dnf辅助外挂C++源代码(仅供学习参考)(4)

popad ret

ShowDrRegInfo endp

;恢复被隐藏的dr寄存器

RecoveryDrReg proc ptrContext, pHandle pushad

;定位到LinkTable

mov ebx, threadCxtLink NEXT:

test ebx, ebx

jne @F ;如果没有遍历完 popad ret @@:

mov eax, (LinkTable ptr [ebx]).ThreadHandle cmp eax, pHandle

je @F ;如果找到匹配项

mov ebx, (LinkTable ptr [ebx]).NextLinkPtr jmp NEXT @@:

;拷贝完毕后立即结束

invoke CopyContextToLinkTable, ebx, ptrContext xor ebx, ebx jmp NEXT

RecoveryDrReg endp

;清空Context的dr寄存器 ClearDrReg proc ptrContext pushad

mov ebx, ptrContext mov ecx, 4 @@:

mov DWORD ptr [ebx + ecx], 0 add ecx, 4 cmp ecx, 18h jbe @B pushad

invoke DbgPrint, $CTA0(\ popad

invoke ShowDrRegInfo, ptrContext popad ret

ClearDrReg endp

;NtGetContextThread钩子代码 NtGetContextThreadHookCode proc ;ebx存放CONTEXT指针

mov ebx, DWORD ptr [ebp + 10h] ;线程句柄

mov edx, DWORD ptr [ebp + 0ch] pushad

invoke ShowDrRegInfo, ebx invoke IsFilterProcess .if eax ;如果是DNF.exe

invoke AddLinkTable, edx, ebx invoke ClearDrReg, ebx .else ;如果不是DNF.exe

invoke RecoveryDrReg, ebx, edx .endif

invoke ShowDrRegInfo, ebx ;执行被覆盖的代码 popad

mov eax, esi pop esi leave ret

NtGetContextThreadHookCode endp

;NtGetContextThread加跳转 HookNtGetContextThread proc pushad

;头5字节跳转

mov eax, offset NtGetContextThreadHookCode

sub eax, NtGetContextThreadAddr;805c13e0h;805c13edh sub eax, 5

mov ebx, NtGetContextThreadAddr;805c13e0h;805c13edh mov cl, 0E9h

mov BYTE PTR [ebx], cl

mov DWORD PTR [ebx + 1], eax popad ret

HookNtGetContextThread endp

DriverEntry proc pDriverObject:PDRIVER_OBJECT, pusRegistryPath:PUNICODE_STRING invoke DbgPrint, $CTA0(\ invoke PsGetCurrentProcess invoke GetNameOffset, eax

mov nameOffset, eax cmp eax, -1 je @F

mov nameOffset, eax cli

mov eax, cr0

and eax, not 10000h mov cr0, eax

call Hook

call HookThread call Dbg

call HookNtGetContextThread

mov eax, pDriverObject

assume eax : ptr DRIVER_OBJECT

mov [eax].DriverUnload, offset DriverUnload assume eax : nothing

mov eax, cr0

or eax, 10000h mov cr0, eax sti

invoke DbgPrint, $CTA0(\@@:

mov eax, STATUS_SUCCESS ret

DriverEntry endp end DriverEntry

百度搜索“77cn”或“免费范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，免费范文网，提供经典小说综合文库dnf辅助外挂C++源代码(仅供学习参考)(4)在线全文阅读。