Question

我使用以下代码为`NtCreateSection`函数制作了一个WOW64系统调用钩子：

#include "Funcs.h"
#include <cstdio>
#include <Windows.h>

const int PAGE_SIZE = 0x1000;
const int SYSCALL_INTERCEPT = 0x4A;
const int NUM_WOW64_BYTES = 0x9;

using pNtCreateSection =
NTSTATUS (NTAPI*)(PHANDLE SectionHandle, ULONG DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
                  PLARGE_INTEGER MaximumSize, ULONG PageAttributess, ULONG SectionAttributes, HANDLE FileHandle);
pNtCreateSection NtCreateSection = nullptr;

DWORD_PTR dwWow64Address = 0;
LPVOID lpJmpRealloc = nullptr;
ULONG SectionAttributes;

void __declspec(naked) NtCreateSectionHook()
{
    __asm
    {
        pushad
    }

    fprintf(stderr, "NtCreateSectionHook called !\n");

    __asm
    {
        popad
        jmp lpJmpRealloc
    }
}

DWORD_PTR __declspec(naked) GetWow64Address()
{
    __asm
    {
        mov eax, dword ptr fs:[0xC0]
        ret
    }
}

void __declspec(naked) Wow64Trampoline()
{
    __asm
    {
        cmp eax, SYSCALL_INTERCEPT
        jz NtCreateSectionHook
        jmp lpJmpRealloc
    }
}

LPVOID CreateNewJump(const DWORD_PTR dwWow64Address)
{
    lpJmpRealloc = VirtualAlloc(nullptr, PAGE_SIZE, MEM_RESERVE | MEM_COMMIT,
        PAGE_EXECUTE_READWRITE);

    (void)memcpy(lpJmpRealloc, (const void *)dwWow64Address, NUM_WOW64_BYTES);

    return lpJmpRealloc;
}

void EnableWow64Redirect(const DWORD_PTR dwWow64Address, const LPVOID lpNewJumpLocation)
{
    unsigned char trampolineBytes[] =
    {
        0x68, 0xDD, 0xCC, 0xBB, 0xAA,       /*push 0xAABBCCDD*/
        0xC3,                               /*ret*/
        0xCC, 0xCC, 0xCC                    /*padding*/
    };

    memcpy(&trampolineBytes[1], &lpNewJumpLocation, sizeof(DWORD_PTR));
    WriteJump(dwWow64Address, trampolineBytes, sizeof trampolineBytes);
}

void WriteJump(const DWORD_PTR dwWow64Address, const void *pBuffer, size_t ulSize)
{
    DWORD dwOldProtect = 0;
    (void)VirtualProtect(reinterpret_cast<LPVOID>(dwWow64Address), PAGE_SIZE, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    (void)memcpy(reinterpret_cast<void *>(dwWow64Address), pBuffer, ulSize);
    (void)VirtualProtect(reinterpret_cast<LPVOID>(dwWow64Address), PAGE_SIZE, dwOldProtect, &dwOldProtect);
}

int main(int argc, char *argv[])
{
    const auto hModule = GetModuleHandle(L"ntdll.dll");
    NtCreateSection = reinterpret_cast<pNtCreateSection>(GetProcAddress(hModule, "NtCreateSection"));

    dwWow64Address = GetWow64Address();

    const auto lpNewJumpLocation = CreateNewJump(dwWow64Address);
    EnableWow64Redirect(dwWow64Address, static_cast<LPVOID>(Wow64Trampoline));

    //Test syscall
    HANDLE hSection;
    NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_EXECUTE_READWRITE, SEC_COMMIT | SEC_NOCHANGE, nullptr);

    getchar();

    return 0;
}

在我将钩子函数更改为此之前，代码工作正常

void __declspec(naked) NtCreateSectionHook()
{
    __asm
    {
        pushad
        mov eax, [esp + 28]
        mov SectionAttributes, eax
    }

    fprintf(stderr, "NtCreateSectionHook called !\n");

    if ((SectionAttributes & SEC_NOCHANGE) != 0)
    {
        fprintf(stderr, "SEC_NOCHANGE found !\n");
    }

    __asm
    {
        popad
        jmp lpJmpRealloc
    }
}

我的代码中的问题是pushad指令与esp混为一谈，因此我无法再访问堆栈，并且如果我不使用pushad/popap，则由于弄乱堆栈，然后跳转到实函数地址。我想访问和更改的参数是NtCreateSection的第六个参数 function。

Answer 1

pushad不会阻止您访问堆栈。 pushad将32个字节（8个寄存器，每个4个字节）压入堆栈，因此，pushad之后的任何偏移都应加32。

__declspec（naked）函数中的x86 asm访问和编辑stdcall函数参数

1 个答案: