微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦！

VB6实现Ring3下直接调用Ring0层函数，反一切R3下API Hook

分类：VB作者：佚名

接论坛帖子：http://topic.csdn.net/u/20120518/18/9a00ec5c-b3d1-4a1f-9bc1-ba1a47b52463.html

例子应用如下。我只是给一个方法给大家，这个方法肯定很麻烦，有需求的人可以用。

添加Module1

Private asm_CallCode() As Byte,KiFastSystemCall&,KiIntSystemCall&
Private Declare Function CallWindowProcW& Lib "user32" (ByVal lpPrevWndFunc As Long,ByVal hWnd As Long,ByVal Msg As Long,ByVal wParam As Long,ByVal lParam As Long)
Private Declare Function LocalAlloc& Lib "kernel32" (ByVal f&,ByVal s&)
Private Declare Function LocalSize& Lib "kernel32" (ByVal m&)
Private Declare Function LocalFree& Lib "kernel32" (ByVal m&)
Private Declare Function GetModuleHandleA& Lib "kernel32" (ByVal n$)
Private Declare Function GetProcAddress& Lib "kernel32" (ByVal m&,ByVal n$)
Private Declare Function IsWow64Process& Lib "kernel32" (ByVal h&,IsWow64 As Boolean)
Private Declare Sub RtlMoveMemory Lib "kernel32" (ByVal Dst&,ByVal Src&,ByVal Size&)
Private Declare Sub PutMem1 Lib "msvbvm60" (ByVal Ptr As Long,ByVal NewVal As Byte)
Private Declare Sub PutMem2 Lib "msvbvm60" (ByVal Ptr As Long,ByVal NewVal As Integer)
Private Declare Sub PutMem4 Lib "msvbvm60" (ByVal Ptr As Long,ByVal NewVal As Long)
Private Declare Sub PutMem8 Lib "msvbvm60" (ByVal Ptr As Long,ByVal NewVal As Currency)

Public Function ReadKrnlFunctionIndex&(ByVal Name$,Optional ByVal DllFile$ = "ntdll.dll") '//读取内核函数索引
Dim pEntry&,dwIndex&
pEntry = GetProcAddress(GetModuleHandleA(DllFile),Name)
RtlMoveMemory VarPtr(dwIndex),pEntry + 1,4
ReadKrnlFunctionIndex = dwIndex
End Function

Public Function InitCallKernel() As Boolean '//这里初始化call代码
Dim bWow64 As Boolean
IsWow64Process -1,bWow64
If bWow64 Then Exit Function '//不支持x64
ReDim asm_CallCode(11)
KiFastSystemCall = GetProcAddress(GetModuleHandleA("ntdll.dll"),"KiFastSystemCall")
KiIntSystemCall = GetProcAddress(GetModuleHandleA("ntdll.dll"),"KiIntSystemCall")
If KiFastSystemCall = 0 Then Exit Function
If KiIntSystemCall = 0 Then Exit Function
asm_CallCode(0) = &HBA
RtlMoveMemory VarPtr(asm_CallCode(1)),IIf(CheckKiFastSystemCallHook,VarPtr(KiIntSystemCall),VarPtr(KiFastSystemCall)),4 '//这里检测Hook，如果KiFastSystemCall被Hook、修改，就使用KiIntSystemCall
asm_CallCode(5) = &HB8
RtlMoveMemory VarPtr(asm_CallCode(6)),VarPtr(0&),4
asm_CallCode(10) = &HFF
asm_CallCode(11) = &HD2
InitCallKernel = True
End Function

Public Function CheckKiFastSystemCallHook() As Boolean
Dim bChar As Byte
RtlMoveMemory VarPtr(bChar),KiFastSystemCall,1
If bChar = &HE9 Then CheckKiFastSystemCallHook = True: Exit Function '//检测jmp Hook
If bChar = &H68 Then CheckKiFastSystemCallHook = True: Exit Function '//检测push Hook
Dim dw3Char&
RtlMoveMemory VarPtr(dw3Char),3
If dw3Char <> 1037451 Then CheckKiFastSystemCallHook = True: Exit Function '//检测函数头
End Function

Public Function CallKernelFunction&(ByVal Name$,ByVal DllFile$,ParamArray pparam())
Dim dwIndex&
dwIndex = ReadKrnlFunctionIndex(Name,DllFile)
If dwIndex = 0 Then CallKernelFunction = -1: Exit Function
Dim ret&,i%,offset&
Dim hMem&
hMem = LocalAlloc(0,((UBound(pParam) + 2) * 5) + UBound(pParam) + 1 + 1 + 12 + 1) '//申请代码内存
offset = hMem
For i = UBound(pParam) To 0 Step -1 '//压栈
PutMem1 offset,&H68 'push Param
offset = offset + 1
PutMem4 offset,pParam(i)
offset = offset + 4
Next
PutMem1 offset,&H68 'push Return Address
PutMem4 offset + 1,VarPtr(ret)
offset = offset + 5
RtlMoveMemory VarPtr(asm_CallCode(6)),VarPtr(dwIndex),4 '//设置内核函数索引
RtlMoveMemory offset,VarPtr(asm_CallCode(0)),12 '//把初始化的代码整个复制过去，省得重造轮子
offset = offset + 12
For i = 0 To UBound(pParam) + 1 '//出栈
PutMem1 offset,&H59 'pop
offset = offset + 1
Next
PutMem1 offset,&HC3 'retn
PutMem1 hMem + LocalSize(hMem),&H90 '//nop一行代码
CallKernelFunction = CallWindowProcW(hMem,0) 'call
LocalFree hMem '//释放内存
End Function
添加Form1，一个Command1 
Private Declare Function textout& Lib "gdi32" Alias "textoutA" (ByVal DC As Long,ByVal X As Long,ByVal Y As Long,ByVal Text As String,ByVal Size As Long)
Private Declare Function CreateThread& Lib "kernel32" (Optional ByVal Attributes As Long,Optional ByVal StackSize As Long,Optional ByVal Address As Long,Optional Parameter As Long,Optional ByVal CreationFlags As Long,Optional TIDs As Long)
Private Type CONTEXT
ContextFlags As Long
Dr(5) As Long
FloatSave(111) As Byte
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Function GetAddr&(ByVal aaa&)
GetAddr = aaa
End Function

Private Sub Command1_Click()
Dim hThread&
hThread = CreateThread(0,4,0)'线程状态为暂停（开始地址为0，直接执行会崩）
MsgBox hThread
Dim i As CONTEXT
i.ContextFlags = 65543'CONTEXT_FULL
Me.Caption = CallKernelFunction("ZwGetContextThread","ntdll.dll",hThread,VarPtr(i))
i.Eip = GetAddr(AddressOf aaa)'更改执行地址
Me.Caption = CallKernelFunction("ZwSetContextThread",VarPtr(i))
CallKernelFunction "ZwResumeThread",0'恢复线程运行
End Sub

Private Sub Form_Load()
InitCallKernel
End Sub

Private Sub Form_Paint()
Dim hDC&
hDC = CallKernelFunction("GetDC","user32.dll",Me.hWnd) '频繁调用可测试稳定性
textout hDC,5,"123",3

Dim hProcess&
Dim objAttr&(5),cid&(1)
cid(0) = 1192 '改成你要打开的PID
CallKernelFunction "ZwOpenProcess",VarPtr(hProcess),2035711,VarPtr(objAttr(0)),VarPtr(cid(0))
Me.Caption = hProcess
End Sub
添加Module2 
Public Declare Function ExitThread& Lib "kernel32" (ByVal ExitStatus&)
Public Sub aaa(ByVal Param&)
Dim i&
For i = 0 To 10000
Form1.Caption = i
Next
ExitThread 0
End Sub

编译运行可测试效果

*******************************

下面这个可替换Module1，InitCallKernel时加True即可。

Private asm_CallCode() As Byte,asm_MyCallCode() As Byte,KiIntSystemCall&,MyKiFastSystemCall#
Private Declare Function CallWindowProcW& Lib "user32" (ByVal lpPrevWndFunc As Long,4
ReadKrnlFunctionIndex = dwIndex
End Function

Public Function InitCallKernel(Optional ByVal IsMySysenter As Boolean) As Boolean  '//这里初始化call代码
Dim bWow64 As Boolean
IsWow64Process -1,4 '//这里检测Hook，如果KiFastSystemCall被Hook、修改，就使用KiIntSystemCall
If IsMySysenter Then RtlMoveMemory VarPtr(asm_CallCode(1)),VarPtr(InitMyCallKernel),4 '//自己写sysenter，省得R3下被各种Hook
asm_CallCode(5) = &HB8
RtlMoveMemory VarPtr(asm_CallCode(6)),4
asm_CallCode(10) = &HFF
asm_CallCode(11) = &HD2
InitCallKernel = True
End Function

Public Function InitMyCallKernel&() '//本来不想写这招的，可见他们说各种Hook，啊那就（<ゝω·）☆
PutMem4 VarPtr(MyKiFastSystemCall),873452683
PutMem2 VarPtr(MyKiFastSystemCall) + 4,-13117
InitMyCallKernel = VarPtr(MyKiFastSystemCall)
End Function

Public Function CheckKiFastSystemCallHook() As Boolean
Dim bChar As Byte
RtlMoveMemory VarPtr(bChar),0) 'call
LocalFree hMem '//释放内存
End Function

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

VB Format函数
Format[$] ( expr [ , fmt ] ) format 返回变体型 format$ 强制返回为文本 -------------------------------- 数字类型的格式化 --------------------------------     固定格式参数：     General Number 普通数字，如可以用来去掉千位分隔号     format$("100,1
vb6/ASP FORMAT MM/DD/YYYY
VB6或者ASP 格式化时间为 MM/dd/yyyy 格式，竟然没有好的办法， Format 或者FormatDateTime 竟然结果和系统设置的区域语言的日期和时间格式相关。意思是尽管你用诸如 Format(Now, "MM/dd/yyyy")，如果系统的设置格式区域语言的日期和时间格式分隔符是"-",那他还会显示为 MM-dd-yyyy     只有拼凑： <%response.write
VB.net 捕获项目全局异常
在项目中添加如下代码：新建窗口来显示异常信息。 Namespace My ‘全局错误处理，新的解决方案直接添加本ApplicationEvents.vb 到工程即可 ‘添加后还需要一个From用来显示错误。如果到这步还不会则需要先打好基础啦 ‘======================================================== ‘以下事件
实现用VB.Net/(C#)开发K/3 BOS 插件的真正可行方法
转了这一篇文章，原来一直想用C#做k3的插件开发，vb没有C#用的爽呀，这篇文章写与2011年，看来我以前没有认真去找这个方法呀。 https://blog.csdn.net/chzjxgd/article/details/6176325 金蝶K3 BOS的插件官方是用VB6编写的，如果  能用.Net下的语言工具开发BOS插件是一件很愉快的事情，其中缘由不言而喻，而本文则是个人首创，实现在了用V
vb，wps，excel 分裂
Sub 分列() ‘以空格为分隔符，连续空格只算1个。对所选中的单元格进行处理 Dim m As Range, tmpStr As String, s As String Dim x As Integer, y As Integer, subStr As String If MsgBox("确定要分列处理吗？请确定分列的数据会覆盖它后面的单元格！", _
VB文件 hash 查看器
  窗体代码 1 Private Sub Text1_OLEDragDrop(Data As DataObject, Effect As Long, Button As Integer, Shift As Integer, X As Single, Y As Single) 2 Dim path As String, hash As String 3 For Each fil
VB.NET MYSQL DataGridView 增删改查INSERT,SELECT,UPDATE,DELETE
  Imports MySql.Data.MySqlClient Public Class Form1 ‘ GLOBAL DECLARATIONS Dim conString As String = "Server=localhost;Database=net2;Uid=root;Pwd=123456;" Dim con As New MySqlConnection
VB.NET 使用ADODB連接資料庫滙出到EXCEL
‘導入命名空間 Imports ADODB Imports Microsoft.Office.Interop   Private Sub A1() Dim Sql As String Dim Cnn As New ADODB.Connection Dim Rs As New ADODB.Recordset Dim S As String   S = "Provider=OraOLEDB.Oracl
vb.net 多线程運用 ping
Imports System.IO Imports System.Threading Imports System.Diagnostics Public Class Form1 Dim A(254) As String    Function ping(ByVal IP As Integer) As String Dim IPAddress As String IPAddress = "10.0.
VB等待进程结束
VB运行EXE程序，并等待其运行结束 参考：https://blog.csdn.net/useway/article/details/5494084 Private Declare Function WaitForSingleObject Lib "kernel32" (ByVal hHandle As Long, ByVal dwMilliseconds As Long) As Long Pr
苹果市值2025年有望达4万亿美元
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot