i m trying to hook this one but i couldnt do. when i use zw or ntreadvirtualmemory. it giving driver couldnt load err. but i can hook zwcreatefile or some apis. but i couldnt this one. i need help. its my code
#include <ntddk.h>
#define SYSTEMSERVICE(_name) KeServiceDescriptorTable.ServiceTable[*(DWORD *) ((unsigned char *)_name + 1)]
typedef unsigned long DWORD, *PDWORD;
typedef unsigned char BYTE, *PBYTE;
typedef struct ServiceDescriptorEntry {
PDWORD ServiceTable;
PDWORD CounterTableBase;
DWORD ServiceLimit;
PBYTE ArgumentTable;
} SDT;
typedef NTSTATUS (*ZWREADVIRTUALMEMORY)(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG NumberOfBytesToRead,
OUT PULONG NumberOfBytesReaded OPTIONAL
);
__declspec(dllimport) SDT KeServiceDescriptorTable;
VOID HookAPI(PDWORD API, PDWORD NewAPI);
VOID UnHookAPI(PDWORD OriginalAPI, PDWORD API);
VOID OnUnload(PDRIVER_OBJECT pDriverObj);
NTSYSAPI NTSTATUS NtReadVirtualMemory(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG NumberOfBytesToRead,
OUT PULONG NumberOfBytesReaded OPTIONAL
);
NTSTATUS NtReadVirtualMemoryOwned(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG NumberOfBytesToRead,
OUT PULONG NumberOfBytesReaded OPTIONAL
);
PDWORD OriginalAPI;
NTSTATUS NtReadVirtualMemoryOwned(
IN HANDLE ProcessHandle,
IN PVOID BaseAddress,
OUT PVOID Buffer,
IN ULONG NumberOfBytesToRead,
OUT PULONG NumberOfBytesReaded OPTIONAL
)
{
NTSTATUS ret;
ZWREADVIRTUALMEMORY OriginalFunc = (ZWREADVIRTUALMEMORY)OriginalAPI;
DbgPrint(“\nProcessHandle:0x%X\nBaseAddress:0x%X\nBufferAddress:0x%X\nNumberOfBytesToRead:%d\nNumberOfBytesReaded:%d\n”,
(ULONG) ProcessHandle,(ULONG)BaseAddress,(ULONG)Buffer,(ULONG)NumberOfBytesToRead,(ULONG) NumberOfBytesReaded);
ret = OriginalFunc(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesReaded);
return ret;
}
VOID HookAPI(PDWORD API, PDWORD NewAPI)
{
DWORD nOldProtect;
OriginalAPI = (PDWORD) (SYSTEMSERVICE(API));
DbgPrint(“\nAPI Address : 0x%x”, SYSTEMSERVICE(API));
DbgPrint(“\nHooking API…”);
__asm
{
cli
push eax
mov eax, cr0
mov nOldProtect, eax
and eax, 0xFFFEFFFF
mov cr0, eax
pop eax
}
(PDWORD) (SYSTEMSERVICE(API)) = NewAPI;
__asm
{
push eax
mov eax, nOldProtect
mov cr0, eax
pop eax
sti
}
}
VOID UnHookAPI(PDWORD OriginalAPI, PDWORD API)
{
DWORD nOldProtect;
DbgPrint(“\nUnhooking API…\n”);
__asm
{
cli
push eax
mov eax, cr0
mov nOldProtect, eax
and eax, 0xFFFEFFFF
mov cr0, eax
pop eax
}
(PDWORD)(SYSTEMSERVICE(API)) = OriginalAPI;
__asm
{
push eax
mov eax, nOldProtect
mov cr0, eax
pop eax
sti
}
}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegisteryPath)
{
DbgPrint(“SSDT Address: 0x%x\nNtReadVirtualMemory Address: 0x%x\n”, KeServiceDescriptorTable.ServiceTable,(ULONG)NtReadVirtualMemory);
HookAPI((PDWORD)NtReadVirtualMemory, (PDWORD)NtReadVirtualMemoryOwned);
pDriverObj->DriverUnload = OnUnload;
return STATUS_SUCCESS;
}
VOID OnUnload(PDRIVER_OBJECT pDriverObj)
{
UnHookAPI(OriginalAPI, (PDWORD)ZwCreateFile);
DbgPrint(“\nDriver Unload\n”);
}
ty for all.</ntddk.h>