ring3改KernelCallbackTable防键盘钩子

落日映苍穹つ 2022-08-10 03:52 136阅读 0赞

# ring3改KernelCallbackTable防键盘钩子 #

<table style="word-wrap:break-word; empty-cells:show; border-collapse:collapse; width:800px; table-layout:fixed; margin-left:1px"> 
 <tbody style="word-wrap:break-word"> 
 <tr style="word-wrap:break-word"> 
 <td style="word-wrap:break-word; color:rgb(51,51,51); font-size:14px; line-height:1.6em; font-family:Verdana,Helvetica,Arial,sans-serif"> __declspec(naked) test() { &nbsp;&nbsp;_asm &nbsp;&nbsp;{ &nbsp; &nbsp; ret &nbsp; &nbsp; jmp oldaddr &nbsp;&nbsp;} } DWORD * KernelCallbackTable = NULL; _asm { &nbsp; &nbsp;&nbsp;&nbsp;push eax &nbsp; &nbsp;&nbsp;&nbsp;mov eax,dword ptr fs:[0x18] &nbsp; &nbsp;&nbsp;&nbsp;mov eax,dword ptr ds:[eax+0x30] &nbsp; &nbsp;&nbsp;&nbsp;mov eax,dword ptr ds:[eax+0x2C] &nbsp; &nbsp;&nbsp;&nbsp;mov KernelCallbackTable, eax &nbsp; &nbsp;&nbsp;&nbsp;pop eax } DWORD old = 0; if(VirtualProtect(&amp;KernelCallbackTable[40], sizeof(PVOID),PAGE_EXECUTE_READWRITE, &amp;old)) { &nbsp;&nbsp;oldaddr = KernelCallbackTable[40]; &nbsp;&nbsp;KernelCallbackTable[40] = (DWORD)test; } 前几天研究windows的消息机制时偶尔发现。 通过修改KernelCallbackTable内供ring3回调用ring0的函数分派表实现 
 <table style="word-wrap:break-word; empty-cells:show; border-collapse:collapse; width:800px; table-layout:fixed; margin-left:1px; color:rgb(51,51,51); font-family:Verdana,Helvetica,Arial,sans-serif; font-size:12px"> 
 <tbody style="word-wrap:break-word"> 
 <tr style="word-wrap:break-word"> 
 <td style="word-wrap:break-word; font-size:14px; line-height:1.6em; font-family:Verdana,Helvetica,Arial,sans-serif"> 跟这个不一样吧，防全局钩子拦ClientLoadLibrary,XP下是66,不知道你的40是哪来的。。 查了下XPSP2的40是fnHkINDWORD，不知道你拦截了什么。也能拦键盘钩子？离奇了吧 呵呵 XP SP2的callback函数对照表 01&nbsp; &nbsp;&nbsp; &nbsp; fnCOPYDATA 02&nbsp; &nbsp;&nbsp; &nbsp; fnCOPYGLOBALDATA 03&nbsp; &nbsp;&nbsp; &nbsp; fnDWORD 04&nbsp; &nbsp;&nbsp; &nbsp; fnNCDESTROY 05&nbsp; &nbsp;&nbsp; &nbsp; fnDWORDOPTINLPMSG 06&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTDRAG 07&nbsp; &nbsp;&nbsp; &nbsp; fnGETTEXTLENGTHS 08&nbsp; &nbsp;&nbsp; &nbsp; fnINCNTOUTSTRING 09&nbsp; &nbsp;&nbsp; &nbsp; fnPOUTLPINT 10&nbsp; &nbsp;&nbsp; &nbsp; fnINLPCOMPAREITEMSTRUCT 11&nbsp; &nbsp;&nbsp; &nbsp; fnINLPCREATESTRUCT 12&nbsp; &nbsp;&nbsp; &nbsp; fnINLPDELETEITEMSTRUCT 13&nbsp; &nbsp;&nbsp; &nbsp; fnINLPDRAWITEMSTRUCT 14&nbsp; &nbsp;&nbsp; &nbsp; fnINLPHLPSTRUCT 15&nbsp; &nbsp;&nbsp; &nbsp; fnINLPHLPSTRUCT 16&nbsp; &nbsp;&nbsp; &nbsp; fnINLPMDICREATESTRUCT 17&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTLPMEASUREITEMSTRUCT 18&nbsp; &nbsp;&nbsp; &nbsp; fnINLPWINDOWPOS 19&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTLPPOINT5 20&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTLPSCROLLINFO 21&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTLPRECT 22&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTNCCALCSIZE 23&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTLPSCROLLINFO 24&nbsp; &nbsp;&nbsp; &nbsp; fnINPAINTCLIPBRD 25&nbsp; &nbsp;&nbsp; &nbsp; fnINSIZECLIPBRD 26&nbsp; &nbsp;&nbsp; &nbsp; fnINDESTROYCLIPBRD 27&nbsp; &nbsp;&nbsp; &nbsp; fnINSTRINGNULL 28&nbsp; &nbsp;&nbsp; &nbsp; fnINSTRINGNULL 29&nbsp; &nbsp;&nbsp; &nbsp; fnINDEVICECHANGE 30&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTNEXTMENU 31&nbsp; &nbsp;&nbsp; &nbsp; fnLOGONNOTIFY 32&nbsp; &nbsp;&nbsp; &nbsp; fnOPTOUTLPDWORDOPTOUTLPDWORD 33&nbsp; &nbsp;&nbsp; &nbsp; fnOPTOUTLPDWORDOPTOUTLPDWORD 34&nbsp; &nbsp;&nbsp; &nbsp; fnOUTDWORDINDWORD 35&nbsp; &nbsp;&nbsp; &nbsp; fnOUTLPRECT 36&nbsp; &nbsp;&nbsp; &nbsp; fnPOUTLPINT 37&nbsp; &nbsp;&nbsp; &nbsp; fnINLPHLPSTRUCT 38&nbsp; &nbsp;&nbsp; &nbsp; fnPOUTLPINT 39&nbsp; &nbsp;&nbsp; &nbsp; fnSENTDDEMSG 40&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTSTYLECHANGE 41&nbsp; &nbsp;&nbsp; &nbsp; fnHkINDWORD 42&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPCBTACTIVATESTRUCT 43&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPCBTCREATESTRUCT 44&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPDEBUGHOOKSTRUCT 45&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPMOUSEHOOKSTRUCTEX 46&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPKBDLLHOOKSTRUCT 47&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPMSLLHOOKSTRUCT 48&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPMSG 49&nbsp; &nbsp;&nbsp; &nbsp; fnHkINLPRECT 50&nbsp; &nbsp;&nbsp; &nbsp; fnHkOPTINLPEVENTMSG 51&nbsp; &nbsp;&nbsp; &nbsp; ClientCopyDDEIn1 52&nbsp; &nbsp;&nbsp; &nbsp; ClientCopyDDEIn2 53&nbsp; &nbsp;&nbsp; &nbsp; ClientCopyDDEOut1 54&nbsp; &nbsp;&nbsp; &nbsp; ClientCopyDDEOut2 55&nbsp; &nbsp;&nbsp; &nbsp; ClientCopyImage 56&nbsp; &nbsp;&nbsp; &nbsp; ClientEventCallback 57&nbsp; &nbsp;&nbsp; &nbsp; ClientFindMnemChar 58&nbsp; &nbsp;&nbsp; &nbsp; ClientFontSweep 59&nbsp; &nbsp;&nbsp; &nbsp; ClientFreeDDEHandle 60&nbsp; &nbsp;&nbsp; &nbsp; ClientFreeLibrary 61&nbsp; &nbsp;&nbsp; &nbsp; ClientGetCharsetInfo 62&nbsp; &nbsp;&nbsp; &nbsp; ClientGetDDEFlags 63&nbsp; &nbsp;&nbsp; &nbsp; ClientGetDDEHookData 64&nbsp; &nbsp;&nbsp; &nbsp; ClientGetListboxString 65&nbsp; &nbsp;&nbsp; &nbsp; ClientGetMessageMPH 66&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadImage 67&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadLibrary 68&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadMenu 69&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadLocalT1Fonts 70&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadRemoteT1Fonts 71&nbsp; &nbsp;&nbsp; &nbsp; ClientPSMTextOut 72&nbsp; &nbsp;&nbsp; &nbsp; ClientLpkDrawTextEx 73&nbsp; &nbsp;&nbsp; &nbsp; ClientExtTextOutW 74&nbsp; &nbsp;&nbsp; &nbsp; ClientGetTextExtentPointW 75&nbsp; &nbsp;&nbsp; &nbsp; ClientCharToWchar 76&nbsp; &nbsp;&nbsp; &nbsp; ClientAddFontResourceW 77&nbsp; &nbsp;&nbsp; &nbsp; ClientThreadSetup 78&nbsp; &nbsp;&nbsp; &nbsp; ClientDeliverUserApc 79&nbsp; &nbsp;&nbsp; &nbsp; ClientNoMemoryPopup 80&nbsp; &nbsp;&nbsp; &nbsp; ClientMonitorEnumProc 81&nbsp; &nbsp;&nbsp; &nbsp; ClientCallWinEventProc 82&nbsp; &nbsp;&nbsp; &nbsp; ClientWaitMessageExMPH 83&nbsp; &nbsp;&nbsp; &nbsp; ClientWOWGetProcModule 84&nbsp; &nbsp;&nbsp; &nbsp; ClientWOWTask16SchedNotify 85&nbsp; &nbsp;&nbsp; &nbsp; ClientImmLoadLayout 86&nbsp; &nbsp;&nbsp; &nbsp; ClientImmProcessKey 87&nbsp; &nbsp;&nbsp; &nbsp; fnIMECONTROL 88&nbsp; &nbsp;&nbsp; &nbsp; fnINWPARAMDBCSCHAR 89&nbsp; &nbsp;&nbsp; &nbsp; fnGETTEXTLENGTHS 90&nbsp; &nbsp;&nbsp; &nbsp; fnINLPKDRAWSWITCHWND 91&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadStringW 92&nbsp; &nbsp;&nbsp; &nbsp; ClientLoadOLE 93&nbsp; &nbsp;&nbsp; &nbsp; ClientRegisterDragDrop 94&nbsp; &nbsp;&nbsp; &nbsp; ClientRevokeDragDrop 95&nbsp; &nbsp;&nbsp; &nbsp; fnINOUTMENUGETOBJECT 96&nbsp; &nbsp;&nbsp; &nbsp; ClientPrinterThunk 97&nbsp; &nbsp;&nbsp; &nbsp; fnOUTLPCOMBOBOXINFO 98&nbsp; &nbsp;&nbsp; &nbsp; fnOUTLPSCROLLBARINFO</td> 
 </tr> 
 </tbody> 
 </table> </td> 
 </tr> 
 </tbody> 
</table>