一个简单的Object Hook的例子（win7 32bit）

野性酷女 2023-10-12 06:36 17阅读 0赞

Object Hook简单的来说就是Hook对象，这里拿看雪上的一个例子，因为是在win7 32位上的，有些地方做了些修改。

\_OBJECT\_HEADER：

kd> dt \_OBJECT\_HEADER  
nt!\_OBJECT\_HEADER  
   +0×000 PointerCount     : Int4B  
   +0×004 HandleCount      : Int4B  
   +0×004 NextToFree       : Ptr32 Void  
   +0×008 Lock             : \_EX\_PUSH\_LOCK  
   +0x00c TypeIndex        : UChar  
   +0x00d TraceFlags       : UChar  
   +0x00e InfoMask         : UChar  
   +0x00f Flags            : UChar  
   +0×010 ObjectCreateInfo : Ptr32 \_OBJECT\_CREATE\_INFORMATION  
   +0×010 QuotaBlockCharged : Ptr32 Void  
   +0×014 SecurityDescriptor : Ptr32 Void  
   +0×018 Body             : \_QUAD

在[Win7 Object\_Header之TypeIndex解析][Win7 Object_Header_TypeIndex]已经说了怎么通过TypeIndex得到对象类型：

\_OBJECT\_TYPE：

kd> dt \_OBJECT\_TYPE  
nt!\_OBJECT\_TYPE  
   +0×000 TypeList         : \_LIST\_ENTRY  
   +0×008 Name             : \_UNICODE\_STRING  
   +0×010 DefaultObject    : Ptr32 Void  
   +0×014 Index            : UChar  
   +0×018 TotalNumberOfObjects : Uint4B  
   +0x01c TotalNumberOfHandles : Uint4B  
   +0×020 HighWaterNumberOfObjects : Uint4B  
   +0×024 HighWaterNumberOfHandles : Uint4B  
   +0×028 TypeInfo         : \_OBJECT\_TYPE\_INITIALIZER  
   +0×078 TypeLock         : \_EX\_PUSH\_LOCK  
   +0x07c Key              : Uint4B  
   +0×080 CallbackList     : \_LIST\_ENTRY

对象类型结构主要是创建对象类型，比如\*IoFileObjectType, \*PsProcessType, \*PsThreadType 这些。

系统初始化的时候第一个创建的对象类型结构就是TYPE结构，生成对象目录\\ObjectTypes 其后面的对象类型直接挂在这个目录上

比如对象类型 \\ObjectTypes\\File 或者设备类型 \\ObjectTypes\\Device

最重要的是下面这个结构：

kd> dt \_OBJECT\_TYPE\_INITIALIZER  
nt!\_OBJECT\_TYPE\_INITIALIZER  
   +0×000 Length           : Uint2B  
   +0×002 ObjectTypeFlags  : UChar  
   +0×002 CaseInsensitive  : Pos 0, 1 Bit  
   +0×002 UnnamedObjectsOnly : Pos 1, 1 Bit  
   +0×002 UseDefaultObject : Pos 2, 1 Bit  
   +0×002 SecurityRequired : Pos 3, 1 Bit  
   +0×002 MaintainHandleCount : Pos 4, 1 Bit  
   +0×002 MaintainTypeList : Pos 5, 1 Bit  
   +0×002 SupportsObjectCallbacks : Pos 6, 1 Bit  
   +0×004 ObjectTypeCode   : Uint4B  
   +0×008 InvalidAttributes : Uint4B  
   +0x00c GenericMapping   : \_GENERIC\_MAPPING  
   +0x01c ValidAccessMask  : Uint4B  
   +0×020 RetainAccess     : Uint4B  
   +0×024 PoolType         : \_POOL\_TYPE  
   +0×028 DefaultPagedPoolCharge : Uint4B  
   +0x02c DefaultNonPagedPoolCharge : Uint4B  
   +0×030 DumpProcedure    : Ptr32     void  
   +0×034 OpenProcedure    : Ptr32     long  
   +0×038 CloseProcedure   : Ptr32     void  
   +0x03c DeleteProcedure  : Ptr32     void  
   +0×040 ParseProcedure   : Ptr32     long  
   +0×044 SecurityProcedure : Ptr32     long  
   +0×048 QueryNameProcedure : Ptr32     long  
   +0x04c OkayToCloseProcedure : Ptr32     unsigned char

后面这几个函数决定对象的一些操作，例如 打开、创建、删除，不同对象类型（OBJECT\_TYPE）的操作也不同，所以要清楚知道对象是什么类型。

当你调用NtCreateFile->IoCreateFile->ObOpenObjectByName->ObpLookupObjectName->IopParseFile->IopParseDevice  
IopParseFile最终也会调用IopParseDevice  
ObjectHook其实就是比如你要HOOK 创建打开就是OBJECT\_TYPE\_INITIALIZER->ParseProcedure。

代码如下：

<table> 
 <tbody> 
 <tr> 
 <td> 
 <div>
 1 
 2 
 3 
 4 
 5 
 6 
 7 
 8 
 9 
 10 
 11 
 12 
 13 
 14 
 15 
 16 
 17 
 18 
 19 
 20 
 21 
 22 
 23 
 24 
 25 
 26 
 27 
 28 
 29 
 30 
 31 
 32 
 33 
 34 
 35 
 36 
 37 
 38 
 39 
 40 
 41 
 42 
 43 
 44 
 45 
 46 
 47 
 48 
 49 
 50 
 51 
 52 
 53 
 54 
 55 
 56 
 57 
 58 
 59 
 60 
 61 
 62 
 63 
 64 
 65 
 66 
 67 
 68 
 69 
 70 
 71 
 72 
 73 
 74 
 75 
 76 
 77 
 78 
 79 
 80 
 81 
 82 
 83 
 84 
 85 
 86 
 87 
 88 
 89 
 90 
 91 
 92 
 93 
 94 
 95 
 96 
 97 
 98 
 99 
 100 
 101 
 102 
 103 
 104 
 105 
 106 
 107 
 108 
 109 
 110 
 111 
 112 
 113 
 114 
 115 
 116 
 117 
 118 
 119 
 120 
 121 
 122 
 123 
 124 
 125 
 126 
 127 
 128 
 129 
 130 
 131 
 132 
 133 
 134 
 135 
 136 
 137 
 138 
 139 
 140 
 141 
 </div> </td> 
 <td> 
 <div> 
 #include &lt;ntddk.h&gt; 
 
 
 typedef PULONG 
 (NTAPI 
 *OBGETOBJECTTYPE 
 ) 
 (PVOID 
 ) 
 ; 
 OBGETOBJECTTYPE OBGetObjectType 
 ; 
 
 
 typedef 
 struct _OBJECT_TYPE_INITIALIZER 
 { 
 &nbsp; &nbsp; &nbsp; &nbsp; USHORT Length &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR ObjectTypeFlags 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR CaseInsensitive &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR UnnamedObjectsOnly 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR &nbsp;UseDefaultObject 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR &nbsp;SecurityRequired 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR MaintainHandleCount 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR MaintainTypeList 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR SupportsObjectCallbacks 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR CacheAligned &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; ULONG ObjectTypeCode &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; BOOLEAN InvalidAttributes 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; GENERIC_MAPPING GenericMapping &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; BOOLEAN &nbsp; ValidAccessMask &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; BOOLEAN &nbsp; RetainAccess &nbsp; &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; POOL_TYPE PoolType &nbsp; &nbsp; &nbsp; &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; BOOLEAN DefaultPagedPoolCharge 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; BOOLEAN DefaultNonPagedPoolCharge 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; PVOID DumpProcedure &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; ULONG OpenProcedure &nbsp; &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; PVOID CloseProcedure &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; PVOID DeleteProcedure 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; ULONG ParseProcedure &nbsp; 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; ULONG SecurityProcedure 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; ULONG QueryNameProcedure 
 ; 
 &nbsp; &nbsp; &nbsp; &nbsp; UCHAR OkayToCloseProcedure 
 ; 
 
 } OBJECT_TYPE_INITIALIZER 
 , 
 *POBJECT_TYPE_INITIALIZER 
 ; 
 
 typedef 
 struct _OBJECT_TYPE 
 { 
 &nbsp; &nbsp; LIST_ENTRY TypeList 
 ; 
 &nbsp; &nbsp; UNICODE_STRING Name 
 ; 
 &nbsp; &nbsp; PVOID DefaultObject 
 ; 
 &nbsp; &nbsp; ULONG Index 
 ; 
 &nbsp; &nbsp; ULONG TotalNumberOfObjects 
 ; 
 &nbsp; &nbsp; ULONG TotalNumberOfHandles 
 ; 
 &nbsp; &nbsp; ULONG HighWaterNumberOfObjects 
 ; 
 &nbsp; &nbsp; ULONG HighWaterNumberOfHandles 
 ; 
 &nbsp; &nbsp; OBJECT_TYPE_INITIALIZER TypeInfo &nbsp; 
 ; 
 &nbsp; &nbsp; ULONG &nbsp;TypeLock 
 ; 
 &nbsp; &nbsp; ULONG &nbsp; Key 
 ; 
 &nbsp; &nbsp; LIST_ENTRY &nbsp; CallbackList 
 ; 
 
 } OBJECT_TYPE 
 , 
 *POBJECT_TYPE 
 ; 
 
 POBJECT_TYPE &nbsp; pType 
 = NULL 
 ; 
 PVOID &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;OldParseProcedure 
 = NULL 
 ; 
 
 NTSTATUS NewParseProcedure 
 (IN PVOID ParseObject 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN PVOID ObjectType 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN OUT PACCESS_STATE AccessState 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN KPROCESSOR_MODE AccessMode 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN ULONG Attributes 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN OUT PUNICODE_STRING CompleteName 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN OUT PUNICODE_STRING RemainingName 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN OUT PVOID Context OPTIONAL 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL 
 , 
 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;OUT PVOID 
 *Object 
 ) 
 
 { 
 &nbsp; &nbsp; &nbsp;NTSTATUS Status 
 ; 
 &nbsp; &nbsp; &nbsp;KdPrint 
 ( 
 ( 
 "object is hook\n" 
 ) 
 ) 
 ; 
 &nbsp; __asm 
 &nbsp; 
 { 
 &nbsp; &nbsp; &nbsp; push eax 
 &nbsp; &nbsp; &nbsp; push Object 
 &nbsp; &nbsp; &nbsp; push SecurityQos 
 &nbsp; &nbsp; &nbsp; push Context 
 &nbsp; &nbsp; &nbsp; push RemainingName 
 &nbsp; &nbsp; &nbsp; push CompleteName 
 &nbsp; &nbsp; &nbsp; push Attributes 
 &nbsp; &nbsp; &nbsp; movzx eax 
 , AccessMode 
 &nbsp; &nbsp; &nbsp; push eax 
 &nbsp; &nbsp; &nbsp; push AccessState 
 &nbsp; &nbsp; &nbsp; push ObjectType 
 &nbsp; &nbsp; &nbsp; push ParseObject 
 &nbsp; &nbsp; &nbsp; call OldParseProcedure 
 &nbsp; &nbsp; &nbsp; mov Status 
 , eax 
 &nbsp; &nbsp; &nbsp; pop eax 
 &nbsp; 
 } 
 &nbsp; 
 return Status 
 ; 
 
 } 
 VOID GetObGetObjectTypeAddress 
 ( 
 ) 
 
 { 
 &nbsp; &nbsp; PUCHAR addr 
 ; 
 &nbsp; &nbsp; UNICODE_STRING pslookup 
 ; 
 &nbsp; &nbsp; RtlInitUnicodeString 
 ( 
 &amp;pslookup 
 ,L 
 "ObGetObjectType" 
 ) 
 ; 
 &nbsp; &nbsp; addr 
 = 
 (PUCHAR 
 )MmGetSystemRoutineAddress 
 ( 
 &amp;pslookup 
 ) 
 ; 
 &nbsp; &nbsp; OBGetObjectType 
 = 
 (OBGETOBJECTTYPE 
 )addr 
 ; 
 
 } 
 NTSTATUS Hook 
 ( 
 ) 
 
 { 
 &nbsp; NTSTATUS &nbsp;Status 
 ; 
 &nbsp; HANDLE hFile 
 ; 
 &nbsp; UNICODE_STRING Name 
 ; 
 &nbsp; OBJECT_ATTRIBUTES Attr 
 ; 
 &nbsp; IO_STATUS_BLOCK ioStaBlock 
 ; 
 &nbsp; PVOID pObject 
 = NULL 
 ; 
 &nbsp; 
 &nbsp; 
 &nbsp; RtlInitUnicodeString 
 ( 
 &amp;Name 
 ,L 
 "\\Device\\HarddiskVolume1\\1.txt" 
 ) 
 ; &nbsp; 
 //C:\1.txt 
 &nbsp; InitializeObjectAttributes 
 ( 
 &amp;Attr 
 ,&amp;Name 
 ,OBJ_CASE_INSENSITIVE 
 | OBJ_KERNEL_HANDLE 
 ,\ 
 &nbsp; &nbsp; 
 0 
 ,NULL 
 ) 
 ; 
 &nbsp; Status 
 = ZwOpenFile 
 ( 
 &amp;hFile 
 ,GENERIC_ALL 
 ,&amp;Attr 
 ,&amp;ioStaBlock 
 ,\ 
 &nbsp; &nbsp; 
 0 
 ,FILE_NON_DIRECTORY_FILE 
 ) 
 ; 
 &nbsp; 
 if 
 ( 
 !NT_SUCCESS 
 (Status 
 ) 
 ) 
 &nbsp; 
 { 
 &nbsp; &nbsp; KdPrint 
 ( 
 ( 
 "File is Null\n" 
 ) 
 ) 
 ; 
 &nbsp; &nbsp; 
 return Status 
 ; 
 &nbsp; 
 } 
 &nbsp; 
 &nbsp; Status 
 = ObReferenceObjectByHandle 
 (hFile 
 ,GENERIC_ALL 
 ,NULL 
 ,KernelMode 
 ,&amp;pObject 
 ,NULL 
 ) 
 ; 
 &nbsp; 
 if 
 ( 
 !NT_SUCCESS 
 (Status 
 ) 
 ) 
 &nbsp; 
 { 
 &nbsp; &nbsp; KdPrint 
 ( 
 ( 
 "Object is Null\n" 
 ) 
 ) 
 ; 
 &nbsp; &nbsp; 
 return Status 
 ; 
 &nbsp; 
 } 
 &nbsp; 
 &nbsp;KdPrint 
 ( 
 ( 
 "pobject is %08X\n" 
 ,pObject 
 ) 
 ) 
 ; 
 
 //win7 获取objecttype更加方便了。。。 
 &nbsp;pType 
 = 
 (POBJECT_TYPE 
 )OBGetObjectType 
 (pObject 
 ) 
 ; 
 
 KdPrint 
 ( 
 ( 
 "pType is %08X\n" 
 ,pType 
 ) 
 ) 
 ; 
 OldParseProcedure 
 = pType 
 -&gt;TypeInfo. 
 ParseProcedure 
 ; 
 KdPrint 
 ( 
 ( 
 "OldParseProcedure addrs is %08X\n" 
 ,OldParseProcedure 
 ) 
 ) 
 ; 
 
 //这里最好检查一下OldParseProcedure,是否为0 
 
 pType 
 -&gt;TypeInfo. 
 ParseProcedure 
 = NewParseProcedure 
 ; 
 //hook 因为object原本就是是可写的，所以不用特意去除内存保护 
 &nbsp;Status 
 = ZwClose 
 (hFile 
 ) 
 ; 
 &nbsp; 
 return Status 
 ; 
 
 } 
 
 NTSTATUS DriverEntry 
 (PDRIVER_OBJECT DriverObject 
 ,PUNICODE_STRING RegistryPath 
 ) 
 
 { 
 &nbsp; NTSTATUS Status 
 = STATUS_SUCCESS 
 ; 
 &nbsp; GetObGetObjectTypeAddress 
 ( 
 ) 
 ; 
 &nbsp; Status 
 =Hook 
 ( 
 ) 
 ; 
 &nbsp; 
 return Status 
 ; 
 
 } 
 </div> </td> 
 </tr> 
 </tbody> 
</table>

效果：

[![DOY)\]23HX\{SA7GI\{FF@\{$4L][DOY_23HX_SA7GI_FF_4L]][DOY_23HX_SA7GI_FF_4L_DOY_23HX_SA7GI_FF_4L][![\{\}$D6\}(GSQT\}6T\[9)\[RP\[2K][D6_GSQT_6T_9_RP_2K]][D6_GSQT_6T_9_RP_2K_D6_GSQT_6T_9_RP_2K]

本文链接：[http://www.blogfshare.com/object-hook.html][http_www.blogfshare.com_object-hook.html]

**object\_header地址=\_EPROCESS地址**

![923483-20160830094107761-1279901750.jpg][]jpg 改 rar

转载于:https://www.cnblogs.com/kuangke/p/5818815.html

[Win7 Object_Header_TypeIndex]: http://www.blogfshare.com/win7-obtypeindextable.html
[DOY_23HX_SA7GI_FF_4L]: http://www.blogfshare.com/wp-content/uploads/images/Object-Hook_E632/DOY23HXSA7GIFF4L_thumb.jpg
[DOY_23HX_SA7GI_FF_4L_DOY_23HX_SA7GI_FF_4L]: http://www.blogfshare.com/wp-content/uploads/images/Object-Hook_E632/DOY23HXSA7GIFF4L.jpg
[D6_GSQT_6T_9_RP_2K]: http://www.blogfshare.com/wp-content/uploads/images/Object-Hook_E632/D6GSQT6T9RP2K_thumb.jpg
[D6_GSQT_6T_9_RP_2K_D6_GSQT_6T_9_RP_2K]: http://www.blogfshare.com/wp-content/uploads/images/Object-Hook_E632/D6GSQT6T9RP2K.jpg
[http_www.blogfshare.com_object-hook.html]: http://www.blogfshare.com/object-hook.html
[923483-20160830094107761-1279901750.jpg]: https://images2015.cnblogs.com/blog/923483/201608/923483-20160830094107761-1279901750.jpg