C++简易VT框架源码-以SyscallHook作为例子

wa123344

==玩具VT,简易框架,VMX开启支持Win10,==

==SysCallHook不支持装了KPTI补丁(双Cr3)的操作系统==

==理论支持win7-win10 21h2==

参考:

https://hbxiaock.bk-free01.com/ADDD/8ee4

https://github.com/huoji120?tab=repositories

https://revers.engineering/patch ... -instrospection-p1/

==测试系统==

版本                           Windows 10 专业版
版本号                        21H2
安装日期                     ‎2022/‎8/‎9
操作系统内部版本        19044.2075
体验                            Windows Feature Experience Pack 120.2212.4180.0


==测试效果 Hook NtOpenProcess==

1. SyscallHook::GetInsctance()->fn_syshook_init(0xfffff800832018c0, 0xfffff8008280aa90, 0xfffff800827f9630, 0xfffff8008280bbc0,FALSE);
   
2. SyscallHook::GetInsctance()->fn_add_hook_by_index(0x26, (UINT64)MyOpenProcess);

复制代码

1. NTSTATUS MyOpenProcess(        _Out_ PHANDLE ProcessHandle,
   
2.         _In_ ACCESS_MASK DesiredAccess,
   
3.         _In_ POBJECT_ATTRIBUTES ObjectAttributes,
   
4.         _In_opt_ PCLIENT_ID ClientId) {
   
5.         asm_stac();
   
6.         DbgPrintEx(77, 0, "[+]NtOpenProcess catched\r\n");
   
7.         DbgPrintEx(77, 0, "[+]Process Handle 0%llx DesiredAccess %x ClinetId %llx\r\n",ProcessHandle,DesiredAccess,ClientId);
   
8. 
   
9.         return NtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
   
10. }

复制代码

游客，如果您要查看本帖隐藏内容请回复

vipsnadong

C++简易VT框架源码-以SyscallHook作为例子