLIST_ENTRY pMod = pListHead->Flink;
 
        while (pMod != pListHead)
        {
            DbgPrint("Base=%p, Size=%ld, Path=%wZ\n",
                (PVOID)(((PLDR_DATA_TABLE_ENTRY)pMod)->DllBase),
                (ULONG)(((PLDR_DATA_TABLE_ENTRY)pMod)->SizeOfImage),
                &(((PLDR_DATA_TABLE_ENTRY)pMod)->FullDllName));
            pMod = pMod->Flink;
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        DbgPrint("EXCEPTION_EXECUTE_HANDLER is occure...\n");
    }
    KeUnstackDetachProcess(&ks);
}

//Based on: http://alter.org.ua/docs/nt_kernel/procaddr
PVOIDUndocumented::GetKernelBase(PULONG pImageSize) {
typedef struct _SYSTEM_MODULE_ENTRY {
HANDLE Section;
PVOID MappedBase;
PVOID ImageBase;
ULONG ImageSize;
ULONG Flags;
USHORT LoadOrderIndex;
USHORT InitOrderIndex;
USHORT LoadCount;
USHORT OffsetToFileName;
UCHAR FullPathName[256];
} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;

#pragma warning(disable:4200)
typedef struct _SYSTEM_MODULE_INFORMATION {
ULONG Count;
SYSTEM_MODULE_ENTRY Module[0];
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;

PVOID pModuleBase = NULL;
NTSTATUSstatus = STATUS_SUCCESS;
ULONGSystemInfoBuffersize = 0;
PSYSTEM_MODULE_INFORMATION pSystemModuleInfo = NULL;

status = Undocumented::ZwQuerySystemInformation(SystemModuleInformation,
&SystemInfoBuffersize,
0,
&SystemInfoBuffersize);
if (!SystemInfoBuffersize) {
DbgPrint("[-]ZwQuerySystemInformation GetLengthError\n");
return NULL;
}

pSystemModuleInfo = (PSYSTEM_MODULE_INFORMATION)RtlAllocateMemory(true, SystemInfoBuffersize * 2);
if (!pSystemModuleInfo) {
DbgPrint("[-]RtlAllocateMemory SystemModuleInfoError\n");
return NULL;
}

status = Undocumented::ZwQuerySystemInformation(SystemModuleInformation,
pSystemModuleInfo,
SystemInfoBuffersize * 2,
&SystemInfoBuffersize);
if (NT_SUCCESS(status)) {
pModuleBase = pSystemModuleInfo->Module[0].ImageBase;
if (pImageSize)
*pImageSize = pSystemModuleInfo->Module[0].ImageSize;
}
else {
DbgPrint("[-]ZwQuerySystemInformation SystemModuleInfoError\n");
}

RtlFreeMemory(pSystemModuleInfo);

return pModuleBase;
}

PVOIDSSDT::NtMoudleTextFind() {
ULONGKernelSize;
ULONG_PTRKernelBase = (ULONG_PTR)Undocumented::GetKernelBase(&KernelSize);
if (KernelBase == 0 || KernelBase == 0)
return NULL;

//查找.text段
PIMAGE_NT_HEADERS pNtHeader = RtlImageNtHeader((PVOID)KernelBase);
PIMAGE_SECTION_HEADERpSection = IMAGE_FIRST_SECTION(pNtHeader);
PIMAGE_SECTION_HEADERpTextSetion = NULL;
for (ULONG i = 0; i < pNtHeader->FileHeader.NumberOfSections; i++) {
char SectionName[IMAGE_SIZEOF_SHORT_NAME + 1] = { 0 };
RtlCopyMemory(SectionName, pSection->Name, IMAGE_SIZEOF_SHORT_NAME);
SectionName[IMAGE_SIZEOF_SHORT_NAME] = '\0';
//判断text段名
if (strncmp(SectionName, ".text", sizeof(".text") - sizeof(char)) == 0) {
pTextSetion = pSection;
}
pSection++;
}

return pTextSetion;
}

PSSDTStruct SSDT::SSDTFind() {
staticPSSDTStruct pSSDT = NULL;
ULONGKernelSize;
ULONG_PTRKernelBase = (ULONG_PTR)Undocumented::GetKernelBase(&KernelSize);
if (KernelBase == 0 || KernelBase == 0)
return NULL;

//获取nt模块text段地址
PIMAGE_SECTION_HEADERpTextSetion = (PIMAGE_SECTION_HEADER)NtMoudleTextFind();
if (pTextSetion == NULL)
return NULL;
//.text:FFFFF8046BDCDE00                                         KiSystemServiceStart : ; DATA XREF : KiServiceInternal + 5A↑o
//.text:FFFFF8046BDCDE00 190 48 89 A3 90 00 00 00                                mov[rbx + 90h], rsp; _KTHREAD.SystemCallNumber = rsp
//.text:FFFFF8046BDCDE07 190 8B F8                                               mov     edi, eax
//.text:FFFFF8046BDCDE09 190 C1 EF 07                                            shr     edi, 7; 除以128
//.text:FFFFF8046BDCDE0C 190 83 E7 20 and edi, 20h; 计算偏移号
//.text:FFFFF8046BDCDE0F 190 25 FF 0F 00 00 and eax, 0FFFh; GDI 系统调用（调用号 >= 0x1000
//.text:FFFFF8046BDCDE14
//.text:FFFFF8046BDCDE14                                         KiSystemServiceRepeat : ; CODE XREF : KiSystemCall64 + 8EE↓j
//.text:FFFFF8046BDCDE14 190 4C 8D 15 65 9A 3B 00                                lea     r10, KeServiceDescriptorTable; #pragma pack()
//.text:FFFFF8046BDCDE1B 190 4C 8D 1D 5E 1C 3A 00                                lea     r11, KeServiceDescriptorTableShadow
//查找KiSystemServiceStart特征码
constunsigned char KiSystemServiceStartPattern[] = { 0x8B, 0xF8, 0xC1, 0xEF, 0x07, 0x83, 0xE7, 0x20, 0x25, 0xFF, 0x0F, 0x00, 0x00 };
constULONGSignatureSize = sizeof(KiSystemServiceStartPattern);
BOOL Found = FALSE;
ULONGi;
for (i = 0; i < pTextSetion->Misc.VirtualSize - SignatureSize; i++) {
if (RtlEqualMemory((PUCHAR)(KernelBase + pTextSetion->VirtualAddress + i), KiSystemServiceStartPattern, SignatureSize) == TRUE) {
Found = TRUE;
break;
}
}
if (!Found)
return NULL;

//.text:FFFFF8046BDCDE14 190 4C 8D 15 65 9A 3B 00                                lea     r10, KeServiceDescriptorTable; #pragma pack()
//获取KeServiceDescriptorTable的相对偏移值
ULONG_PTR LeaR10 = KernelBase + pTextSetion->VirtualAddress + i + SignatureSize;
LONGSSDTOffset = 0;
if ((*(PUCHAR)LeaR10 == 0x4c) &&
(*(PUCHAR)(LeaR10 + 1) == 0x8D) &&
(*(PUCHAR)(LeaR10 + 2) == 0x15)) {
SSDTOffset = *(PLONG)(LeaR10 + 3);
}
if (SSDTOffset == 0)
return NULL;

pSSDT = (PSSDTStruct)(LeaR10 + SSDTOffset + 7);
#ifdef _DEBUG
DbgPrint("[+]SSDTAddress:0x%p\n",pSSDT);
#endif // _DEBUG


return pSSDT;
}

#include<ntifs.h>
#include<windef.h>
#include<tdi.h>
#include<tdikrnl.h>

#define  HTONS(A) (((A&0xff00) >> 8) | ((A&0x00ff) << 8))
//Windows7
PDEVICE_OBJECT pfilterdevobj = NULL;

PDEVICE_OBJECT pdodevobj = NULL;

BOOLEAN g_attachTcp = FALSE;

NTSTATUS MyDispatch(DEVICE_OBJECT* DeviceObject, IRP* pIrp);
NTSTATUS NotSupport(DEVICE_OBJECT* DeviceObject, IRP* pIrp);

typedef struct _NETWORK_ADDRESS {
UCHAR address[4];
CHAR port[4];
}NETWORK_ADDRESS,*PNETWORK_ADDRESS;

VOID DriverUnload(PDRIVER_OBJECT pDriverObject) {
//__debugbreak();
DbgPrint("UnLoad\n");

if (g_attachTcp) {
IoDetachDevice(pdodevobj);
}
if (pfilterdevobj != NULL) {
IoDeleteDevice(pfilterdevobj);
}
return;
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) {
pDriverObject->DriverUnload = DriverUnload;

NTSTATUS status = STATUS_SUCCESS;

UNICODE_STRING devicename = { 0 };
//__debugbreak();
do {
status = IoCreateDevice(pDriverObject, 0, NULL, FILE_DEVICE_NETWORK, FILE_DEVICE_SECURE_OPEN, FALSE, &pfilterdevobj);

if (!NT_SUCCESS(status)) {
DbgPrint("Error Create %x\n", status);
break;
}

for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) {
pDriverObject->MajorFunction[i] = NotSupport;
}
pDriverObject->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL] = MyDispatch;

RtlInitUnicodeString(&devicename, L"\\Device\\Tcp");
//__debugbreak();
//第三个参数是下层设备的指针
status = IoAttachDevice(pfilterdevobj, &devicename, &pdodevobj);

if (!NT_SUCCESS(status)) {
DbgPrint("Error Attach %x\n", status);

IoDeleteDevice(pfilterdevobj);

break;
}
g_attachTcp = TRUE;
} while (FALSE);

return status;

}
NTSTATUS NotSupport(DEVICE_OBJECT* pDeviceObject, IRP* pIrp) {
//递增跳过，让下一层拿到当前的数据
IoSkipCurrentIrpStackLocation(pIrp);
//一定要使用AttachDevice后的下层驱动设备指针
return IoCallDriver(pdodevobj, pIrp);
}

NTSTATUS MyDispatch(DEVICE_OBJECT* pDeviceObject, IRP* pIrp) {
//DbgPrint("This Is Filter\n");
PIO_STACK_LOCATION pIrpStack = NULL;
//判断是否是当前的过滤设备
if (pDeviceObject == pfilterdevobj) {
pIrpStack = IoGetCurrentIrpStackLocation(pIrp);

if (pIrpStack == NULL) {
return STATUS_UNSUCCESSFUL;
}
//MajorFunction 对应IRP_MJ_XXXX
//MinorFunction 对应定义的其他请求

if (pIrpStack->MinorFunction == TDI_CONNECT) {
NETWORK_ADDRESS network = { 0 };

PTDI_REQUEST_KERNEL_CONNECT param = (PTDI_REQUEST_KERNEL_CONNECT)(&pIrpStack->Parameters);

PTA_ADDRESS remote_addr = ((TRANSPORT_ADDRESS*)(param->RequestConnectionInformation->RemoteAddress))->Address;

PTDI_ADDRESS_IP tdi_addr = (PTDI_ADDRESS_IP)(remote_addr->Address);

DWORD address = tdi_addr->in_addr;

DWORD port = tdi_addr->sin_port;

network.address[0] = ((PUCHAR)&address)[0];

network.address[1] = ((PUCHAR)&address)[1];

network.address[2] = ((PUCHAR)&address)[2];

network.address[3] = ((PUCHAR)&address)[3];

port = HTONS(port);

DbgPrint("connect ip address [%d.%d.%d.%d:%d]\n", network.address[0],network.address[1],network.address[2],network.address[3],port);
}
}

//递增跳过，让下一层拿到当前的数据
IoSkipCurrentIrpStackLocation(pIrp);
//一定要使用AttachDevice后的下层驱动设备指针
return IoCallDriver(pdodevobj, pIrp);
}

typedef struct {
LIST_ENTRY listentry;
ULONG64 unknown;
LARGE_INTEGER  cookie;
ULONG64 context;
ULONG64 function;
}CM_NOTIFY_ENTRY,*PCM_NOTIFY_ENTRY;

VOID EnumRegisterCallback() {
UNICODE_STRING apiname = { 0 };

PUCHAR apiaddr = NULL;

PLONG64 CallbackListHead = NULL;

PCM_NOTIFY_ENTRY tempNotifyEntry = NULL;

PCM_NOTIFY_ENTRY pNotifyEntry = NULL;

LONG offset = 0;

int i = 0;

LARGE_INTEGER lNum[50] = { 0 };

RtlInitUnicodeString(&apiname, L"CmUnRegisterCallback");

apiaddr = MmGetSystemRoutineAddress(&apiname);

if (!apiaddr) {
DbgPrint("Not Found CmUnRegisterCallback\n");
return;
}

DbgPrint("CmUnRegisterCallback addr %p\n", apiaddr);

//0B8 48 8D 0D 06 D8 C3 FF                                lea     rcx, CallbackListHead

for (int i = 0; i < 1000; i++) {
if (*(apiaddr + i) == 0x48 && *(apiaddr + i + 1) == 0x8D && *(apiaddr + i + 2) == 0x0D) {
apiaddr = apiaddr + i;

offset = *(PLONG32)(apiaddr + 3);

CallbackListHead = apiaddr + 7 + offset;


break;
}
}
DbgPrint("%p\n", CallbackListHead);

pNotifyEntry = tempNotifyEntry = *CallbackListHead;
do
{
if (MmIsAddressValid((PVOID)(tempNotifyEntry->function))) {

DbgPrint("[CmRegCallBack] FuncAddr: %p,Cookie: %p\n", tempNotifyEntry->function, tempNotifyEntry->cookie.QuadPart);

//函数卸载
lNum[i] = tempNotifyEntry->cookie;

i++;
}

tempNotifyEntry = tempNotifyEntry->listentry.Flink;

} while (tempNotifyEntry->listentry.Flink != pNotifyEntry);

//__debugbreak();
//函数卸载
for (i = 0;i < 50;i++) {
if (lNum[i].QuadPart == 0) {
break;
}
CmUnRegisterCallback(lNum[i]);

}
return;
}

1: kd> dt _OBJECT_TYPE
nt!_OBJECT_TYPE
   +0x000 TypeList         : _LIST_ENTRY
   +0x010 Name             : _UNICODE_STRING
   +0x020 DefaultObject    : Ptr64 Void
   +0x028 Index            : UChar
   +0x02c TotalNumberOfObjects : Uint4B
   +0x030 TotalNumberOfHandles : Uint4B
   +0x034 HighWaterNumberOfObjects : Uint4B
   +0x038 HighWaterNumberOfHandles : Uint4B
   +0x040 TypeInfo         : _OBJECT_TYPE_INITIALIZER
   +0x0b8 TypeLock         : _EX_PUSH_LOCK
   +0x0c0 Key              : Uint4B
   +0x0c8 CallbackList     : _LIST_ENTRY

typedef struct{
LIST_ENTRY listEntry;
ULONG64unkonw;
ULONG64 objectHead;
ULONG64 handle;
ULONG64 prefunc;
ULONG64 postfunc;
}OBJECTCALLBACK,*POBJECTCALLBACK;

VOID EnumProcessCallBack() {
POBJECTCALLBACK pObjectCallBack = NULL;

POBJECTCALLBACK ptempobject = NULL;

PULONG64 temp = NULL;

PUCHAR pObject = NULL;

int i = 0;

ULONG64 ulNum[50] = { 0 };

pObject = (PUCHAR)*PsProcessType;

temp = (PULONG64)(pObject + 0x0c8);

ptempobject = pObjectCallBack = (POBJECTCALLBACK)*temp;

DbgPrint("%p\n", pObjectCallBack);

do
{
DbgPrint("[ProcCallBack] handle: %p,PreFunc: %p, PostFunc: %p\n", ptempobject->handle,ptempobject->prefunc, ptempobject->postfunc);

//卸载
ulNum[i] = ptempobject->handle;

i++;

ptempobject = ptempobject->listEntry.Flink;

} while (pObjectCallBack != ptempobject->listEntry.Flink);

//函数卸载
for (i = 0;i < 50;i++) {
if (ulNum[i]== 0) {
break;
}
ObUnRegisterCallbacks((PVOID)ulNum[i]);
}

return;
}

status = PsSetCreateProcessNotifyRoutine(MyCreateProcessRoutine, FALSE);

VOID MyCreateProcessRoutine(HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create) {
//Create = TRUE 创建进程 FALSE 结束进程
if (Create) {
PEPROCESStempep = NULL;

NTSTATUSstatus = STATUS_SUCCESS;

//根据ProcessId返回对应的EPROCESS结构指针
status = PsLookupProcessByProcessId(ProcessId, &tempep);

if (NT_SUCCESS(status)) {
//减引用
ObDereferenceObject(tempep);

PCHAR imagename = PsGetProcessImageFileName(tempep);

DbgPrint("pid :<%d> --- name: <%s>\n", ProcessId, imagename);
}
}
return;
}

status = PsSetCreateProcessNotifyRoutineEx((PCREATE_PROCESS_NOTIFY_ROUTINE_EX)MyCreateProcessRoutineEx, FALSE);

VOID MyCreateProcessRoutineEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) {

HANDLE hParentProcessId = NULL;

HANDLE hParentThreadId = NULL;

HANDLE hCurrnetThreadId = NULL;
//获取当前的线程id
hCurrnetThreadId = PsGetCurrentThreadId();

if (CreateInfo == NULL) {
//进程结束
__debugbreak();
DbgPrint(" Destory hCurrnetThreadId:<%d>,ProcessID:<%d>\n", hCurrnetThreadId, ProcessId);
return;
}
//__debugbreak();
hParentProcessId = CreateInfo->CreatingThreadId.UniqueProcess;
hParentThreadId = CreateInfo->CreatingThreadId.UniqueThread;

DbgPrint(" Create hCurrnetThreadId:<0x%x>,hParentProcessId:<%d>,hParentThreadId:<%d>,ProcessID:<%d>, ProcessName:<%wZ>\n", hCurrnetThreadId, hParentProcessId, hParentThreadId, ProcessId,CreateInfo->ImageFileName);
    //子进程的线程ID，父进程的进程ID，父进程的创建子进程线程的ID，被创建的子进程的进程ID
return;
}

status = PsSetLoadImageNotifyRoutine(MySetLoadImageNotifyRoutine);

VOID MySetLoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo) {
//模块名 //加载模块的进程

PEPROCESS tempep = NULL;

NTSTATUS status = STATUS_SUCCESS;

status = PsLookupProcessByProcessId(ProcessId, &tempep);

if (NT_SUCCESS(status)) {
ObDereferenceObject(tempep);

PCHAR imagename = PsGetProcessImageFileName(tempep);

DbgPrint("[%s] Load Image [%wZ] ,Baseaddr: [0x%x], size is [0x%llx]\n", imagename, FullImageName, ImageInfo->ImageBase, ImageInfo->ImageSize);

}
return;
}

typedef struct _IMAGE_INFO_EX {
  SIZE_T              Size;
  IMAGE_INFO          ImageInfo;
  struct _FILE_OBJECT *FileObject;
} IMAGE_INFO_EX, *PIMAGE_INFO_EX;

VOID MySetLoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo) {
//模块名 //加载模块的进程

PEPROCESS tempep = NULL;

NTSTATUS status = STATUS_SUCCESS;

status = PsLookupProcessByProcessId(ProcessId, &tempep);

PCHAR imagename = NULL;

if (!NT_SUCCESS(status)) {
return;
}

ObDereferenceObject(tempep);

imagename = PsGetProcessImageFileName(tempep);

if (ImageInfo->ExtendedInfoPresent)
{
PIMAGE_INFO_EX pInfo = CONTAINING_RECORD(ImageInfo, IMAGE_INFO_EX, ImageInfo);

DbgPrint("[%s] Load Image [%wZ] ,FileObject [0x%x],Baseaddr: [0x%x], size is [0x%llx]\n", imagename, FullImageName, pInfo->FileObject,ImageInfo->ImageBase, ImageInfo->ImageSize);

return;
}

DbgPrint("[%s] Load Image [%wZ] ,Baseaddr: [0x%x], size is [0x%llx]\n", imagename, FullImageName, ImageInfo->ImageBase, ImageInfo->ImageSize);

return;
}

status = PsSetCreateThreadNotifyRoutine(MyCreateThreadNotifyRoutine);

VOID MyCreateThreadNotifyRoutine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) {
NTSTATUS status;

PEPROCESS tempep = NULL;

status = PsLookupProcessByProcessId(ProcessId, &tempep);

PCHAR imagefilename;

if (NT_SUCCESS(status)) {
imagefilename = PsGetProcessImageFileName(tempep);

if (Create) {
DbgPrint("[%s] Create Thread [%d]\n", imagefilename, ThreadId);
}
else {
DbgPrint("[%s] Destory Thread [%d]\n", imagefilename, ThreadId);
}

}
return;
}