在windbg中测试shadow ssdt , win32k!NtUserGetForegroundWindow , hook shadow ssdt

喜欢ヅ旅行 2022-09-18 02:55 22阅读 0赞

## 在windbg中测试shadow ssdt , win32k!NtUserGetForegroundWindow , hook shadow ssdt ##

**在windbg中查看shadow ssdt：**  
  
0: kd> lm  
start end module name  
804d8000 806e3000 nt (pdb symbols) I:\\Symbols\\ntkrpamp.pdb\\966DF78E558F483199141B029DF5A9D51\\ntkrpamp.pdb  
  
Unloaded modules:  
f56ab000 f56d6000 kmixer.sys  
f7b59000 f7b5a000 drmkaud.sys  
f6fc8000 f6fd5000 DMusic.sys  
f7018000 f7026000 swmidi.sys  
f56d6000 f56f9000 aec.sys  
f7ad9000 f7adb000 splitter.sys  
f70dd000 f70e0000 wmiacpi.sys  
f79fb000 f79ff000 kbdhid.sys  
f78cf000 f78d4000 Cdaudio.SYS  
f79ef000 f79f2000 Sfloppy.SYS  
0: kd> x win32k!\* **win32k.sys的symbol文件没有被载入，此时无法查看win32k.sys的内容**。  
^ Couldn't resolve 'x win32k'  
0: kd> uf win32k!NtUserGetForegroundWindow  
Couldn't resolve error at 'win32k!NtUserGetForegroundWindow '  
0: kd> !process 0 0  
\*\*\*\* NT ACTIVE PROCESS DUMP \*\*\*\*  
PROCESS 861b5660 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000  
DirBase: 069c0020 ObjectTable: e1003e40 HandleCount: 255.  
Image: System  
  
PROCESS 85c99298 SessionId: none Cid: 0220 Peb: 7ffde000 ParentCid: 0004  
DirBase: 069c0040 ObjectTable: e1366228 HandleCount: 21.  
Image: smss.exe  
  
PROCESS 85f92ca8 SessionId: 0 Cid: 025c Peb: 7ffde000 ParentCid: 0220  
DirBase: 069c0060 ObjectTable: e13bfd50 HandleCount: 368.  
Image: csrss.exe  
......  
  
PROCESS 85b61020 SessionId: 0 Cid: 0794 Peb: 7ffdd000 ParentCid: 02a0  
DirBase: 069c0280 ObjectTable: e184ce98 HandleCount: 63.  
Image: VMwareService.exe  
  
PROCESS 85c9ab38 SessionId: 0 Cid: 06cc Peb: 7ffd4000 ParentCid: 060c  
DirBase: 069c01c0 ObjectTable: e1043768 HandleCount: 49.  
Image: notepad.exe  
  
  
0: kd> .process 85c9ab38  
Implicit process is now 85c9ab38  
WARNING: .cache forcedecodeuser is not enabled  
0: kd> .reload **重新载入符号**  
Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE  
Loading Kernel Symbols  
........................................................................................................................  
Loading User Symbols  
............................  
Loading unloaded module list  
..........  
0: kd> x win32k!\* **现在可以查看shadow ssdt了**  
bf9346be win32k!EngQueryLocalTime = <no type information>  
bf938572 win32k!NtGdiCreateEllipticRgn = <no type information>  
bf9ab110 win32k!ghwndSwitch = <no type information>  
bf9248f9 win32k!SearchAndSetKbdTbl = <no type information>  
bf92602a win32k!xxxUnlatchStickyKeys = <no type information>  
bf814d93 win32k!NtUserInvalidateRect = <no type information>  
bf98c678 win32k!\_imp\_\_IoGetStackLimits = <no type information>  
bf944f4a win32k!vTransparentCopyS32D8 = <no type information>  
bf8778da win32k!xxxMoveThumb = <no type information>  
bf85ef37 win32k!KillTooltipTimer = <no type information>  
bf8d3308 win32k!fsg\_CompositeInnerGridFit = <no type information>  
bf98c49c win32k!\_imp\_\_RtlSetOwnerSecurityDescriptor = <no type information>  
bf8687ef win32k!bCalcMeshExtent = <no type information>  
bf842cf7 win32k!xxxClientLoadMenu = <no type information>  
bf8a1307 win32k!ParkIcon = <no type information>  
......  
  
  
**uf一个函数试试：**  
  
0: kd> uf win32k!NtUserGetForegroundWindow （ **win32k!NtUserGetForegroundWindow是win32 api GetForegroundWindow()的内核实现）**  
win32k!NtUserGetForegroundWindow:  
bf823d3d 8bff mov edi,edi  
bf823d3f 56 push esi  
bf823d40 e8a4cefdff call win32k!EnterSharedCrit (bf800be9)  
bf823d45 a160b59abf mov eax,dword ptr \[win32k!gpqForeground (bf9ab560)\]  
bf823d4a 85c0 test eax,eax  
bf823d4c 7429 je win32k!NtUserGetForegroundWindow+0x33 (bf823d77)  
  
win32k!NtUserGetForegroundWindow+0x11:  
bf823d4e 83782800 cmp dword ptr \[eax+28h\],0  
bf823d52 7423 je win32k!NtUserGetForegroundWindow+0x33 (bf823d77)  
  
win32k!NtUserGetForegroundWindow+0x17:  
bf823d54 8b7028 mov esi,dword ptr \[eax+28h\]  
bf823d57 ff1560c298bf call dword ptr \[win32k!\_imp\_\_PsGetCurrentThread (bf98c260)\]  
bf823d5d 50 push eax  
bf823d5e ff15f8c798bf call dword ptr \[win32k!\_imp\_\_PsGetThreadWin32Thread (bf98c7f8)\]  
bf823d64 8b403c mov eax,dword ptr \[eax+3Ch\]  
bf823d67 3b460c cmp eax,dword ptr \[esi+0Ch\]  
bf823d6a 750b jne win32k!NtUserGetForegroundWindow+0x33 (bf823d77)  
*PVOID  
PsGetThreadWin32Thread(  
\_\_in PETHREAD Thread  
)  
\{  
return Thread->Tcb.Win32Thread;  
\}  
  
PW32THREAD W32Thread;  
PETHREAD PEThread = PsGetCurrentThread();  
W32Thread = PsGetThreadWin32Thread(PEThread);  
//不知道W32Thread和W32Thread->3Ch是什么结构  
/\*  
0: kd> dt \_W32THREAD  
win32k!\_W32THREAD  
\+0x000 pEThread : Ptr32 \_ETHREAD  
\+0x004 RefCount : Uint4B  
\+0x008 ptlW32 : Ptr32 \_TL  
\+0x00c pgdiDcattr : Ptr32 Void  
\+0x010 pgdiBrushAttr : Ptr32 Void  
\+0x014 pUMPDObjs : Ptr32 Void  
\+0x018 pUMPDHeap : Ptr32 Void  
\+0x01c dwEngAcquireCount : Uint4B  
\+0x020 pSemTable : Ptr32 Void  
\+0x024 pUMPDObj : Ptr32 Void  
3Ch是什么？  
\*/  
if( W32Thread->3Ch != \[ \[win32k!gpqForeground\]+28h +0Ch \] )\{  
return 0; //hwnd=0  
\}*  
win32k!NtUserGetForegroundWindow+0x2f:  
bf823d6c 8b36 mov esi,dword ptr \[esi\]  
  
win32k!NtUserGetForegroundWindow+0x35:  
bf823d6e e8a3cdfdff call win32k!LeaveCrit (bf800b16)  
bf823d73 8bc6 mov eax,esi  
bf823d75 5e pop esi  
bf823d76 c3 ret  
  
win32k!NtUserGetForegroundWindow+0x33:  
bf823d77 33f6 xor esi,esi  
bf823d79 ebf3 jmp win32k!NtUserGetForegroundWindow+0x35 (bf823d6e)  
  
  
  
**可以看到win32k!NtUserGetForegroundWindow()返回的值其实是 \[ \[win32k!gpqForeground\]+28h \]，我们在windbg就可以查看这个值：**  
  
0: kd> dd poi(poi(win32k!gpqForeground) +28h)  
bc6542b0 00030100 00000009 e24102c8 85c4d480  
bc6542c0 bc6542b0 40020049 80000300 00000910  
bc6542d0 14cf0000 01000000 00000000 bc66d800  
bc6542e0 bc66e010 bc6506e8 bc66e820 00000000  
bc6542f0 00000041 00000045 00000299 000001d9  
bc654300 00000045 00000077 00000295 000001d5  
bc654310 01003429 bc654230 00000000 bc66e1c8  
bc654320 00000000 00000000 bc654478 03040587  
  
**其中00030100 便是win32k!NtUserGetForegroundWindow()的返回值。  
在驱动中可以这样实现：**  
  
*ULONG ASM\_GetForeground()\{  
  
//win32k.sys不常驻内存，调用它的函数前一定要先载入gui进程  
KeAttachProcess(crsEProc);  
DbgPrint("==hwnd:%x \\n",g\_OriginalNtUserGetForegroundWindow());//  
\_\_asm\{  
;call win32k!EnterSharedCrit (bf800be9)  
;mov eax,0bf800be9h  
;call eax  
  
mov eax,0bf9ab560h ;win32k!gpqForeground.我用的是硬编码  
mov eax,dword ptr \[eax\]  
test eax,eax  
je \_failed  
  
cmp dword ptr \[eax+28h\],0  
je \_failed  
  
mov esi,dword ptr \[eax+28h\]  
mov esi,\[esi\]  
jmp \_end  
  
\_failed:  
mov esi,0  
\_end:  
;call win32k!LeaveCrit (bf800b16)  
;mov eax,0bf800b16h  
;call eax  
  
call KeDetachProcess  
  
mov eax,esi  
\}  
\}  
  
  
  
\------------------------------------------------------*  
  
**尝试一下下断点  
  
0: kd> bu win32k!\_imp\_\_PsGetThreadWin32Thread**  
WARNING: Software breakpoints on session addresses can cause bugchecks.  
Use hardware execution breakpoints (ba e) if possible.  
0: kd> bc \*  
**0: kd> ba e1 win32k!\_imp\_\_PsGetThreadWin32Thread** 必须下硬件断点，否则会导致异常！  
0: kd> bl  
0 e bf98c7f8 e 1 0001 (0001) win32k!\_imp\_\_PsGetThreadWin32Thread   
  
至此下断点成功   
  
*\------------------------------------------------------  
  
**最后是测试hook shadow ssdt 。*** **[《Hook Shadow SSDT》][Hook Shadow SSDT] 里面有参考代码.我测试了一下添加对NtUserInternalGetWindowText()的hook：**  
  
*if ( majorVersion == 5 && minorVersion == 1 )  
\{  
DbgPrint("comint32: Running on Windows XP\\n");  
NtUserFindWindowEx\_callnumber = 0x17A;  
NtUserGetForegroundWindow\_callnumber = 0x194;  
NtUserBuildHwndList\_callnumber = 0x138;  
NtUserQueryWindow\_callnumber = 0x1E3;  
NtUserWindowFromPoint\_callnumber = 0x250;  
**NtUserInternalGetWindowText\_callnumber = 0x1c1;**  
  
\}  
  
INT MyNtUserInternalGetWindowText(  
IN HWND hwnd,  
OUT LPWSTR lpString,  
IN int nMaxCount)\{  
INT result;  
result=g\_OriginalNtUserInternalGetWindowText(hwnd,lpString,nMaxCount);  
DbgPrint("MyNtUserInternalGetWindowText() hwnd:%x, lpString:%x-\\"%S\\", %d, %d\\n",hwnd,lpString,lpString,nMaxCount,result);  
return result;  
\}*  
  
  
  
![6c68e9c4055e37b68226acc9.jpg][]  
  
参考：  
**《shadow ssdt学习笔记(一)(二)》**http://bbs.pediy.com/showthread.php?t=56955  
**《Hook Shadow SSDT》** http://bbs.pediy.com/showthread.php?t=65931

[Hook Shadow SSDT]: http://bbs.pediy.com/showthread.php?t=65931
[6c68e9c4055e37b68226acc9.jpg]: /images/20220828/17d6301cc2a74293a1114a2b1827f984.png