Я хочу реализовать ssdt ловушку на виртуальной машине Windows 7 x86, и я следовал этому руководству ссылка на руководство . В моем коде я получил ошибку компоновки «неопределенного символа», которая ссылается на функцию системного вызова, которую я хочу перехватить. в этом случае "NtCreateProcess".
ошибки: неразрешенный внешний символ LNK2019 __imp__NtCreateProcess @ 32, указанный в функции _DriverEntry @ 8
LNK2001 неразрешенный внешний символ _NtCreateProcess @ 32
Я думал, что __declspec(dllimport) говорит компоновщику игнорировать тот факт, что нет определения, потому что оно находится в импортированной функции
#include <ntddk.h>
/* The structure representing the System Service Table. */
typedef struct SystemServiceTable {
UINT32* ServiceTable;
UINT32* CounterTable;
UINT32 ServiceLimit;
UINT32* ArgumentTable;
} SST;
/* Declaration of KeServiceDescriptorTable, which is exported by ntoskrnl.exe. */
__declspec(dllimport) SST KeServiceDescriptorTable;
//Required information for hooking NtCreateProcess.
__declspec(dllimport) NTSTATUS NTAPI NtCreateProcess(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL);
typedef NTSTATUS(*NtCreateProcessPrototype)(
OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL);
NtCreateProcessPrototype oldNtCreateProcess = NULL;
/*
* Disable the WP bit in CR0 register.
*/
void DisableWP() {
__asm {
push edx;
mov edx, cr0;
and edx, 0xFFFEFFFF;
mov cr0, edx;
pop edx;
}
}
/*
* Enable the WP bit in CR0 register.
*/
void EnableWP() {
__asm {
push edx;
mov edx, cr0;
or edx, 0x00010000;
mov cr0, edx;
pop edx;
}
}
/*
* A function that hooks the 'syscall' function in SSDT.
*/
PULONG HookSSDT(PUCHAR syscall, PUCHAR hookaddr) {
/* local variables */
UINT32 index;
PLONG ssdt;
PLONG target;
/* disable WP bit in CR0 to enable writing to SSDT */
DisableWP();
DbgPrint("The WP flag in CR0 has been disabled.\r\n");
/* identify the address of SSDT table */
ssdt = (PLONG)KeServiceDescriptorTable.ServiceTable;
DbgPrint("The system call address is %x.\r\n", syscall);
DbgPrint("The hook function address is %x.\r\n", hookaddr);
DbgPrint("The address of the SSDT is: %x.\r\n", ssdt);
/* identify 'syscall' index into the SSDT table */
index = *((PULONG)(syscall + 0x1));
DbgPrint("The index into the SSDT table is: %d.\r\n", index);
/* get the address of the service routine in SSDT */
target = (PLONG)&(ssdt[index]);
DbgPrint("The address of the SSDT routine to be hooked is: %x.\r\n", target);
/* hook the service routine in SSDT */
return (PULONG)InterlockedExchange(target, (LONG)hookaddr);
}
/*
* Hook Function.
*/
NTSTATUS Hook_NtCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL) {
/* local variables */
NTSTATUS status;
/* calling new instructions */
DbgPrint("NtCreateProcess hook called.\r\n");
/* calling old function */
status = oldNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, InheritObjectTable, SectionHandle, DebugPort, ExceptionPort);
if (!NT_SUCCESS(status)) {
DbgPrint("The call to original ZwQuerySystemInformation did not succeed.\r\n");
}
return status;
}
/*
* DriverEntry: entry point for drivers.
*/
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath)
{
NTSTATUS NtStatus = STATUS_SUCCESS;
unsigned int uiIndex = 0;
PDEVICE_OBJECT pDeviceObject = NULL;
UNICODE_STRING usDriverName, usDosDeviceName;
DbgPrint("DriverEntry Called \r\n");
RtlInitUnicodeString(&usDriverName, L"\\Device\\MyDriver");
RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\MyDriver");
NtStatus = IoCreateDevice(pDriverObject, 0, &usDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDeviceObject);
if (NtStatus == STATUS_SUCCESS) {
/* DriverUnload is required to be able to dynamically unload the driver. */
pDriverObject->DriverUnload = MyDriver_Unload;
pDeviceObject->Flags |= 0;
pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);
/* Create a Symbolic Link to the device. MyDriver -> \Device\MyDriver */
IoCreateSymbolicLink(&usDosDeviceName, &usDriverName);
/* hook SSDT */
oldNtCreateProcess = (NtCreateProcessPrototype)HookSSDT((PUCHAR)NtCreateProcess, (PUCHAR)Hook_NtCreateProcess);//linking problem is here
}
return NtStatus;
}