[ C ] NtOpenProcess hook.

A ‘Crude’ method of preventing access to a program is by hooking NtOpenProcess and denying any request for a handle. Simple. The screenshot below shows what happens when I tried to terminate notepad, which at the time was ‘protected’ by this hook. A detour hook would be preferable to an SSDT pointer change as it is less detectable, but I’ll cover that some other time.

[ C – Source ] Driver.c
[ C++ – Source ] DriverControll.cpp
Download the compiled executable.
ntifs.h
NEW post regarding NtOpenProcess hooks

Operation:  Once the executable has been run and you’ve entered your target process name (with the .exe!) and you are presented with an arrow (–>), you have three commands. HOOK, UNHOOK, EXIT. They’re fairly explanatory. Unhook before you exit. Make sure you’ve spelt the process name correctly.

Ok, as with many previous things this is XP only. Both the syscall and EPROCESS offsets would need to be changed for other OS’s or SP’s. A list of both is available below:
New EPROCESS offsets for windows 7
List of current windows syscalls

This rootkit has featured in the following Academic papers:

+ “A Multi Agent-Based Framework for Network Intelligence and Intrusion Prevention – by BSc Amani Salah Eldin Abdalaziz, Prof. Mohamed Shouman, Prof. Hossam M. Faheem and Prof. Ibrahim Elhenawy”.

+ “Virtual Machines Security in IaaS Platform – by Amani Ibrahim, James Hamlyn-Harris, John Grundy (Swinburne University of Technology)”

Advertisements

~ by Rhys Mossom on October 4, 2008.

19 Responses to “[ C ] NtOpenProcess hook.”

  1. Marvellous, I wanted this desperately.

  2. Hi. I cant compile driver.c. I want create a new driver file. I want change drivername. please help me…

  3. Hey Rhys,

    Thank you for the code. I tested the binaries with notepad and it returned the result as you’ve mentioned above.
    I would like to know more about such techniques. Could you pleas help me in this? Also you’ve mentioned to changed the call number ( which I assume is NtOpenProcess_callnumber variable in the driver code ). How could I know the call number of the function in different operating systems? Did you mean the entry point? Can I open ntdll in DependencyWalker and get the entry point from there? Waiting eagerly for your help.

    Regards

    Anil

  4. Rhys,
    I tried to build the driver. In my machine, I’ve got WDK installed, latest ofcourse. I got 15 error while building using check build environement. Below is the complete build log.

    BUILD: Computing Include file dependencies:
    BUILD: Examining d:\openprocesshook\driver directory for files to compile.
    before AssemblyIdentity_AfterReadAllSources
    after AssemblyIdentity_AfterReadAllSources
    skipping post pass 0 command
    Compiling and Linking d:\openprocesshook\driver *************
    ‘nmake.exe /nologo BUILDMSG=Stop. -i BUILD_PASS=PASS2 LINKONLY=1 NOPASS0=1 MAKEDIR_RELATIVE_TO_BASEDIR= MAKEDIR_LOWERCASE=d:\openprocesshook\driver’
    d:\openprocesshook\driver: TARGETPATH is obj
    BUILDMSG: _NT_TARGET_VERSION SET TO WINXP
    cl.exe @d:\openprocesshook\driver\objchk_wxp_x86\i386\cl.rsp
    Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.220 for 80×86
    Copyright (C) Microsoft Corporation. All rights reserved.

    cl /Fo”d:\openprocesshook\driver\objchk_wxp_x86\i386/”
    /FC

    /Ii386
    /I.
    /I%BUILD%\inc
    /Id:\openprocesshook\driver\objchk_wxp_x86\i386
    /ID:\WinDDK\6000\inc\api
    /ID:\WinDDK\6000\inc\api
    /ID:\WinDDK\6000\inc\ddk
    /ID:\WinDDK\6000\inc\ddk
    /ID:\WinDDK\6000\inc\crt
    /D_X86_=1
    /Di386=1

    /DSTD_CALL
    /DCONDITION_HANDLING=1

    /DNT_INST=0
    /DWIN32=100
    /D_NT1X_=100
    /DWINNT=1
    /D_WIN32_WINNT=0x0501
    /DWINVER=0x0501
    /D_WIN32_IE=0x0603

    /DWIN32_LEAN_AND_MEAN=1
    /DDEVL=1
    /DDBG=1
    /D__BUILDMACHINE__=WinDDK
    /DFPO=0

    /D_DLL=1
    /DNDEBUG

    /DDEPRECATE_DDK_FUNCTIONS=1
    /DMSC_NOOPT
    /DNTDDI_VERSION=0x05010200

    /c
    /Zc:wchar_t-
    /Zl
    /Zp8
    /Gy
    /Gm-
    -cbstring
    /W3

    /Gz

    /hotpatch
    /EHs-c-

    /GR-
    /GF
    /GS
    /Zi
    /Od
    /Oi

    /Oy-
    /Zi
    /Fdd:\openprocesshook\driver\objchk_wxp_x86\i386\

    -DKMDF_MAJOR_VERSION=01
    -DKMDF_MINOR_VERSION=005
    /FID:\WinDDK\6000\inc\api\warning.h

    .\cntopenprocessdrver.c

    cntopenprocessdrver.c
    d:\openprocesshook\driver\cntopenprocessdrver.c(74) : error C2065: ‘KeServiceDescriptorTable’ : undeclared identifier
    errors in directory d:\openprocesshook\driver
    d:\openprocesshook\driver\cntopenprocessdrver.c(74) : error C2065: ‘KeServiceDescriptorTable’ : undeclared identifier
    d:\openprocesshook\driver\cntopenprocessdrver.c(74) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(74) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(81) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(81) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(84) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(84) : error C2223: left of ‘->ServiceTable’ must point to struct/union
    d:\openprocesshook\driver\cntopenprocessdrver.c(98) : error C2037: left of ‘ActiveProcessLinks’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(98) : error C2037: left of ‘ActiveProcessLinks’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(98) : error C2198: ‘IsListEmpty’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(98) : error C2198: ‘IsListEmpty’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(102) : error C2037: left of ‘ActiveProcessLinks’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(102) : error C2037: left of ‘ActiveProcessLinks’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(106) : error C2065: ‘EPROCESS’ : undeclared identifier
    d:\openprocesshook\driver\cntopenprocessdrver.c(106) : error C2065: ‘EPROCESS’ : undeclared identifier
    d:\openprocesshook\driver\cntopenprocessdrver.c(106) : error C2059: syntax error : ‘)’
    d:\openprocesshook\driver\cntopenprocessdrver.c(106) : error C2059: syntax error : ‘)’
    d:\openprocesshook\driver\cntopenprocessdrver.c(107) : error C2037: left of ‘ActiveThreads’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(107) : error C2037: left of ‘ActiveThreads’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(108) : error C2037: left of ‘ThreadListHead’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(108) : error C2037: left of ‘ThreadListHead’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(108) : error C2198: ‘IsListEmpty’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(108) : error C2198: ‘IsListEmpty’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : error C2037: left of ‘ImageFileName’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : error C2037: left of ‘ImageFileName’ specifies undefined struct/union ‘_EPROCESS’
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : warning C4047: ‘function’ : ‘const char *’ differs in levels of indirection from ‘size_t’
    warnings in directory d:\openprocesshook\driver
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : warning C4047: ‘function’ : ‘const char *’ differs in levels of indirection from ‘size_t’
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : warning C4024: ‘_strnicmp’ : different types for formal and actual parameter 2
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : warning C4024: ‘_strnicmp’ : different types for formal and actual parameter 2
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : error C2198: ‘_strnicmp’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(109) : error C2198: ‘_strnicmp’ : too few arguments for call
    d:\openprocesshook\driver\cntopenprocessdrver.c(118) : error C2143: syntax error : missing ‘{‘ before ‘__stdcall’
    d:\openprocesshook\driver\cntopenprocessdrver.c(118) : error C2143: syntax error : missing ‘{‘ before ‘__stdcall’
    d:\openprocesshook\driver\cntopenprocessdrver.c(119) : warning C4142: benign redefinition of type
    d:\openprocesshook\driver\cntopenprocessdrver.c(119) : warning C4142: benign redefinition of type
    link.exe /out:objchk_wxp_x86\i386\UndeadRootKit.sys /machine:ix86 @C:\DOCUME~1\Anil\LOCALS~1\Temp\nmBB.tmp
    Microsoft (R) Incremental Linker Version 8.00.50727.220
    Copyright (C) Microsoft Corporation. All rights reserved.

    /MERGE:_PAGE=PAGE
    /MERGE:_TEXT=.text
    /SECTION:INIT,d
    /OPT:REF
    /OPT:ICF
    /IGNORE:4198,4010,4037,4039,4065,4070,4078,4087,4089,4221
    /INCREMENTAL:NO
    /FULLBUILD
    /release
    /NODEFAULTLIB
    /WX
    /debug
    /debugtype:cv
    /version:6.0
    /osversion:6.0
    /functionpadmin:5
    /safeseh
    /debug
    /debugtype:cv,fixup
    /pdbcompress
    /STACK:0x40000,0x1000
    /driver
    /base:0x10000
    /align:0x80 /stub:d:\winddk\6000\lib\wxp\stub512.com
    /subsystem:native,5.01
    /entry:GsDriverEntry@8
    /out:objchk_wxp_x86\i386\UndeadRootKit.sys
    objchk_wxp_x86\i386\cntopenprocessdrver.obj
    d:\winddk\6000\lib\wxp\i386\BufferOverflowK.lib
    d:\winddk\6000\lib\wxp\i386\ntoskrnl.lib
    d:\winddk\6000\lib\wxp\i386\hal.lib
    d:\winddk\6000\lib\wxp\i386\wmilib.lib
    d:\winddk\6000\lib\wxp\i386\sehupd.lib
    LINK : fatal error LNK1181: cannot open input file ‘objchk_wxp_x86\i386\cntopenprocessdrver.obj’
    link : error LNK1181: cannot open input file ‘objchk_wxp_x86\i386\cntopenprocessdrver.obj’

    Could you please help me out?

    Regards
    Anil

  5. Rhys,

    I was able to build the cpp file in a sample project with character code set to mulitbyte and some minor changes in the code. When I tried running the exe, it asked for the executable for which I gave notepad.exe and gave HOOK. Message hooked showed up, but nothing happened. I tried with the executables which you’d provided in the site, which are working fine. What all could be the reasons?

    Regards
    Anil

  6. Rhys,

    In my immediate previous message, I’d mentioned some difficulty in running the exe from the project. I rebuild the project in Release mode(earlier it was debug), used the driver (sys file) which you provide and now its working. So thats solved. Now the earlier and the most important one is still there. I can’t build the driver on my own. Could you please help?

    Regards
    Anil

  7. You’re WDK doesnt seem to include the definitions.
    Check on msdn for the structure definitions of KeServiceDescriptorTable and try narrow it down. Their error messages are a pain and I tend to blank over to them. Sorry about my lack of replies, I’ve been living elsewhere for the past while without access to internet.
    Rhys

  8. Hello all
    any one can tell me which WDK or DDK he used to build the driver ?

    thanks for all

  9. i add this to ntifs.h ver 7600
    #ifdef _X86_
    #define HARDWARE_PTE HARDWARE_PTE_X86
    #define PHARDWARE_PTE PHARDWARE_PTE_X86
    #else
    #define HARDWARE_PTE ULONG
    #define PHARDWARE_PTE PULONG
    #endif

    #ifndef FlagOn
    #define FlagOn(_F,_SF) ((_F) & (_SF))
    #endif

    #ifndef BooleanFlagOn
    #define BooleanFlagOn(F,SF) ((BOOLEAN)(((F) & (SF)) != 0))
    #endif

    #ifndef SetFlag
    #define SetFlag(_F,_SF) ((_F) |= (_SF))
    #endif

    #ifndef ClearFlag
    #define ClearFlag(_F,_SF) ((_F) &= ~(_SF))
    #endif

    //
    // Define types that are not exported.
    //

    typedef struct _BUS_HANDLER *PBUS_HANDLER;
    typedef struct _CALLBACK_OBJECT *PCALLBACK_OBJECT;
    typedef struct _DEVICE_HANDLER_OBJECT *PDEVICE_HANDLER_OBJECT;
    typedef struct _IO_TIMER *PIO_TIMER;
    typedef struct _KINTERRUPT *PKINTERRUPT;
    typedef struct _KPROCESS *PKPROCESS ,*PRKPROCESS; //*PEPROCESS;
    typedef struct _KTHREAD *PKTHREAD, *PRKTHREAD; //*PETHREAD;
    typedef struct _OBJECT_TYPE *POBJECT_TYPE;
    typedef struct _PEB *PPEB;
    typedef struct _ACL *PACL;

    typedef struct _CACHE_MANAGER_CALLBACKS *PCACHE_MANAGER_CALLBACKS;
    typedef struct _FILE_GET_QUOTA_INFORMATION *PFILE_GET_QUOTA_INFORMATION;
    typedef struct _HANDLE_TABLE *PHANDLE_TABLE;
    typedef struct _KEVENT_PAIR *PKEVENT_PAIR;
    typedef struct _KPROCESS *PKPROCESS;
    typedef struct _KQUEUE *PKQUEUE;
    typedef struct _KTRAP_FRAME *PKTRAP_FRAME;
    typedef struct _LPC_MESSAGE *PLPC_MESSAGE;
    typedef struct _MAILSLOT_CREATE_PARAMETERS *PMAILSLOT_CREATE_PARAMETERS;
    typedef struct _MMWSL *PMMWSL;
    typedef struct _NAMED_PIPE_CREATE_PARAMETERS *PNAMED_PIPE_CREATE_PARAMETERS;
    typedef struct _OBJECT_DIRECTORY *POBJECT_DIRECTORY;
    typedef struct _PEB *PPEB;
    typedef struct _PS_IMPERSONATION_INFORMATION *PPS_IMPERSONATION_INFORMATION;
    typedef struct _SHARED_CACHE_MAP *PSHARED_CACHE_MAP;
    typedef struct _TERMINATION_PORT *PTERMINATION_PORT;
    typedef struct _VACB *PVACB;
    typedef struct _VAD_HEADER *PVAD_HEADER;
    typedef struct _PAGEFAULT_HISTORY *PPAGEFAULT_HISTORY;
    typedef struct _EPROCESS_QUOTA_BLOCK *PEPROCESS_QUOTA_BLOCK;
    typedef struct _SECTION_OBJECT *PSECTION_OBJECT;
    typedef struct _SERVICE_DESCRIPTOR_TABLE *PSERVICE_DESCRIPTOR_TABLE;

    typedef struct _KPROCESS *PKPROCESS;
    typedef struct _HANDLE_TABLE *PHANDLE_TABLE;

    extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;

    typedef PVOID PEJOB;

    typedef struct _SERVICE_DESCRIPTOR_TABLE {
    /*
    * Table containing cServices elements of pointers to service handler
    * functions, indexed by service ID.
    */
    PVOID *ServiceTable;
    /*
    * Table that counts how many times each service is used. This table
    * is only updated in checked builds.
    */
    PULONG CounterTable;
    /*
    * Number of services contained in this table.
    */
    ULONG TableSize;
    /*
    * Table containing the number of bytes of parameters the handler
    * function takes.
    */
    PUCHAR ArgumentTable;
    } SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE;

    typedef struct _KGDTENTRY {
    USHORT LimitLow;
    USHORT BaseLow;
    union {
    struct {
    UCHAR BaseMid;
    UCHAR Flags1;
    UCHAR Flags2;
    UCHAR BaseHi;
    } Bytes;
    struct {
    ULONG BaseMid : 8;
    ULONG Type : 5;
    ULONG Dpl : 2;
    ULONG Pres : 1;
    ULONG LimitHi : 4;
    ULONG Sys : 1;
    ULONG Reserved_0 : 1;
    ULONG Default_Big : 1;
    ULONG Granularity : 1;
    ULONG BaseHi : 8;
    } Bits;
    } HighWord;
    } KGDTENTRY, *PKGDTENTRY;

    typedef struct _KIDTENTRY {
    USHORT Offset;
    USHORT Selector;
    USHORT Access;
    USHORT ExtendedOffset;
    } KIDTENTRY, *PKIDTENTRY;

    typedef struct _KPROCESS {
    DISPATCHER_HEADER Header;
    LIST_ENTRY ProfileListHead;
    ULONG DirectoryTableBase[2];
    KGDTENTRY LdtDescriptor;
    KIDTENTRY Int21Descriptor;
    USHORT IopmOffset;
    UCHAR Iopl;
    UCHAR Unused;
    ULONG ActiveProcessors;
    ULONG KernelTime;
    ULONG UserTime;
    LIST_ENTRY ReadyListHead;
    SINGLE_LIST_ENTRY SwapListEntry;
    PVOID VdmTrapcHandler;
    LIST_ENTRY ThreadListHead;
    KSPIN_LOCK ProcessLock;
    KAFFINITY Affinity;
    USHORT StackCount;
    CHAR BasePriority;
    CHAR ThreadQuantum;
    BOOLEAN AutoAlignment;
    UCHAR State;
    UCHAR ThreadSeed;
    BOOLEAN DisableBoost;
    UCHAR PowerState;
    BOOLEAN DisableQuantum;
    UCHAR IdealNode;
    UCHAR Spare;
    } KPROCESS, *PKPROCESS;

    typedef struct _HARDWARE_PTE_X86 {
    ULONG Valid : 1;
    ULONG Write : 1;
    ULONG Owner : 1;
    ULONG WriteThrough : 1;
    ULONG CacheDisable : 1;
    ULONG Accessed : 1;
    ULONG Dirty : 1;
    ULONG LargePage : 1;
    ULONG Global : 1;
    ULONG CopyOnWrite : 1;
    ULONG Prototype : 1;
    ULONG reserved : 1;
    ULONG PageFrameNumber : 20;
    } HARDWARE_PTE_X86, *PHARDWARE_PTE_X86;

    typedef struct _EX_FAST_REF {
    union {
    PVOID Object;
    ULONG RefCnt : 3;
    ULONG Value;
    };
    } EX_FAST_REF, *PEX_FAST_REF;

    typedef struct _EX_PUSH_LOCK {
    union {
    struct {
    ULONG Waiting : 1;
    ULONG Exclusive : 1;
    ULONG Shared : 30;
    };
    ULONG Value;
    PVOID Ptr;
    };
    } EX_PUSH_LOCK, *PEX_PUSH_LOCK;

    typedef struct _DEVICE_MAP {
    POBJECT_DIRECTORY DosDevicesDirectory;
    POBJECT_DIRECTORY GlobalDosDevicesDirectory;
    ULONG ReferenceCount;
    ULONG DriveMap;
    UCHAR DriveType[32];
    } DEVICE_MAP, *PDEVICE_MAP;

    typedef struct _SE_AUDIT_PROCESS_CREATION_INFO {
    POBJECT_NAME_INFORMATION ImageFileName;
    } SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO;

    typedef struct _MMSUPPORT_FLAGS {
    ULONG SessionSpace : 1;
    ULONG BeingTrimmed : 1;
    ULONG SessionLeader : 1;
    ULONG TrimHard : 1;
    ULONG MaximumWorkingSetHard : 1;
    ULONG ForceTrim : 1;
    ULONG MinimumWorkingSetHard : 1;
    ULONG Available0 : 1;
    ULONG MemoryPriority : 8;
    ULONG GrowWsleHash : 1;
    ULONG AcquiredUnsafe : 1;
    ULONG Available : 14;
    } MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;

    typedef struct _MMSUPPORT {
    LIST_ENTRY WorkingSetExpansionLinks;
    LARGE_INTEGER LastTrimTime; // 0x8
    MMSUPPORT_FLAGS Flags; // 0x10
    ULONG PageFaultCount; // 0x14
    ULONG PeakWorkingSetSize; // 0x18
    ULONG GrowthSinceLastEstimate; // 0x1c
    ULONG MinimumWorkingSetSize; // 0x20
    ULONG MaximumWorkingSetSize; // 0x24
    PMMWSL VmWorkingSetList; // 0x28
    ULONG Claim; // 0x2c
    ULONG NextEstimationSlot; // 0x30
    ULONG NextAgingSlot; // 0x34
    ULONG EstimatedAvailable; // 0x38
    ULONG WorkingSetSize; //0x3c
    KGUARDED_MUTEX Mutex; // 0x40
    } MMSUPPORT, *PMMSUPPORT;

    typedef struct _EPROCESS
    {
    KPROCESS Pcb;
    EX_PUSH_LOCK ProcessLock;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER ExitTime;
    EX_RUNDOWN_REF RundownProtect;
    PVOID UniqueProcessId;
    LIST_ENTRY ActiveProcessLinks;
    ULONG QuotaUsage[3];
    ULONG QuotaPeak[3];
    ULONG CommitCharge;
    ULONG PeakVirtualSize;
    ULONG VirtualSize;
    LIST_ENTRY SessionProcessLinks;
    PVOID DebugPort;
    PVOID ExceptionPort;
    PHANDLE_TABLE ObjectTable;
    EX_FAST_REF Token;
    FAST_MUTEX WorkingSetLock;
    ULONG WorkingSetPage;
    FAST_MUTEX AddressCreationLock;
    KSPIN_LOCK HyperSpaceLock;
    PETHREAD ForkInProgress;
    ULONG HardwareTrigger;
    PVOID VadRoot;
    PVOID VadHint;
    PVOID CloneRoot;
    ULONG NumberOfPrivatePages;
    ULONG NumberOfLockedPages;
    PVOID Win32Process;
    PEJOB Job;
    PSECTION_OBJECT SectionObject;
    PVOID SectionBaseAddress;
    PEPROCESS_QUOTA_BLOCK QuotaBlock;
    PPAGEFAULT_HISTORY WorkingSetWatch;
    PVOID Win32WindowStation;
    PVOID InheritedFromUniqueProcessId;
    PVOID LdtInformation;
    PVOID VadFreeHint;
    PVOID VdmObjects;
    PDEVICE_MAP DeviceMap;
    LIST_ENTRY PhysicalVadList;
    union
    {
    HARDWARE_PTE PageDirectoryPte;
    ULONGLONG Filler;
    };
    PVOID Session;
    UCHAR ImageFileName[16];
    LIST_ENTRY JobLinks;
    PVOID LockedPageList;
    LIST_ENTRY ThreadListHead;
    PVOID SecurityPort;
    PVOID PaeTop;
    ULONG ActiveThreads;
    ULONG GrantedAccess;
    ULONG DefaultHardErrorProcessing;
    NTSTATUS LastThreadExitStatus;
    PPEB Peb;
    EX_FAST_REF PrefetchTrace;
    LARGE_INTEGER ReadOperationCount;
    LARGE_INTEGER WriteOperationCount;
    LARGE_INTEGER OtherOperationCount;
    LARGE_INTEGER ReadTransferCount;
    LARGE_INTEGER WriteTransferCount;
    LARGE_INTEGER OtherTransferCount;
    ULONG CommitChargeLimit;
    ULONG CommitChargePeek;
    PVOID AweInfo;
    SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
    MMSUPPORT Vm;
    ULONG LastFaultCount;
    ULONG ModifiedPageCount;
    ULONG NumberOfVads;
    ULONG JobStatus;
    union
    {
    ULONG Flags;
    struct
    {
    ULONG CreateReported : 1;
    ULONG NoDebugInherit : 1;
    ULONG ProcessExiting : 1;
    ULONG ProcessDelete : 1;
    ULONG Wow64SplitPages : 1;
    ULONG VmDeleted : 1;
    ULONG OutswapEnabled : 1;
    ULONG Outswapped : 1;
    ULONG ForkFailed : 1;
    ULONG HasPhysicalVad : 1;
    ULONG AddressSpaceInitialized : 2;
    ULONG SetTimerResolution : 1;
    ULONG BreakOnTermination : 1;
    ULONG SessionCreationUnderway : 1;
    ULONG WriteWatch : 1;
    ULONG ProcessInSession : 1;
    ULONG OverrideAddressSpace : 1;
    ULONG HasAddressSpace : 1;
    ULONG LaunchPrefetched : 1;
    ULONG InjectInpageErrors : 1;
    ULONG Unused : 11;
    };
    };
    NTSTATUS ExitStatus;
    USHORT NextPageColor;
    union
    {
    struct
    {
    UCHAR SubSystemMinorVersion;
    UCHAR SubSystemMajorVersion;
    };
    USHORT SubSystemVersion;
    };
    UCHAR PriorityClass;
    BOOLEAN WorkingSetAcquiredUnsafe;
    } EPROCESS, *PEPROCESS;

    the driver compile good but my computer make restart when i try use ur exe with the driver i compiled
    if u can tell me what is the wrong here it will be great from u
    thanks

  10. My installed version of WDK is 6001.18001.

  11. hello
    thanks for ur replay
    but i want to know what is EPROCESS structure u used or from where u get it ?

  12. […] have attached an updated version of my NtOpenProcessHook below with the fix. The hack (this is too crude to be a fix!) lies in the RetrievePID() function. […]

  13. Hi,

    I can’t seem to download the sources, is the link broken?

  14. Can you give me the content of Makefile Plz … I cant compile driver.c

    @Sorry for my english

  15. Hi !
    gianghoplus my MAKEFILE has this text on it:

    !INCLUDE $(NTMAKEENV)\makefile.def

    just that line

    Mr Rhys Awesome code 😄
    and that ntifs.h helped a lot
    Good Luck

  16. Hi Mr Rhys;

    Sorry! because i’m spupid.

    I try build by WinDDK but falure.

    Can you give me full project (makefile, makefile.def, source … ect…) -> zip

    Thanks so much!

    ————-
    @Sorry for my english

  17. My error:

    Microsoft (R) Program Maintenance Utility Version 9.00.30729.207
    Copyright (C) Microsoft Corporation. All rights reserved.

    BUILDMSG: _NT_TARGET_VERSION SET TO WINXP
    C:\WinDDK\7600.16385.1\bin\makefile.new(7117) : fatal error U1087: cannot have :
    and :: dependents for same target
    Stop.

    C:\Documents and Settings\Nghiatd\Desktop\DriverHook\myDriv>

  18. Hi,
    Is there Any way we can hook the same function without using the or knowing the call_number

  19. Hi guys, sorry for not getting back to anyone. Been absent the last few years. The eprocess structures have changed, but the one I was using beforehand is available on my blog in multiple posts. As everyone should know by now all the syscalls have changed post windows sp3 (what all my code here was written and tested on). I will be posting all the updated syscall offsets as well as the eprocess structure offsets (which was partially addressed in a previous post).
    As for my make file:
    !INCLUDE $(NTMAKEENV)\makefile.def

    and my sources file:
    TARGETNAME=rhysdriver
    TARGETPATH=Release
    TARGETTYPE=DRIVER
    SOURCES=Driver.c

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: