4. Nt Api Hook Asm + hook function
以 Hook NtQuerySystemInformation 為例
當 SystemInformationClass == SystemProcessInformation 時
印出 pid 跟 process image name
Assembly.asm
; ASSEMBLE CODE
; Exportation
PUBLIC BossInvincible
PUBLIC AttackNoDelay
PUBLIC NtQuerySystemInformation_Orig
; Importation
EXTERN g_controlData_Enable_BossInvincible:QWORD
EXTERN g_controlData_Enable_NoDelay:QWORD
EXTERN g_controlData_NoDelayValue:QWORD
; Declaration
.DATA
g_noDelayCount DB 00H
; Implementation
.CODE
BossInvincible PROC
mov rcx, [g_controlData_Enable_BossInvincible]
cmp byte ptr [rcx], 01H
je BossInvincible_Enable
mov rcx, 140531EC0H
push rcx
mov ecx, [rcx+00000850H]
ret
BossInvincible_Enable:
mov eax,01H
ret
BossInvincible ENDP
AttackNoDelay PROC
mov rcx, [g_controlData_Enable_NoDelay]
cmp byte ptr [rcx], 01H
jne AttackNoDelay_Orig
mov rcx, [g_controlData_NoDelayValue]
mov al, byte ptr [rcx]
cmp byte ptr [g_noDelayCount], al
jae AttackNoDelay_Orig
inc byte ptr [g_noDelayCount]
jmp SkipSetAction
AttackNoDelay_Orig:
mov byte ptr [g_noDelayCount], 0
mov [rsi+00000864H],r13d
SkipSetAction:
mov rax,[r14]
mov [rsp+20H],ebx
mov rcx,1434F9CD7H
jmp rcx
AttackNoDelay ENDP
NtQuerySystemInformation_Orig PROC
mov r10,rcx
mov eax,00000036H
syscall
ret
NtQuerySystemInformation_Orig ENDP
END
複製代碼
dllmain.cpp
#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers