SST Hook -> Bluescreen!?

[Cobi]

Hi there,
For educational purpose (?) i want to code a File/Regmon Clone, with the same method of SystemServiceTable Hooking described in "Undocumented Windows NT" but when i try to Patch i get a Bluescreen "DRIVER_IRQL_NOT_LESS_OR_EQUAL" !?

extern	PSERVICE_DESCRIPTOR_TABLE	KeServiceDescriptorTable;
#define	SYSTEMSERVICE(_function)	KeServiceDescriptorTable->ntoskrnl.ServiceTable[*(PULONG)((PUCHAR)_function+1)]

_asm cli;
(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#
_asm sti;

The System crashes directly when i try to Patch.
Is the Table in WinXP write protected or whats going on?
The whole source is attached.
Happy new Year @all
-Cobi

[goggles99]

Yes, the "System Desciptor Table" in xp is write protected...
you need to disable the WP bit in the processors CR0 register.

Hooking by modifying the "Kernel service table" is used by several publicly available rootkit packages. HE4Hook and KApiHooks are two of them...

I can't download your attachment (Not enough thankyou points or something) but trysomething like this...

_asm
{
CLI //dissable interrupt
MOV EAX, CR0 //move CR0 register into EAX
AND EAX, NOT 10000H //disable WP bit 
MOV CR0, EAX //write register back
}

(NTCREATEFILE)(SYSTEMSERVICE(ZwCreateFile)) = NewZwCreateFile; // <---#HERE#

_asm 
{
MOV EAX, CR0 //move CR0 register into EAX
OR EAX, 10000H //enable WP bit 
MOV CR0, EAX //write register back 
STI //enable interrupt
}

Hi,

And if you want some examples of SDT hooking coded entirely in assembly language, you can look at my codes in my vault "Opc0de"
in the rootkit site:

hxxp://www.rootkit.com/download.php

Maybe you need to register before you be able to download it

Regards,
Opc0de

After each blue screen, a Crash Dump file is created in "Minidump" folder at your Windows directory.

You can load this dump file into "WinDbg" (A Microsoft debugger that comes with SDKs) or other debuggers that can load this type of files, and then you analyze the reason of the crash and get usefull ideas

[Cobi]

-> It seems to work (with the writeenabled SST)
Big Thx @ all!
@hajir
I know, but i had already lokated the error exacxtly a the point where i try to write a table entry, but thx the for tip

Another bad news. Microsoft disable modify service table in 64-bit windows. It disable to modify service table and even function entry code. So such program cann't use in 64-bit windows in future.

[Cobi]

Hmm, yes, ( link ) but ->

except through authorized Microsoft-originated hot patches

(That meens "except through everyone" )

Curious if anyone has run into issues with WinXP SP2? I can hook ZwCreateFile (As I am trying to debug a rather nasty problem...) just fine, but if I want to open a file from my driver within the hook for ZwCreateFile, using the proper/original ZwCreateFile I manage to get a STATUS_ACCESS_VIOLATION.

Anyone run into this problem and have a quick solution? I have walked through the disassembly in Windbg and IDA Pro and see that everything goes bad when NtCreateFile->IoCreateFile->IopCreateFile runs into MmUserProbeAddress() on the FileHandle I supply to the original ZwCreateFile.

Any subtle insights would be greatly appreciated.

You're passing UserMode on a buffer that comes from Kernel-Mode.

How am I passing anything from UserMode? I am creating my own handle in kernel-mode to pass on to the original ZwCreateFile. Absolutely touching nothing coming from user-mode. The address of my kernel-mode allocated handle that I am passing is _valid_ for kernel-mode and not a user-mode buffer.

[Cobi]

If i understand you right you want to pass a File-Handle created by your Kernel-Mode Process to a User-Mode Process, so you could edit the File-Object and change its owner.
(ObObjectRefferenceByHandle or smth.)

Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.

Originally Posted by thewhiz

Actually no. I am hooking ZwCreateFile, within the hooked function for ZwCreateFile that I created I am trying to call the original ZwCreateFile with all attributes allocated IN kernel-space and utilized IN kernel space. Absolutely NOTHING to do with user-mode other than interceding in the middle of a user-mode application attempting to open a file. Not in anyway shape or form attempting to pass anything back to user-mode.

check out KTHREAD.PreviousMode, probably that's cause of your problem. normally you'd have to re-enter the kernel thru the Zw APIs, but since that's what you hooked you'll need some extra logic in there to pass such calls directly down (or mock with PreviousMode directly).