Question

我想在Windows 7 x86 VM上实现ssdt挂钩，我遵循了本指南link to guide。在我的代码中，出现了一个“未定义符号”的链接错误，该链接错误引用了我想挂接的系统调用函数。在这种情况下为“ NtCreateProcess”。

错误：函数_DriverEntry @ 8中引用的LNK2019无法解析的外部符号__imp__NtCreateProcess @ 32

LNK2001无法解析的外部符号_NtCreateProcess @ 32

我认为__declspec(dllimport)告诉链接器忽略以下事实，因为它在导入的函数中而没有定义

#include <ntddk.h>


/* The structure representing the System Service Table. */
typedef struct SystemServiceTable {
    UINT32*     ServiceTable;
    UINT32*     CounterTable;
    UINT32      ServiceLimit;
    UINT32*     ArgumentTable;
} SST;

/* Declaration of KeServiceDescriptorTable, which is exported by ntoskrnl.exe. */
__declspec(dllimport) SST KeServiceDescriptorTable;

//Required information for hooking NtCreateProcess.
__declspec(dllimport) NTSTATUS NTAPI NtCreateProcess(
    OUT PHANDLE           ProcessHandle,
    IN ACCESS_MASK        DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE             ParentProcess,
    IN BOOLEAN            InheritObjectTable,
    IN HANDLE             SectionHandle OPTIONAL,
    IN HANDLE             DebugPort OPTIONAL,
    IN HANDLE             ExceptionPort OPTIONAL);


typedef NTSTATUS(*NtCreateProcessPrototype)(
    OUT PHANDLE           ProcessHandle,
    IN ACCESS_MASK        DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE             ParentProcess,
    IN BOOLEAN            InheritObjectTable,
    IN HANDLE             SectionHandle OPTIONAL,
    IN HANDLE             DebugPort OPTIONAL,
    IN HANDLE             ExceptionPort OPTIONAL);



NtCreateProcessPrototype oldNtCreateProcess = NULL;


/*
 * Disable the WP bit in CR0 register.
 */
void DisableWP() {
    __asm {
        push edx;
        mov edx, cr0;
        and edx, 0xFFFEFFFF;
        mov cr0, edx;
        pop edx;
    }
}

/*
 * Enable the WP bit in CR0 register.
 */
void EnableWP() {
    __asm {
        push edx;
        mov edx, cr0;
        or edx, 0x00010000;
        mov cr0, edx;
        pop edx;
    }
}


/*
 * A function that hooks the 'syscall' function in SSDT.
 */
PULONG HookSSDT(PUCHAR syscall, PUCHAR hookaddr) {
    /* local variables */
    UINT32 index;
    PLONG ssdt;
    PLONG target;

    /* disable WP bit in CR0 to enable writing to SSDT */
    DisableWP();
    DbgPrint("The WP flag in CR0 has been disabled.\r\n");

    /* identify the address of SSDT table */
    ssdt = (PLONG)KeServiceDescriptorTable.ServiceTable;
    DbgPrint("The system call address is %x.\r\n", syscall);
    DbgPrint("The hook function address is %x.\r\n", hookaddr);
    DbgPrint("The address of the SSDT is: %x.\r\n", ssdt);

    /* identify 'syscall' index into the SSDT table */
    index = *((PULONG)(syscall + 0x1));
    DbgPrint("The index into the SSDT table is: %d.\r\n", index);

    /* get the address of the service routine in SSDT */
    target = (PLONG)&(ssdt[index]);
    DbgPrint("The address of the SSDT routine to be hooked is: %x.\r\n", target);

    /* hook the service routine in SSDT */
    return (PULONG)InterlockedExchange(target, (LONG)hookaddr);
}


/*
 * Hook Function.
 */
NTSTATUS Hook_NtCreateProcess(OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL) {
    /* local variables */
    NTSTATUS status;

    /* calling new instructions */
    DbgPrint("NtCreateProcess hook called.\r\n");

    /* calling old function */
    status = oldNtCreateProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ParentProcess, InheritObjectTable, SectionHandle, DebugPort, ExceptionPort);
    if (!NT_SUCCESS(status)) {
        DbgPrint("The call to original ZwQuerySystemInformation did not succeed.\r\n");
    }
    return status;
}


/*
 * DriverEntry: entry point for drivers.
 */
NTSTATUS DriverEntry(PDRIVER_OBJECT  pDriverObject, PUNICODE_STRING  pRegistryPath)
{
    NTSTATUS NtStatus = STATUS_SUCCESS;
    unsigned int uiIndex = 0;
    PDEVICE_OBJECT pDeviceObject = NULL;
    UNICODE_STRING usDriverName, usDosDeviceName;

    DbgPrint("DriverEntry Called \r\n");

    RtlInitUnicodeString(&usDriverName, L"\\Device\\MyDriver");
    RtlInitUnicodeString(&usDosDeviceName, L"\\DosDevices\\MyDriver");

    NtStatus = IoCreateDevice(pDriverObject, 0, &usDriverName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &pDeviceObject);

    if (NtStatus == STATUS_SUCCESS) {
        /* DriverUnload is required to be able to dynamically unload the driver. */
        pDriverObject->DriverUnload = MyDriver_Unload;
        pDeviceObject->Flags |= 0;
        pDeviceObject->Flags &= (~DO_DEVICE_INITIALIZING);

        /* Create a Symbolic Link to the device. MyDriver -> \Device\MyDriver */
        IoCreateSymbolicLink(&usDosDeviceName, &usDriverName);

        /* hook SSDT */
        oldNtCreateProcess = (NtCreateProcessPrototype)HookSSDT((PUCHAR)NtCreateProcess, (PUCHAR)Hook_NtCreateProcess);//linking problem is here
    }

    return NtStatus;
}

Answer 1

我认为__declspec（dllimport）告诉链接器忽略没有定义的事实，因为它在导入的函数中

用__declspec(dllimport)声明的函数仍然需要.lib文件作为导入它们的DLL，如here所示：

请注意，您的DLL用户仍然需要与导入库链接。

换句话说，您没有ntdll.lib就被圈住了，这意味着您无法构建调用NtCreateProcess的内核模式驱动程序或ntdll.dll所公开的任何其他函数。

如何在代码中为系统调用Ntcreateprocess原型修复未定义的符号？

1 个答案: