ObCallback回调钩子检测

2013-12-20 Nie.Meining Coding

在 PatchGuard 的摧残下,通过 ObRegisterCallbacks 函数注册回调钩子已经成了 RK/ARK 中的主流技术之一。注册回调钩子的具体做法可以参考MSDN上的示例代码:http://code.msdn.microsoft.com/windowshardware/ObCallback-Sample-67a47841

今天研究了一下检测这类回调钩子的方法,发出来跟大家分享。本人水平有限,错漏之处还请大家指正。

首先关注的还是注册回调钩子时调用的 ObRegisterCallbacks 函数,MSDN上的函数声明如下:

NTSTATUS ObRegisterCallbacks(
	_In_   POB_CALLBACK_REGISTRATION CallBackRegistration,
	_Out_  PVOID *RegistrationHandle
);


也就是说调用该函数后,我们会得到一个神奇的 RegistrationHandle 指针,而该指针指向的数据结构必然用于描述本次注册的回调钩子(否则 ObUnRegisterCallbacks 就摘不掉钩子了)。

经过一番逆向和调试,发现这个数据结构由三个部分顺序组织在内存中:

-----------------------------------------------------------------------------------------------------

Part1:

钩子数据结构的头部信息,如版本号,CallbackOperator 个数等


Part2:(这个部分的长度取决于该回调钩子包含多少个CallbackOperator)

钩子数据结构的CallbackOperator1 相关信息

钩子数据结构的CallbackOperator2 相关信息

……


Part3:

钩子数据结构的额外信息,如 Altitude 等

-----------------------------------------------------------------------------------------------------

具体来讲,用 C 语言可以描述如下:

struct CALLBACK_NODE {
	// 版本号,目前是 0x100, 可通过 ObGetFilterVersion 获取该值
	USHORT		usVersion;

	// 本节点上有多少个 CallbackOperator,即多少个 CallbackBodies
	USHORT		usCallbackBodyCount;

	// 注册回调时设定的 OB_CALLBACK_REGISTRATION.RegistrationContext
	// 即 PreCallbackRoutine 和 PostCallbackRoutine 的参数
	PVOID		pContext;

	// 这里似乎是 0x000C000C/0x00080008 一类的值
	ULONG		ulXXX_000X000X;

	// 指向 Altitude 字符串
	// 注意这个字符串因为最大长度是恒定的,所以不一定以 NULL 结尾
	PWCHAR		wcsAltitude;

	// CALLBACK_BODY 数组,其元素个数为 ulCallbackCount
	struct CALLBACK_BODY CallbackBodies[1];
	
	//
	// CALLBACK_BODY数组后,紧接着 Altitude 字符串和一些其它数据
	//
};


其中的 struct CALLBACK_BODY CallbackBodies[] 数组就是描述该 CallbackNode 上的各个 CallbackOperator 的数据结构:

struct CALLBACK_BODY {

	// 所有的 CALLBACK_NODE 通过这个链表串在一起
	LIST_ENTRY	ListEntry;

	// 注册回调时设定的 OB_OPERATION_REGISTRATION.Operations,
	// 即 OB_OPERATION_HANDLE_CREATE 这些东西
	ULONG		ulOperations;

	// 这里似乎始终是 1
	ULONG		ulXXX_1;

	// 指向该 CallbackBody 对应的 CallbackNode
	struct CALLBACK_NODE* pCallbackNode;

	// 注册回调时设定的 OB_OPERATION_REGISTRATION.pObjectType
	// 即 PsProcessType,PsThreadType 这些东西
	PVOID		pObjectType;

	// 这就是注册回调时设定的 PreCallbackRoutine 函数地址
	PVOID		pPreCallbackRoutine;

	// 这就是注册回调时设定的 PostCallbackRoutine 函数地址
	PVOID		pPostCallbackRoutine;

	// 这里似乎是个引用计数
	ULONG		ulRefCount;

};


注意这里面的 CALLBACK_BODY.ListEntry 链表很有意思,它将系统中的其它 CALLBACK_NODE.CallbackBodies 都链在了一起。因此我们就可以通过遍历这个链表检测系统中的其它回调钩子。

检测的大致思路是,先自己调用ObRegisterCallbacks注册一个假钩子,这样就得到了一个节点,然后用这个节点开始遍历。

写了一个测试代码,在64位Win8系统上测试截图如下:

x64bd360.png

图中 CallbackDetect.sys 中钩子是我的检测模块注册的假钩子;bd0001.sys 中的钩子是百度卫士注册的钩子;其它是360注册的钩子。


完整测试代码下载(64位/32位系统通用):CallbackDetect.zip 

评论:

fedkamedfa
2021-10-10 02:41
<a href=https://kino-ep.online/serials/>
сосет хуй мужу</a> <a href="https://kino-ep.online/serials/
">
порно мужики хуесосы</a>
fedkamedfa
2021-10-10 00:22
<a href=https://kino-ep.online/serials/>
сын побрил пизду маме</a> <a href="https://kino-ep.online/serials/
">
плоские жопы</a>
ttyubadty
2021-10-09 20:51
https://hydraruzxpnew4aaf-onion.com/
<a href=https://hydraruzxpnew4aaf-onion.com/>
hydraruzxpnew4af</a> <a href="https://hydraruzxpnew4aaf-onion.com/">
Гидра 2021</a>
ttyubadty
2021-10-09 19:59
https://hydraruzxpnew4aaf-onion.com/
<a href=https://hydraruzxpnew4aaf-onion.com/>
Гидра</a> <a href="https://hydraruzxpnew4aaf-onion.com/">
Гидра darknet</a>
ttyubadty
2021-10-09 16:36
https://hydraruzxpnew4aaf-onion.com/
<a href=https://hydraruzxpnew4aaf-onion.com/>
Гидра маркетплейс</a> <a href="https://hydraruzxpnew4aaf-onion.com/">
гидра официальный сайт </a>
briunetui
2021-10-09 05:41
https://kino-ep.online/newfilms/
<a href=https://kino-ep.online/newfilms/>
маму подставила жопу</a> <a href="https://kino-ep.online/newfilms/
пожилые пидарасы
бомж жрет говно
русское порно
порно хентай
видео в жопу маме
маме хуй в рот
лесби порно
порно гермафродиты
маму подставила жопу
целку трахают
целки клитор
ласкает пизду маме
порно русская
друг сосет хуй">
порно хентай</a>
nigatreba
2021-10-07 02:59
<a href=https://hydraruzxinew4afi-onion.com/>
гидра сайт официальный</a> <a href="https://hydraruzxinew4afi-onion.com/">
gidra</a>
https://hydraruzxinew4afi-onion.com/
nigatreba
2021-10-07 00:26
<a href=https://hydraruzxinew4afi-onion.com/>
gidra</a> <a href="https://hydraruzxinew4afi-onion.com/">
гидра зеркала</a>
https://hydraruzxinew4afi-onion.com/
newtopmus
2021-10-06 00:18
It is important for any musician not only to write a track or album, but also to monetize it as profitably as possible. Make money on your creativity.

And streaming platforms play a big role in the sale of music. After all, almost every audition is paid.

Many musicians receive thousands of dollars from streaming every month. It remains to choose the right distributor who will quickly place the musician's track on the maximum number of sites.

We recommend the service https://www.newmusic.top/. This service is free for the musician, there is no need to pay anything in advance. It is enough to register, upload a track, cover art and track data.

Music distribution service New Music will quickly place tracks on over 100 sites.

The musician, in his personal account, will be able to observe the statistics on auditions. In which countries, in what quantity and in what streaming service they listened to his work. And at the beginning of the reporting period, the musician receives detailed statistics and the due fee. The artist reserves all rights. The fee (money) can be withdrawn to a bank card or to an account.

Making a piece of music is one thing. Placement on platforms is the second. And to tell music lovers about the artist's work, to advertise and become a popular performer is another thing. And sometimes it's harder than writing a hit.

Every day 60-100 thousand music tracks appear in the world. To stand out from this amount of music, to be heard is almost the main task that a musician faces.

Service managers https://www.newmusic.top/ listen to the downloaded musicians' tracks. High-quality pieces of music are sent to radio stations, playlist curators, and news reviews of new products. And all this is free for the artist.

The main requirement for a musician is to create high-quality content (music tracks) and post it through the New Music service. If you want to strengthen the advertising campaign, the managers of https://www.newmusic.top will advise, tell and help.

Another advantageous advantage of https://www.newmusic.top/ is free licensing and free placement (distribution) of covers. Covering popular songs is a very good start or rebirth for a musician. Performing covers give a powerful impetus to the recognition and popularization of the musician's creativity. After all, the original song is already popular ...

Record covers, post on streaming platforms through https://www.newmusic.top/ to get maximum monetization (profit) and recognition. And all the red tape associated with the legal registration of covers, payments of royalties, etc., managers of New Music will take over.

The only thing left for the musician is to create and get the most out of the works he has created.

<a href=https://www.newmusic.top/>
select o hits music distribution</a> <a href="https://www.newmusic.top/">
digital music distribution europe</a>
newtopmus
2021-10-05 21:49
It is important for any musician not only to write a track or album, but also to monetize it as profitably as possible. Make money on your creativity.

And streaming platforms play a big role in the sale of music. After all, almost every audition is paid.

Many musicians receive thousands of dollars from streaming every month. It remains to choose the right distributor who will quickly place the musician's track on the maximum number of sites.

We recommend the service https://www.newmusic.top/. This service is free for the musician, there is no need to pay anything in advance. It is enough to register, upload a track, cover art and track data.

Music distribution service New Music will quickly place tracks on over 100 sites.

The musician, in his personal account, will be able to observe the statistics on auditions. In which countries, in what quantity and in what streaming service they listened to his work. And at the beginning of the reporting period, the musician receives detailed statistics and the due fee. The artist reserves all rights. The fee (money) can be withdrawn to a bank card or to an account.

Making a piece of music is one thing. Placement on platforms is the second. And to tell music lovers about the artist's work, to advertise and become a popular performer is another thing. And sometimes it's harder than writing a hit.

Every day 60-100 thousand music tracks appear in the world. To stand out from this amount of music, to be heard is almost the main task that a musician faces.

Service managers https://www.newmusic.top/ listen to the downloaded musicians' tracks. High-quality pieces of music are sent to radio stations, playlist curators, and news reviews of new products. And all this is free for the artist.

The main requirement for a musician is to create high-quality content (music tracks) and post it through the New Music service. If you want to strengthen the advertising campaign, the managers of https://www.newmusic.top will advise, tell and help.

Another advantageous advantage of https://www.newmusic.top/ is free licensing and free placement (distribution) of covers. Covering popular songs is a very good start or rebirth for a musician. Performing covers give a powerful impetus to the recognition and popularization of the musician's creativity. After all, the original song is already popular ...

Record covers, post on streaming platforms through https://www.newmusic.top/ to get maximum monetization (profit) and recognition. And all the red tape associated with the legal registration of covers, payments of royalties, etc., managers of New Music will take over.

The only thing left for the musician is to create and get the most out of the works he has created.

<a href=https://www.newmusic.top/>
music distribution no annual fee</a> <a href="https://www.newmusic.top/">
music distribution near me</a>
newtopmus
2021-10-05 16:06
It is important for any musician not only to write a track or album, but also to monetize it as profitably as possible. Make money on your creativity.

And streaming platforms play a big role in the sale of music. After all, almost every audition is paid.

Many musicians receive thousands of dollars from streaming every month. It remains to choose the right distributor who will quickly place the musician's track on the maximum number of sites.

We recommend the service https://www.newmusic.top/. This service is free for the musician, there is no need to pay anything in advance. It is enough to register, upload a track, cover art and track data.

Music distribution service New Music will quickly place tracks on over 100 sites.

The musician, in his personal account, will be able to observe the statistics on auditions. In which countries, in what quantity and in what streaming service they listened to his work. And at the beginning of the reporting period, the musician receives detailed statistics and the due fee. The artist reserves all rights. The fee (money) can be withdrawn to a bank card or to an account.

Making a piece of music is one thing. Placement on platforms is the second. And to tell music lovers about the artist's work, to advertise and become a popular performer is another thing. And sometimes it's harder than writing a hit.

Every day 60-100 thousand music tracks appear in the world. To stand out from this amount of music, to be heard is almost the main task that a musician faces.

Service managers https://www.newmusic.top/ listen to the downloaded musicians' tracks. High-quality pieces of music are sent to radio stations, playlist curators, and news reviews of new products. And all this is free for the artist.

The main requirement for a musician is to create high-quality content (music tracks) and post it through the New Music service. If you want to strengthen the advertising campaign, the managers of https://www.newmusic.top will advise, tell and help.

Another advantageous advantage of https://www.newmusic.top/ is free licensing and free placement (distribution) of covers. Covering popular songs is a very good start or rebirth for a musician. Performing covers give a powerful impetus to the recognition and popularization of the musician's creativity. After all, the original song is already popular ...

Record covers, post on streaming platforms through https://www.newmusic.top/ to get maximum monetization (profit) and recognition. And all the red tape associated with the legal registration of covers, payments of royalties, etc., managers of New Music will take over.

The only thing left for the musician is to create and get the most out of the works he has created.

<a href=https://www.newmusic.top/>
music distribution help</a> <a href="https://www.newmusic.top/">
music distribution royalties</a>
miujynos
2021-10-01 19:35
https://шахта.top/
<a href=https://шахта.top/>
шахта обменник сайт</a> <a href="https://шахта.top/">
шахта официальный сайт обменник</a>
sranbiju
2021-09-16 18:13
<a href=https://onion-hydra.biz/>
гидра ссылка зеркало</a> <a href="https://onion-hydra.biz/">
цены на гидре</a>
https://onion-hydra.biz/
sranbiju
2021-09-16 14:54
<a href=https://onion-hydra.biz/>
гидра ссылка на сайт зеркало</a> <a href="https://onion-hydra.biz/">
регистрация на гидре</a>
https://onion-hydra.biz/
nijumlok
2021-09-16 02:03
https://hydra-onion-site.biz/
<a href=https://hydra-onion-site.biz/>
гидра шоп</a> <a href="https://hydra-onion-site.biz/">
адрес гидры в тор онион</a>

发表评论:

Powered by emlog