FucnTS.cpp

///////////////////////////////////////////////////////////////////////////////
///
/// Copyright (c) 2023 - ultracage(rsa)
///
/// Original filename: FucnTS.c
/// Project          : FucnTS
/// Date of creation : 2023-02-18
/// Author(s)        : <author name(s)>
///
/// Purpose          : <description>
///
/// Revisions:
///  0000 [2023-02-18] Initial revision.
///
///////////////////////////////////////////////////////////////////////////////

// $Id$


#include "FucnTS.h"




#ifdef __cplusplus
namespace { // anonymous namespace to limit the scope of this global variable!
#endif
PDRIVER_OBJECT pdoGlobalDrvObj = 0;
#ifdef __cplusplus
}; // anonymous namespace
#endif

EXTERN_C SSDT KeServiceDescriptorTable;

VOID (*g_uOldUnLoad)(IN PDRIVER_OBJECT DriverObject);
// ULONG g_uOldUnLoad = 0;
BOOLEAN g_bUnLoad = FALSE;
ULONG g_uDnfPid = 0;

NTSTATUS
NtQueryPerformanceCounter (__out PLARGE_INTEGER PerformanceCounter,
						   __out_opt PLARGE_INTEGER PerformanceFrequency)
{
	return STATUS_SUCCESS;
}

NTSTATUS FUCNTS_DispatchCreateClose(
    IN PDEVICE_OBJECT		DeviceObject,
    IN PIRP					Irp
    )
{
    NTSTATUS status = STATUS_SUCCESS;
    Irp->IoStatus.Status = status;
    Irp->IoStatus.Information = 0;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}

NTSTATUS FUCNTS_DispatchDeviceControl(
    IN PDEVICE_OBJECT		DeviceObject,
    IN PIRP					Irp
    )
{
    NTSTATUS status = STATUS_SUCCESS;
    PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);

    switch(irpSp->Parameters.DeviceIoControl.IoControlCode)
    {
    case IOCTL_Memeory:
        { 
            // KiAttachProcess
            // NtReadVritualMemory
            // NtWriteVirtualMemory
            // NtOpenProcess
            // NtOpenThread
            // KdBreakPoint(); 

            Irp->IoStatus.Information = 0;
            status = STATUS_SUCCESS;
        }
        break;
    case IOCTL_UNMemeory:
        { 


            Irp->IoStatus.Information = 0;
            status = STATUS_SUCCESS;
        }
        break;
    default:
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        Irp->IoStatus.Information = 0;
        break;
    }

    status = Irp->IoStatus.Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return status;
}


VOID FUCNTS_DriverUnload(
    IN PDRIVER_OBJECT		DriverObject
    )
{

    KdBreakPoint();
    PDEVICE_OBJECT pdoNextDeviceObj = pdoGlobalDrvObj->DeviceObject;
    IoDeleteSymbolicLink(&usSymlinkName);

    if (g_uOldUnLoad = 0)
    {
        UnHookTsUnLoad();
    }
    if (!g_bUnLoad)
    {
        ULONG uCurrentBuild = 0;
        PsGetVersion(NULL, NULL, &uCurrentBuild, NULL);
 
        if (uCurrentBuild == 2600) // xp
        {

            UnHookSSDT(g_uOldNtReadVirtualMemoryAddr, 0xba);
            UnHookSSDT(g_uOldNtWriteVirtualMemoryAddr, 0x115);
        }
        else if (uCurrentBuild == 3790) // 2003
        {

            UnHookSSDT(g_uOldNtReadVirtualMemoryAddr, 0xc2);
            UnHookSSDT(g_uOldNtWriteVirtualMemoryAddr, 0x11f);
        }
        EnableNtOpenProcessHook(FALSE);
        EnableNtOpenThreadHook(FALSE);
        //EnableZwOpenProcsssook(0, FALSE);
    }

    // EnableNtCreateFileHook(0, FALSE);
    // Delete all the device objects
    while(pdoNextDeviceObj)
    {
        PDEVICE_OBJECT pdoThisDeviceObj = pdoNextDeviceObj;
        pdoNextDeviceObj = pdoThisDeviceObj->NextDevice;
        IoDeleteDevice(pdoThisDeviceObj);
    }
}

#ifdef __cplusplus
extern "C" {
#endif
NTSTATUS DriverEntry( IN OUT PDRIVER_OBJECT   DriverObject,  IN PUNICODE_STRING      RegistryPath  )
{
    KdBreakPoint();
    PDEVICE_OBJECT pdoDeviceObj = 0;
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    pdoGlobalDrvObj = DriverObject;

    // Create the device object.
    if(!NT_SUCCESS(status = IoCreateDevice(
        DriverObject,
        0,
        &usDeviceName,
        FILE_DEVICE_UNKNOWN,
        FILE_DEVICE_SECURE_OPEN,
        FALSE,
        &pdoDeviceObj
        )))
    {
        // Bail out (implicitly forces the driver to unload).
        return status;
    };

    // Now create the respective symbolic link object
    if(!NT_SUCCESS(status = IoCreateSymbolicLink(
        &usSymlinkName,
        &usDeviceName
        )))
    {
        IoDeleteDevice(pdoDeviceObj);
        return status;
    }

    // NOTE: You need not provide your own implementation for any major function that
    //       you do not want to handle. I have seen code using DDKWizard that left the
    //       *empty* dispatch routines intact. This is not necessary at all!
    DriverObject->MajorFunction[IRP_MJ_CREATE] =
    DriverObject->MajorFunction[IRP_MJ_CLOSE] = FUCNTS_DispatchCreateClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = FUCNTS_DispatchDeviceControl;
    DriverObject->DriverUnload = FUCNTS_DriverUnload;
    
    ULONG uImageBase = 0;


//     HookTsUnLoad();
// 
//     // KdBreakPoint(); 
// 
    if (DisDebugZero())
    {
        Hook(); 
    }


    return STATUS_SUCCESS;
}



#ifdef __cplusplus
}; // extern "C"
#endif

 
#pragma  LOCKEDCODE
BOOLEAN IsOpenPAE()
{
    ULONG uCR4 = 0;
    __asm
    {
        _emit 0x0F 
        _emit 0x20
        _emit 0xE0
        mov uCR4, eax
    }
 
    if ((uCR4 & 0x00000020) == 0x00000020)
    {
        return TRUE;
    }
    else
    {
        return FALSE;
    }
}

#pragma  LOCKEDCODE
VOID GetKernelFileName(PWCHAR pszKernelName)
{
    PWCHAR pszFullName = (IsOpenPAE() ? L"\\SystemRoot\\system32\\ntkrnlpa.exe" :
        L"\\SystemRoot\\system32\\ntoskrnl.exe");
    RtlCopyMemory(pszKernelName, 
              pszFullName, 
              wcslen(pszFullName) * sizeof(WCHAR) + sizeof(WCHAR));
}



PVOID GetKernelBase(PVOID pRawData, PANSI_STRING pFuncName, ULONG uFuncAddr)
{ 
    // PVOID pFuncAddr = MiFindExportedRoutineByNameByRaw(pRawData, pFuncName);

    PVOID pFuncRva = MiFindExportedRoutineRvaByNameByRaw(pRawData, pFuncName);
    if (pFuncRva == NULL)
    {
        return NULL;
    }
    // 8082d1f0 - 80800000 = 0x2d1f0; 
    PVOID pKernelBase = (PVOID)(uFuncAddr - (ULONG)pFuncRva);
    return pKernelBase;
}

NTSTATUS OpenKernelFile(PULONG puKernelBase, PULONG puImageBase)
{

    WCHAR szKernelName[MAX_PATH];
    RtlZeroMemory(szKernelName, MAX_PATH * 2);
    GetKernelFileName(szKernelName);
    KdPrint(("the kernel file's name is %ws\n", szKernelName));

    OBJECT_ATTRIBUTES ObjectAttributes;
    UNICODE_STRING uniKernelName;
    RtlInitUnicodeString(&uniKernelName, szKernelName);

    InitializeObjectAttributes(&ObjectAttributes, 
        &uniKernelName, 
        OBJ_CASE_INSENSITIVE, 
        NULL, 
        NULL);

    HANDLE hFile = NULL;
    IO_STATUS_BLOCK  IoStatusBlock;
    NTSTATUS FileStatus = ZwCreateFile(&hFile, 
        GENERIC_READ, 
        &ObjectAttributes, 
        &IoStatusBlock, 
        NULL, 
        FILE_ATTRIBUTE_NORMAL, 
        FILE_SHARE_READ, 
        FILE_OPEN, 
        FILE_SYNCHRONOUS_IO_NONALERT, 
        NULL, 
        0);
    if (!NT_SUCCESS(FileStatus))
    {
        KdPrint(("Open File fails\n"));
        return FileStatus;

    } 
    FILE_STANDARD_INFORMATION fsi;
    FileStatus = ZwQueryInformationFile(hFile, 
        &IoStatusBlock, 
        &fsi, 
        sizeof(FILE_STANDARD_INFORMATION), 
        FileStandardInformation);
    if (!NT_SUCCESS(FileStatus))
    {
        KdPrint(("get file length fails\n"));
        return FileStatus;
    }

    KdPrint(("file length:%u\n", fsi.EndOfFile.QuadPart));
 
    ULONG uRawDataSize = (ULONG)fsi.EndOfFile.QuadPart;
    PUCHAR pRawData = (PUCHAR)ExAllocatePool(NonPagedPool, uRawDataSize);
    RtlZeroMemory(pRawData, uRawDataSize);
    if (pRawData == NULL)
    {
        KdPrint(("ExAllocatePool file memory fails\n"));
        return STATUS_MEMORY_NOT_ALLOCATED;
    }

    FileStatus = ZwReadFile(hFile, 
        NULL, 
        NULL, 
        NULL, 
        &IoStatusBlock, 
        pRawData,
        uRawDataSize,
        NULL, 
        NULL);

    if (!NT_SUCCESS(FileStatus))
    {
        KdPrint(("ZwReadFile file fails\n"));
        return FileStatus;
    }
    if (uRawDataSize != IoStatusBlock.Information)
    {
        KdPrint(("read file size error\n"));
        return FileStatus;
    }

    if (hFile != NULL)
    {
        ZwClose(hFile);
        hFile = NULL;
    }
 
    if (((PIMAGE_DOS_HEADER)pRawData)->e_magic != IMAGE_DOS_SIGNATURE) 
    {
        return STATUS_INVALID_IMAGE_FORMAT;
    }

    PIMAGE_NT_HEADERS pNtHeader = RtlImageNtHeader(pRawData);
    if (pNtHeader == NULL)
    {
        return STATUS_UNSUCCESSFUL;
    }
    if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) 
    {
        return STATUS_INVALID_IMAGE_FORMAT;
    }

    ANSI_STRING FuncName;
    RtlInitAnsiString(&FuncName, "ZwPulseEvent");
    PVOID pKernelBase = GetKernelBase(pRawData, &FuncName, (ULONG)ZwPulseEvent);
    if (pKernelBase == NULL)
    {
        return STATUS_UNSUCCESSFUL;
    }
    ULONG uSizeOfImage = pNtHeader->OptionalHeader.SizeOfImage;
    PUCHAR pImageBase = (PUCHAR)ExAllocatePool(NonPagedPool, uSizeOfImage);
    RtlZeroMemory(pImageBase, uSizeOfImage);
    if (pImageBase == NULL)
    {
        KdPrint(("ExAllocatePool file memory fails\n"));
        return STATUS_MEMORY_NOT_ALLOCATED;
    }
    NTSTATUS status = 0;
    PUCHAR  UserModeZwPulseEvent = NULL;
    LoadImage(pImageBase, pRawData);
    LdrRelocateImage(pImageBase, uSizeOfImage, (ULONG)pKernelBase);

    *puImageBase = (ULONG)pImageBase;
    *puKernelBase = (ULONG)pKernelBase;
    if (pRawData != NULL)
    {
        ExFreePool(pRawData);
        pRawData = NULL;
    }
    return STATUS_SUCCESS;
}

#pragma LOCKEDCODE
ULONG GetSSDTAddr(ULONG KernelBase, ULONG ImageBase, ULONG uIndex)
{
    ULONG SSDTAddr = 0; 
    ULONG uSSDTVa = *(PULONG)KeServiceDescriptorTable.ServiceTableBase 
        - KernelBase + ImageBase;
    SSDTAddr = *(PULONG)(uSSDTVa + uIndex * 4);
    return SSDTAddr;
}

#pragma LOCKEDCODE
void CopyFuncByte(ULONG uNewAddr, ULONG uOlduAddr, ULONG uFuncAddr)
{
    ULONG OldLen = DisassembleUntil((PUCHAR)uOlduAddr, 6);

    CliAndDisableWP();
    RtlMoveMemory((PCHAR)uFuncAddr, (PCHAR)uOlduAddr, OldLen);
    *(PUCHAR)(uFuncAddr + OldLen) = 0x68;
    *(PULONG)(uFuncAddr + OldLen + 1) = (ULONG)(uNewAddr + OldLen);
    *(PUCHAR)(uFuncAddr + OldLen + 5) = 0xc3;
    EnableWPAndSti();
}

NTSTATUS Hook()
{
    NTSTATUS status;
    ULONG uKernelBase = 0;
    ULONG uImageBase = 0;
    // KdBreakPoint();
    OpenKernelFile(&uKernelBase, &uImageBase);
    INSTRUCTION Instruction;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;

    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uCurrentBuild = 0;
    PsGetVersion(NULL, NULL, &uCurrentBuild, NULL);

    // XP
    // #define NtWriteVirtualMemoryIndex 0x115
    // #define NtReadVirtualMemoryIndex  0xba

    // 2003
    // #define NtWriteVirtualMemoryIndex 0x11f
    // #define NtReadVirtualMemoryIndex  0xc2
    if (uCurrentBuild == 2600) // xp
    {
        ULONG uNewSSDTAddr = GetSSDTAddr(uKernelBase, uImageBase, 0x115);
        ULONG uOlduSSDTAddr = uNewSSDTAddr - uKernelBase + uImageBase;
        CopyFuncByte(uNewSSDTAddr, uOlduSSDTAddr, (ULONG)FuckNtWriteVirtualMemory);
        HookSSDT((ULONG)FuckNtWriteVirtualMemory, &g_uOldNtWriteVirtualMemoryAddr, 0x115);

        uNewSSDTAddr = GetSSDTAddr(uKernelBase, uImageBase, 0xba);
        uOlduSSDTAddr = uNewSSDTAddr - uKernelBase + uImageBase;
        CopyFuncByte(uNewSSDTAddr, uOlduSSDTAddr, (ULONG)FuckNtReadVirtualMemory);
        HookSSDT((ULONG)FuckNtReadVirtualMemory, &g_uOldNtReadVirtualMemoryAddr, 0xba);
    }
    else if (uCurrentBuild == 3790) // 2003
    {
        ULONG uNewSSDTAddr = GetSSDTAddr(uKernelBase, uImageBase, 0x11f);
        ULONG uOlduSSDTAddr = uNewSSDTAddr - uKernelBase + uImageBase;
        CopyFuncByte(uNewSSDTAddr, uOlduSSDTAddr, (ULONG)FuckNtWriteVirtualMemory);
        HookSSDT((ULONG)FuckNtWriteVirtualMemory, &g_uOldNtWriteVirtualMemoryAddr, 0x11f);

        uNewSSDTAddr = GetSSDTAddr(uKernelBase, uImageBase, 0xc2);
        uOlduSSDTAddr = uNewSSDTAddr - uKernelBase + uImageBase;
        CopyFuncByte(uNewSSDTAddr, uOlduSSDTAddr, (ULONG)FuckNtReadVirtualMemory);
        HookSSDT((ULONG)FuckNtReadVirtualMemory, &g_uOldNtReadVirtualMemoryAddr, 0xc2);
    }
    else
    {
        KdPrint(("Hook SSDT fails\n"));
    }
    
    EnableKiAttachProcessHook(uImageBase);
    EnableNtOpenProcessHook(TRUE);
    EnableNtOpenThreadHook(TRUE);

//     EnableZwOpenProcsssook(uImageBase, TRUE);
//     EnableNtCreateFileHook(uImageBase, TRUE);
    if (uImageBase != 0)
    {
        ExFreePool((PVOID)uImageBase);
    }
    return STATUS_SUCCESS;
}
BOOLEAN HookSSDT(ULONG uNewHookAddr, PULONG pOldFuncAddr, ULONG uIndex)
{
    ULONG dwAddr
        = *(PULONG)KeServiceDescriptorTable.ServiceTableBase + uIndex * 4;

    *pOldFuncAddr = *(PULONG)dwAddr;
    __try
    {
        CliAndDisableWP();
        *(PULONG)dwAddr = (ULONG)uNewHookAddr;
        EnableWPAndSti();
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        return FALSE;
    }
    return TRUE;
}

BOOLEAN UnHookSSDT(ULONG uOldFuncAddr, ULONG uIndex)
{
    ULONG dwAddr
        = *(PULONG)KeServiceDescriptorTable.ServiceTableBase + uIndex * 4;
    __try
    {
        CliAndDisableWP();
        *(PULONG)dwAddr = uOldFuncAddr;
        EnableWPAndSti();
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        return FALSE;
    }
    return TRUE;
}

VOID CliAndDisableWP()
{
    __asm
    {
        cli;
        push eax;
        mov eax, cr0;
        and eax, 0FFFEFFFFh;
        mov cr0, eax;
        pop eax;
    }
}

VOID EnableWPAndSti()
{
    __asm
    {
        push eax;
        mov eax, cr0;
        or eax, 10000h;
        mov cr0, eax;
        pop eax;
        sti;
    }
}

#pragma  LOCKEDCODE
__declspec( naked ) void FuckNtWriteVirtualMemory()
{
    __asm
    {
        mov ecx, 0x10
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
    }
}

#pragma  LOCKEDCODE
__declspec( naked ) void FuckNtReadVirtualMemory()
{
    __asm
    {
        mov ecx, 0x1232434
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
		NOP
    }
}


UCHAR BackupKiAttachProcess[15] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
#pragma LOCKEDCODE
VOID EnableKiAttachProcessHook(ULONG uImageBase)
{
    //KdBreakPoint();
    KIRQL OldIrql;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;
    
    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uReg = 0;
    ULONG uKiAttachProcessAddr = 0;
    ULONG uOldKiAttachProcessAddr = 0;
    RtlInitUnicodeString(&SymbolName, L"KeAttachProcess");

    RtlInitAnsiString(&FuncName, "KeAttachProcess");

    OldSymbolAddress = MiFindExportedRoutineByName((PVOID)uImageBase, &FuncName);
    if ((SymbolAddress = MmGetSystemRoutineAddress(
        &SymbolName)) && OldSymbolAddress)
    { 

//         nt!KeAttachProcess+0x2a:
//         804f8906 ff1514874d80    call    dword ptr [nt!_imp__KeRaiseIrqlToDpcLevel (804d8714)]
//         804f890c 884508          mov     byte ptr [ebp+8],al
//         804f890f 8d864c010000    lea     eax,[esi+14Ch]
//         804f8915 50              push    eax
//         804f8916 ff7508          push    dword ptr [ebp+8]
//         804f8919 57              push    edi
//         804f891a 56              push    esi
//         804f891b e8b8feffff      call    nt!KiAttachProcess (804f87d8)
// 
//         nt!KeAttachProcess+0x44:
//         804f8920 5f              pop     edi
//         804f8921 5e              pop     esi
//         804f8922 5d              pop     ebp
//         804f8923 c20400          ret     4
		CliAndDisableWP();

       
        ULONG uCurrentBuild = 0;
        PsGetVersion(NULL, NULL, &uCurrentBuild, NULL);

        // XP
        // #define NtWriteVirtualMemoryIndex 0x115
        // #define NtReadVirtualMemoryIndex  0xba

        // 2003
        // #define NtWriteVirtualMemoryIndex 0x11f
        // #define NtReadVirtualMemoryIndex  0xc2


        PUCHAR pStart = (PUCHAR)SymbolAddress;
        for (INT i = 0; i < 512; i++)
        {
            if (uCurrentBuild == 2600) // xp
            {
                if (*(PUCHAR)pStart == 0xe8)
                {
                    // 找到KiAttachProcess
                    // call addr
                    // addr - CurAddr - 5 = op; 
                    // addr = CurAddr + 5 + op
                    uKiAttachProcessAddr = (ULONG)(pStart + 0x5 + *(PULONG)(pStart + 1));
                    break;
                }
                pStart++;
            }
            else if (uCurrentBuild == 3790) // 2003
            {
                if (*(PUCHAR)pStart == 0xe8)
                {
                    // 找到KiAttachProcess
                    // call addr
                    // addr - CurAddr - 5 = op; 
                    // addr = CurAddr + 5 + op
                    // uKiAttachProcessAddr = (ULONG)(pStart + 0x5 + *(PULONG)(pStart + 1));
                    PUCHAR pStartEx = (PUCHAR)pStart + 1;
                    for (int j = 0; j < 512; j++)
                    {
                        if (*(PUCHAR)pStartEx == 0xe8)
                        {
                            // 找到KiAttachProcess
                            // call addr
                            // addr - CurAddr - 5 = op; 
                            // addr = CurAddr + 5 + op
                            uKiAttachProcessAddr = (ULONG)(pStartEx + 0x5 + *(PULONG)(pStartEx + 1));
                            break;
                        }
                        pStartEx++;
                    }
                    break;
                }
                pStart++;
            }

        }

        pStart = (PUCHAR)OldSymbolAddress;
        for (INT i = 0; i < 512; i++)
        {
            if (uCurrentBuild == 2600) // xp
            {
                if (*(PUCHAR)pStart == 0xe8)
                {
                    // 找到KiAttachProcess
                    // call addr
                    // addr - CurAddr - 5 = op; 
                    // addr = CurAddr + 5 + op
                    uOldKiAttachProcessAddr = (ULONG)(pStart + 0x5 + *(PULONG)(pStart + 1));
                    break;
                }
                pStart++;
            }
            else if (uCurrentBuild == 3790) // 2003
            {
                if (*(PUCHAR)pStart == 0xe8)
                {
                    // 找到KiAttachProcess
                    // call addr
                    // addr - CurAddr - 5 = op; 
                    // addr = CurAddr + 5 + op
                    // uOldKiAttachProcessAddr = (ULONG)(pStart + 0x5 + *(PULONG)(pStart + 1));

                    PUCHAR pStartEx = (PUCHAR)pStart + 1;
                    for (int j = 0; j < 512; j++)
                    {
                        if (*(PUCHAR)pStartEx == 0xe8)
                        {
                            // 找到KiAttachProcess
                            // call addr
                            // addr - CurAddr - 5 = op; 
                            // addr = CurAddr + 5 + op
                            uOldKiAttachProcessAddr = (ULONG)(pStartEx + 0x5 + *(PULONG)(pStartEx + 1));
                            break;
                        }
                        pStartEx++;
                    }
                    break;
                }
                pStart++;
            }
        }

        EnableWPAndSti();
        ULONG OldLen = 9; DisassembleUntil((PUCHAR)uKiAttachProcessAddr, 9);

        CliAndDisableWP();
        RtlMoveMemory((PCHAR)BackupKiAttachProcess, (PCHAR)uOldKiAttachProcessAddr, OldLen);
        EnableWPAndSti();


        OldIrql = KeRaiseIrqlToDpcLevel();
        CliAndDisableWP();
        RtlMoveMemory((PVOID)uKiAttachProcessAddr, BackupKiAttachProcess, 9);
        EnableWPAndSti();
        KeLowerIrql(OldIrql);
    }

}

ULONG GetModuleBase(PCHAR szModuleName)
{
    ULONG uSize = 0x10000;
    PVOID pModuleInfo = ExAllocatePoolWithTag(NonPagedPool, 
                                            uSize, 
                                            'GetB');
    if (pModuleInfo == NULL)
    {
        KdPrint(("ExAllocatePoolWithTag failed\n"));
        return 0;
    }
    RtlZeroMemory(pModuleInfo, uSize);

    NTSTATUS status = ZwQuerySystemInformation(SystemModuleInformation, 
        pModuleInfo, 
        uSize, 
        NULL);

    if(!NT_SUCCESS(status))
    {
        KdPrint(("FindModuleByAddress query failed\n"));
        //打印错误
        KdPrint(("FindModuleByAddress status: 0x%x\n", status));
        if (pModuleInfo != NULL)
        {
            ExFreePool(pModuleInfo);
            pModuleInfo = NULL;
        }
        return 0;
    }

    ULONG uNumberOfModules = *(PULONG)pModuleInfo;
    if (uNumberOfModules == 0)
    {
        return 0;
    }

    PRTL_PROCESS_MODULE_INFORMATION pStart = 
        (PRTL_PROCESS_MODULE_INFORMATION)((ULONG)pModuleInfo + sizeof(ULONG));

    for (ULONG uCount = 0; uCount < uNumberOfModules; uCount++)
    {
        PUCHAR pszFullPathName = (PUCHAR)pStart->FullPathName;

        ULONG uOffsetName = pStart->OffsetToFileName;

        PUCHAR pszName = (PUCHAR)(pszFullPathName + uOffsetName);

        if (_stricmp((const char *)pszName, szModuleName) == 0)
        {
            ULONG uImageBase = (ULONG)pStart->ImageBase;
            if (pModuleInfo != NULL)
            {
                ExFreePool(pModuleInfo);
                pModuleInfo = NULL;
            }
            return uImageBase;
        }

        pStart++;
    }
    
    if (pModuleInfo != NULL)
    {
        ExFreePool(pModuleInfo);
        pModuleInfo = NULL;
    }
    return 0;
}

BOOLEAN DisDebugZero()
{

    // 获得TesSafe.sys的加载基地址
    ULONG uImageBase = GetModuleBase("TesSafe.sys");
    if (uImageBase == 0)
    {
        return FALSE;
    }
    
    // 修改三处
    // 修改此三处即可修复DebugPort清零问题。
    // 1. 0x41E0 0xc3
    // 2. 0x2638 0xc3
    // 3. 0x4F2C 0xc3
    KIRQL OldIrql;
    OldIrql = KeRaiseIrqlToDpcLevel();
    CliAndDisableWP();
    // 总检查代码处
	*(PUCHAR)(uImageBase + 0x3658) = 0xc3;
	// 第一处DebugPort清零
	*(PUCHAR)(uImageBase + 0x5556) = 0xc3;
	// 第二处DebugPort清零
    *(PUCHAR)(uImageBase + 0x1E4E) = 0xc3;
    EnableWPAndSti();
    KeLowerIrql(OldIrql);
 
	// 每次更新其实变动最大的就是这三处修改了
	// 更新一次。偏移就会变。最好呢。用特征码匹配来做
	// 那每次更新了。就不会再取麻烦的调试了。
    return TRUE;
}

VOID GetDpcRoutine()
{
//     Index = 0;
//     do {
//         ListHead = &KiTimerTableListHead[Index].Entry;
//         NextEntry = ListHead->Flink;
//         while (NextEntry != ListHead) {
//             Timer = CONTAINING_RECORD(NextEntry, KTIMER, TimerListEntry);
//             NextEntry = NextEntry->Flink;
//             if (Timer->DueTime.QuadPart <= CurrentTime.QuadPart) {
// 
//                 //
//                 // If the timer expiration DPC is queued, then the time has
//                 // been change and the DPC has not yet had the chance to run
//                 // and clear out the expired timers.
//                 //
// 
//                 if ((KeGetCurrentPrcb()->TimerRequest == 0) &&
//                     *((volatile PKSPIN_LOCK *)(&KiTimerExpireDpc.DpcData)) == NULL) {
//                         DbgBreakPoint();
//                 }
//             }
//         }
// 
//         Index += 1;
//     } while(Index < TIMER_TABLE_SIZE);
}

ULONG GetPlantformDependentInfo(ULONG dwFlag)   
{    
    ULONG current_build;    
    ULONG ans = 0;    

    PsGetVersion(NULL, NULL, &current_build, NULL);    

    switch ( dwFlag )   
    {    
    case EPROCESS_SIZE:    
        if (current_build == 2195) ans = 0 ;        // 2000，当前不支持2000，下同   
        if (current_build == 2600) ans = 0x25C;     // xp   
        if (current_build == 3790) ans = 0x270;     // 2003   
        break;    
    case PEB_OFFSET:    
        if (current_build == 2195)  ans = 0;    
        if (current_build == 2600)  ans = 0x1b0;    
        if (current_build == 3790)  ans = 0x1a0;   
        break;    
    case FILE_NAME_OFFSET:    
        if (current_build == 2195)  ans = 0;    
        if (current_build == 2600)  ans = 0x174;    
        if (current_build == 3790)  ans = 0x164;   
        break;    
    case PROCESS_LINK_OFFSET:    
        if (current_build == 2195)  ans = 0;    
        if (current_build == 2600)  ans = 0x088;    
        if (current_build == 3790)  ans = 0x098;   
        break;    
    case PROCESS_ID_OFFSET:    
        if (current_build == 2195)  ans = 0;    
        if (current_build == 2600)  ans = 0x084;    
        if (current_build == 3790)  ans = 0x094;   
        break;    
    case EXIT_TIME_OFFSET:    
        if (current_build == 2195)  ans = 0;    
        if (current_build == 2600)  ans = 0x078;    
        if (current_build == 3790)  ans = 0x088;   

        break;    
    }    
    return ans;    
}

void GetFuckHookAddr(ULONG uFuckAddr, ULONG& uFirst, ULONG & uSecond)
{

//     00011660 90             nop
//     00011661 FF D7          call    edi
//     00011663 50             push    eax
//     00011664 90             nop
// 
//     00011690 90             nop
//     00011691 FF D0          call    eax
//     00011693 57             push    edi
//     00011694 90             nop


	CliAndDisableWP();
    PUCHAR p = (PUCHAR)uFuckAddr;
    while (1)
    {
        if ((*(p) == 0x90) && 
            (*(p + 0x1) == 0xff) &&
            (*(p + 0x2) == 0xd7) &&
            (*(p + 0x3) == 0x50) &&
            (*(p + 0x4) == 0x90))
        {
            KdPrint(("%0X \n",(ULONG)p));
            break;
        }
        //推动指针向前走
        p++;
    }
    uFirst = (ULONG)p;

    p = (PUCHAR)uFuckAddr;
    while (1)
    {
        if ((*(p) == 0x90) && 
            (*(p + 0x1) == 0xff) &&
            (*(p + 0x2) == 0xd0) &&
            (*(p + 0x3) == 0x57) &&
            (*(p + 0x4) == 0x90))
        {
            KdPrint(("%0X \n",(ULONG)p));
            break;
        }
        //推动指针向前走
        p++;
    }
    uSecond = (ULONG)p;
	EnableWPAndSti();
}


#define OLLYDBG  "C9.EXE"
#define CE "TENSAFE.EXE"

PVOID g_pCurEprocess = NULL;
ANSI_STRING g_StrGet, g_StrOd, g_StrCe, g_StrJnject;
// 大写
ULONG g_uTSNtOpenHookAddress = 0;
ULONG g_uObOpenObjectByPointer = 0;
ULONG g_uNtOpenProcessRet = 0;
ULONG g_uNtOpenHookAddress = 0;

#pragma  LOCKEDCODE
__declspec( naked ) void FuckNtOpenProcess()
{
    // 获得当前进程EPROCESS
    g_pCurEprocess = IoGetCurrentProcess();
    
    RtlInitAnsiString(&g_StrGet, 
        (PSZ)((ULONG)g_pCurEprocess + GetPlantformDependentInfo(FILE_NAME_OFFSET)));
    
    RtlInitAnsiString(&g_StrOd, OLLYDBG);
    RtlInitAnsiString(&g_StrCe, CE);
    // RtlInitAnsiString(&g_StrJnject, INJECT);

    _strupr(g_StrGet.Buffer);
    if ((RtlCompareString(&g_StrGet, &g_StrOd, TRUE) == 0 ||
        RtlCompareString(&g_StrGet, &g_StrCe, TRUE) == 0) &&
        IsTpObjecExist())
    {
        // 跳回到TShook代码处
        __asm
        {
            nop
            call edi
            push eax
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            push g_uNtOpenProcessRet
            mov eax, g_uTSNtOpenHookAddress
            jmp eax
        }
    }
    else
    {
        // 直接跳回到ObOpenObjectByPointer代码中
        __asm
        {
            nop
            call eax
            push edi
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            nop
            push g_uNtOpenProcessRet
            mov eax, g_uObOpenObjectByPointer
            jmp eax
        }
    }
}


ULONG NtOpenProcessHookLen = 0;
UCHAR BackupNtOpenProcessHook[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
UCHAR RealNtOpenProcessHook[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
BOOLEAN NtOpenProcessHookEnabled = FALSE;
#pragma LOCKEDCODE
VOID EnableNtOpenProcessHook(BOOLEAN UnHook)
{

    KIRQL OldIrql;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;

    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uReg = 0;

    if (UnHook == NtOpenProcessHookEnabled) 
    {        
        return;
    }

// ntkrnlpa:805C252B 8D 45 E0                  lea     eax, [ebp-20h]
// ntkrnlpa:805C252E 50                        push    eax
// ntkrnlpa:805C252F FF 75 CC                  push    dword ptr [ebp-34h]
// ntkrnlpa:805C2532 FF 35 D8 B2 55 80         push    dword ptr ds:8055B2D8h
// ntkrnlpa:805C2538 56                        push    esi
// ntkrnlpa:805C2539 8D 85 48 FF FF FF         lea     eax, [ebp-0B8h]
// ntkrnlpa:805C253F 50                        push    eax
// ntkrnlpa:805C2540 FF 75 C8                  push    dword ptr [ebp-38h]
// ntkrnlpa:805C2543 FF 75 DC                  push    dword ptr [ebp-24h]
// ntkrnlpa:805C2546 E8 8B FE FE FF            call    nt_ObOpenObjectByPointer
// ntkrnlpa:805C254B 8B F8                     mov     edi, eax
// ntkrnlpa:805C254D 8D 85 48 FF FF FF         lea     eax, [ebp-0B8h]
// ntkrnlpa:805C2553 50                        push    eax
// ntkrnlpa:805C2554 E8 87 59 02 00            call    nt_SeDeleteAccessState
// ntkrnlpa:805C2559 8B 4D D0                  mov     ecx, [ebp-30h]
// ntkrnlpa:805C255C 3B CE                     cmp     ecx, esi
// ntkrnlpa:805C255E 74 05                     jz      short loc_805C2565
// ntkrnlpa:805C2560 E8 0D 16 F6 FF            call    nt_ObfDereferenceObject




    if (UnHook)
    {

        // 查找NtOpenProcess被hook的代码。
        RtlInitUnicodeString(&SymbolName, L"NtOpenProcess");
        SymbolAddress = MmGetSystemRoutineAddress(&SymbolName);
        PUCHAR p = NULL;

		CliAndDisableWP();
        if (SymbolAddress)
        {
            p = (PUCHAR)SymbolAddress;
            //用一个无限循环来判断给定的特征码来确定被HOOK位置
            while (1)
            {
                if ((*(p - 7) == 0x50) && 
                    (*(p - 0xE) == 0x56) &&
                    (*(p + 0xd) == 0x50) &&
                    (*(p + 0x16) == 0x3b) &&
                    (*(p + 0x17) == 0xce) &&
                    (*p == 0xE8) &&
                    (*(p + 5)    == 0x8b) &&
                    (*(p + 6)    == 0xf8))
                {
                    KdPrint(("%0X \n",(ULONG)p));
                    break;
                }
                //推动指针向前走
                p++;
            }
        }

		EnableWPAndSti();

        // 获得TSH指向的地址
        g_uTSNtOpenHookAddress = (ULONG)p + *(PULONG)(p + 1) + 5;

        RtlInitUnicodeString(&SymbolName, L"ObOpenObjectByPointer");
        g_uObOpenObjectByPointer = (ULONG)MmGetSystemRoutineAddress(&SymbolName);
        g_uNtOpenHookAddress = (ULONG)p - 0x6;
        g_uNtOpenProcessRet = (ULONG)p + 0x5;

        ULONG uFirst = 0;
        ULONG uSecond = 0;
        GetFuckHookAddr((ULONG)FuckNtOpenProcess, uFirst, uSecond);


        ULONG OldLen = DisassembleUntil((PUCHAR)g_uNtOpenHookAddress, 6);

        CliAndDisableWP();
        RtlMoveMemory((PCHAR)uFirst, 
            (PCHAR)g_uNtOpenHookAddress, 
            OldLen);

        RtlMoveMemory((PCHAR)uSecond, 
            (PCHAR)g_uNtOpenHookAddress, 
            OldLen);

        EnableWPAndSti();

        // 拷贝要hook前的内容

        // Measure the code length to be copied
        NtOpenProcessHookLen = 
            MeasureCodeLength((PVOID)g_uNtOpenHookAddress, 5);

        if (NtOpenProcessHookLen == 0 
            || NtOpenProcessHookLen > 11)
        {
            return;
        }
        // Copy the code
        RtlMoveMemory(BackupNtOpenProcessHook, 
            (PVOID)g_uNtOpenHookAddress, NtOpenProcessHookLen);
        RtlMoveMemory(RealNtOpenProcessHook, 
            (PVOID)g_uNtOpenHookAddress, NtOpenProcessHookLen);

        // Relocate jmps and calls
        if (!RelocateJumps(RealNtOpenProcessHook, 
            (ULONG)RealNtOpenProcessHook 
            - (ULONG)g_uNtOpenHookAddress, 
            NtOpenProcessHookLen))
        {
            return;
        }
        // Write jumps
        WriteJump(&RealNtOpenProcessHook[NtOpenProcessHookLen], 
            (PVOID)(g_uNtOpenHookAddress
            + NtOpenProcessHookLen));
        WriteJump((PVOID)g_uNtOpenHookAddress, FuckNtOpenProcess);

    }
    else
    {
        OldIrql = KeRaiseIrqlToDpcLevel();
        CliAndDisableWP();
        RtlMoveMemory((PVOID)g_uNtOpenHookAddress, 
            BackupNtOpenProcessHook, 
            NtOpenProcessHookLen);
        EnableWPAndSti();
        KeLowerIrql(OldIrql);

    }
    NtOpenProcessHookEnabled = UnHook;
}




PVOID g_pNtOpenThreadCurEprocess = NULL;
ANSI_STRING g_NtOpenThreadStrGet, g_NtOpenThreadStrOd, g_NtOpenThreadCE, g_NtOpenThreadStrInject;
// 大写
ULONG g_uTSNtOpenThreadAddress = 0;
ULONG g_uNtOpenThreadObOpenObjectByPointer = 0;
ULONG g_uNtOpenThreadRet = 0;
ULONG g_uNtOpenThreadHookAddress = 0;
#pragma  LOCKEDCODE
__declspec( naked ) void FuckNtOpenThread()
{
    // 获得当前进程EPROCESS
    g_pNtOpenThreadCurEprocess = IoGetCurrentProcess();

    RtlInitAnsiString(&g_NtOpenThreadStrGet, 
        (PSZ)((ULONG)g_pNtOpenThreadCurEprocess + GetPlantformDependentInfo(FILE_NAME_OFFSET)));

    RtlInitAnsiString(&g_NtOpenThreadStrOd, OLLYDBG);
    RtlInitAnsiString(&g_NtOpenThreadCE, CE);
    // RtlInitAnsiString(&g_NtOpenThreadStrInject, INJECT);

    _strupr(g_NtOpenThreadStrGet.Buffer);

    if ((RtlCompareString(&g_NtOpenThreadStrGet, &g_NtOpenThreadStrOd, TRUE) == 0 || 
        RtlCompareString(&g_NtOpenThreadStrGet, &g_NtOpenThreadCE, TRUE) == 0) &&
        IsTpObjecExist())
    {
        // 跳回到TShook代码处
        __asm
        {
            nop
                call edi
                push eax
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                push g_uNtOpenThreadRet
                mov eax, g_uTSNtOpenThreadAddress
                jmp eax
        }
    }
    else
    {
        // 直接跳回到ObOpenObjectByPointer代码中
        __asm
        {
            nop
                call eax
                push edi
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                push g_uNtOpenThreadRet
                mov eax, g_uNtOpenThreadObOpenObjectByPointer
                jmp eax
        }
    }
}


ULONG NtOpenThreadHookLen = 0;
UCHAR BackupNtOpenThreadHook[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
UCHAR RealNtOpenThreadHook[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
BOOLEAN NtOpenThreadHookEnabled = FALSE;
#pragma LOCKEDCODE
VOID EnableNtOpenThreadHook(BOOLEAN UnHook)
{

    // KdBreakPoint();
    KIRQL OldIrql;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;

    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uReg = 0;

    if (UnHook == NtOpenThreadHookEnabled) 
    {        
        return;
    }

    if (UnHook)
    {

        // 查找NtOpenProcess被hook的代码。
        RtlInitUnicodeString(&SymbolName, L"NtOpenThread");
        SymbolAddress = MmGetSystemRoutineAddress(&SymbolName);
        PUCHAR p = NULL;

		CliAndDisableWP();
        if (SymbolAddress)
        {
//         nt!NtOpenThread+0x1ff:
//         805c27ad 8d45dc          lea     eax,[ebp-24h]
//         805c27b0 50              push    eax
//         805c27b1 ff75d0          push    dword ptr [ebp-30h]
//         805c27b4 ff35dcb25580    push    dword ptr [nt!PsThreadType (8055b2dc)]
//         805c27ba 56              push    esi
//         805c27bb 8d 85 4c ff ff ff    lea     eax,[ebp-0B4h]
//         805c27c1 50              push    eax
//         805c27c2 ff75cc          push    dword ptr [ebp-34h]
//         805c27c5 ff75e0          push    dword ptr [ebp-20h]
//         805c27c8 e8 09 fc fe ff      call    nt!ObOpenObjectByPointer (805b23d6)
//         805c27cd 8b f8            mov     edi,eax
//         805c27cf 8d 85 4c ff ff ff    lea     eax,[ebp-0B4h]
//         805c27d5 50              push    eax
//         805c27d6 e8 05 57 02 00      call    nt!SeDeleteAccessState (805e7ee0)
//         805c27db 8b 4d e0          mov     ecx,dword ptr [ebp-20h]
//         805c27de e8 8f 13 f6 ff      call    nt!ObfDereferenceObject (80523b72)
//         805c27e3 3b fe            cmp     edi,esi
//         805c27e5 0f 8c 6a ff ff ff    jl      nt!NtOpenThread+0x1a7 (805c2755)
            p = (PUCHAR)SymbolAddress;
            //用一个无限循环来判断给定的特征码来确定被HOOK位置
            while (1)
            {
                if ((*(p - 7) == 0x50) && 
                    (*(p - 0xE) == 0x56) &&
                    (*(p + 0xd) == 0x50) &&
                    (*(p + 0xe) == 0xE8) &&
                    (*(p + 0x16) == 0xE8) &&
                    (*(p + 0x1b) == 0x3b) &&
                    (*(p + 0x1c) == 0xfe) &&
                    (*p == 0xE8) &&
                    (*(p + 5)    == 0x8b) &&
                    (*(p + 6)    == 0xf8))
                {
                    KdPrint(("%0X \n",(ULONG)p));
                    break;
                }
                //推动指针向前走
                p++;
            }
        }
		EnableWPAndSti();

        // 获得TSH指向的地址
        g_uTSNtOpenThreadAddress = (ULONG)p + *(PULONG)(p + 1) + 5;

        RtlInitUnicodeString(&SymbolName, L"ObOpenObjectByPointer");
        g_uNtOpenThreadObOpenObjectByPointer = (ULONG)MmGetSystemRoutineAddress(&SymbolName);
        g_uNtOpenThreadHookAddress = (ULONG)p - 0x6;
        g_uNtOpenThreadRet = (ULONG)p + 0x5;

        ULONG uFirst = 0;
        ULONG uSecond = 0;
        GetFuckHookAddr((ULONG)FuckNtOpenThread, uFirst, uSecond);


        ULONG OldLen = DisassembleUntil((PUCHAR)g_uNtOpenThreadHookAddress, 6);

        CliAndDisableWP();
        RtlMoveMemory((PCHAR)uFirst, 
            (PCHAR)g_uNtOpenThreadHookAddress, 
            OldLen);

        RtlMoveMemory((PCHAR)uSecond, 
            (PCHAR)g_uNtOpenThreadHookAddress, 
            OldLen);

        EnableWPAndSti();

        // 拷贝要hook前的内容

        // Measure the code length to be copied
        NtOpenThreadHookLen = 
            MeasureCodeLength((PVOID)g_uNtOpenThreadHookAddress, 5);

        if (NtOpenThreadHookLen == 0 
            || NtOpenThreadHookLen > 11)
        {
            return;
        }
        // Copy the code
        RtlMoveMemory(BackupNtOpenThreadHook, 
            (PVOID)g_uNtOpenThreadHookAddress, NtOpenThreadHookLen);
        RtlMoveMemory(RealNtOpenThreadHook, 
            (PVOID)g_uNtOpenThreadHookAddress, NtOpenThreadHookLen);

        // Relocate jmps and calls
        if (!RelocateJumps(RealNtOpenThreadHook, 
            (ULONG)RealNtOpenThreadHook 
            - (ULONG)g_uNtOpenThreadHookAddress, 
            NtOpenThreadHookLen))
        {
            return;
        }
        // Write jumps
        WriteJump(&RealNtOpenThreadHook[NtOpenThreadHookLen], 
            (PVOID)(g_uNtOpenThreadHookAddress
            + NtOpenThreadHookLen));
        WriteJump((PVOID)g_uNtOpenThreadHookAddress, FuckNtOpenThread);

    }
    else
    {
        OldIrql = KeRaiseIrqlToDpcLevel();
        CliAndDisableWP();
        RtlMoveMemory((PVOID)g_uNtOpenThreadHookAddress, 
            BackupNtOpenThreadHook, 
            NtOpenThreadHookLen);
        EnableWPAndSti();
        KeLowerIrql(OldIrql);

    }
    NtOpenThreadHookEnabled = UnHook;
}



VOID FuckUnLoad(IN PDRIVER_OBJECT DriverObject)
{
    if (!g_bUnLoad)
    {
        g_bUnLoad = TRUE;
        UnHookSSDT(g_uOldNtReadVirtualMemoryAddr, NtReadVirtualMemoryIndex);
        UnHookSSDT(g_uOldNtWriteVirtualMemoryAddr, NtWriteVirtualMemoryIndex);
        EnableNtOpenProcessHook(FALSE);
        EnableNtOpenThreadHook(FALSE);
        EnableZwOpenProcsssook(0, FALSE);
    }

    g_uOldUnLoad(DriverObject);
}

#pragma  LOCKEDCODE

// __declspec( naked ) void FuckUnLoad()
// {
//     g_uTSNtOpenHookAddress = g_uNtOpenThreadObOpenObjectByPointer;
// 	g_uTSNtOpenThreadAddress = g_uNtOpenThreadObOpenObjectByPointer;
//     __asm
//     {
//         mov eax, g_uOldUnLoad
//         jmp eax
//     }
// }

void HookTsUnLoad()
{
//     GetDriverObject proc 
//         ;mov ecx,$CCOUNTED_UNICODE_STRING ("\\Driver\\TesSafe")
//         ;call GetDriverObject
//         ;edx == return value
//         xor eax,eax
//         push eax
//         push esp
//         push eax
//         push eax
//         push [IoDriverObjectType]
//     push eax
//         push eax
//         push 40h
//         push ecx
//         call ObReferenceObjectByName
//         pop edx
//         or edx,edx
//         je @F
//         push edx
//         call ObDereferenceObject
//         @@:  ret
//         GetDriverObject endp
    // hook TesSafe 的UnLoad例程
    // KdBreakPoint();
    UNICODE_STRING UniStrDriver;
    RtlInitUnicodeString(&UniStrDriver, L"\\Driver\\TesSafe");
    PVOID TsObject;;
    // OBJ_CASE_INSENSITIVE
    NTSTATUS status = ObReferenceObjectByName(&UniStrDriver, 
                0x40, 
                0, 
                0, 
                IoDriverObjectType, 
                KernelMode,
                NULL,
                &TsObject);

    if (!NT_SUCCESS(status))
    {
        KdPrint(("fails\n"));
        return;
    }   
    DRIVER_OBJECT *pObject =  (PDRIVER_OBJECT)TsObject;
    g_uOldUnLoad = pObject->DriverUnload;
    pObject->DriverUnload = (PDRIVER_UNLOAD)FuckUnLoad;
//     g_uOldUnLoad = (ULONG)pObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION];
//     pObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)g_uOldUnLoad;
    ObDereferenceObject(TsObject);
    KdPrint(("IRP_MJ_DEVICE_CONTROL"));
}

void UnHookTsUnLoad()
{
    //     GetDriverObject proc 
    //         ;mov ecx,$CCOUNTED_UNICODE_STRING ("\\Driver\\TesSafe")
    //         ;call GetDriverObject
    //         ;edx == return value
    //         xor eax,eax
    //         push eax
    //         push esp
    //         push eax
    //         push eax
    //         push [IoDriverObjectType]
    //     push eax
    //         push eax
    //         push 40h
    //         push ecx
    //         call ObReferenceObjectByName
    //         pop edx
    //         or edx,edx
    //         je @F
    //         push edx
    //         call ObDereferenceObject
    //         @@:  ret
    //         GetDriverObject endp
    // hook TesSafe 的UnLoad例程
    UNICODE_STRING UniStrDriver;
    RtlInitUnicodeString(&UniStrDriver, L"\\Driver\\TesSafe");
    PVOID TsObject;;
    // OBJ_CASE_INSENSITIVE
    NTSTATUS status = ObReferenceObjectByName(&UniStrDriver, 
        0x40, 
        0, 
        0, 
        IoDriverObjectType, 
        KernelMode,
        NULL,
        &TsObject);

    if (!NT_SUCCESS(status))
    {
        KdPrint(("fails\n"));
        return;
    }   
    DRIVER_OBJECT *pObject =  (PDRIVER_OBJECT)TsObject;
    //pObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = pObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION];
    pObject->DriverUnload = (PDRIVER_UNLOAD)g_uOldUnLoad;
    ObDereferenceObject(TsObject);
    KdPrint(("Pass \\Driver\\TesSafe\n"));
}


// 文件不存在 STATUS_NO_SUCH_FILE 
// ObReferenceObjectByHandle


VOID RemoveListEntry(PLIST_ENTRY ListEntry)
{
    KIRQL OldIrql;
    OldIrql = KeRaiseIrqlToDpcLevel();
    if (ListEntry->Flink != ListEntry &&
        ListEntry->Blink != ListEntry &&
        ListEntry->Blink->Flink == ListEntry &&
        ListEntry->Flink->Blink == ListEntry) {
            ListEntry->Flink->Blink = ListEntry->Blink;
            ListEntry->Blink->Flink = ListEntry->Flink;
            ListEntry->Flink = ListEntry;
            ListEntry->Blink = ListEntry;
    }
    KeLowerIrql(OldIrql);
}

VOID HideProcess(PEPROCESS Process)
{
    ULONG MagicPtr;

    // Remove Process from ActiveProcessLinks
    RemoveListEntry((PLIST_ENTRY)((ULONG)Process + 0x88));

    // Remove ObjectTable from HandleTableList
    MagicPtr = (ULONG)Process + 0xc4;
    if (MmIsAddressValid((PVOID)MagicPtr)) {
        MagicPtr = *(PULONG)MagicPtr;
        RemoveListEntry((PLIST_ENTRY)(MagicPtr + 0x1c));
    }
}



#pragma  LOCKEDCODE
PEPROCESS pCurEprocess = NULL;
ULONG uPID = 0;
NTSTATUS status;

__declspec(naked) void FuckZwOpenProcsss()
{
    __asm
    {
        push eax
        mov eax, [esp + 0x14]
        mov eax, [eax]
        mov uPID, eax
    }
    status = PsLookupProcessByProcessId((HANDLE)uPID, &pCurEprocess);
    if (NT_SUCCESS(status))
    {
        if (_strnicmp("Fingering.exe", (char *)((ULONG)pCurEprocess + 0x174), 13) == 0)
        {
            __asm
            {
                pop eax
                mov eax, 0xC0000022
                ret 0x10
            }
            
        }
        
    }
    __asm
    {
        pop eax
    }
    __asm
    {
        nop
        call    edi
        push    eax
        nop
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
    }
}
ULONG ZwOpenProcsssHookLen = 0;
UCHAR BackupZwOpenProcsss[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
UCHAR RealZwOpenProcsss[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
BOOLEAN ZwOpenProcsssEnabled = FALSE;
#pragma LOCKEDCODE
VOID EnableZwOpenProcsssook(ULONG uImageBase, BOOLEAN UnHook)
{
    // KdBreakPoint();
    KIRQL OldIrql;
    INSTRUCTION Instruction;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;

    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uReg = 0;

    if (UnHook == ZwOpenProcsssEnabled) 
    {        
        return;
    }
    if (UnHook)
    {
        RtlInitUnicodeString(&SymbolName, L"NtOpenProcess");

        RtlInitAnsiString(&FuncName, "NtOpenProcess");

        OldSymbolAddress = MiFindExportedRoutineByName((PVOID)uImageBase, &FuncName);
        if ((SymbolAddress = MmGetSystemRoutineAddress(
            &SymbolName)) && OldSymbolAddress)
        {
            CliAndDisableWP();
            PUCHAR p = (PUCHAR)FuckZwOpenProcsss;
            while (1)
            {
                if ((*(p) == 0x90) && 
                    (*(p + 0x1) == 0xff) &&
                    (*(p + 0x2) == 0xd7) &&
                    (*(p + 0x3) == 0x50) &&
                    (*(p + 0x4) == 0x90))
                {
                    KdPrint(("%0X \n",(ULONG)p));
                    break;
                }
                //推动指针向前走
                p++;
            }
        
            EnableWPAndSti();
            CopyFuncByte((ULONG)SymbolAddress, (ULONG)OldSymbolAddress, 
                (ULONG)p);

            // Measure the code length to be copied
            ZwOpenProcsssHookLen = 
                MeasureCodeLength((PVOID)SymbolAddress, 5);

            if (ZwOpenProcsssHookLen == 0 
                || ZwOpenProcsssHookLen > 11)
            {
                return;
            }
            // Copy the code
            RtlMoveMemory(BackupZwOpenProcsss, 
                (PVOID)SymbolAddress, ZwOpenProcsssHookLen);
            RtlMoveMemory(RealZwOpenProcsss, 
                (PVOID)SymbolAddress, ZwOpenProcsssHookLen);

            // Relocate jmps and calls
            if (!RelocateJumps(RealZwOpenProcsss, 
                (ULONG)RealZwOpenProcsss 
                - (ULONG)SymbolAddress, 
                ZwOpenProcsssHookLen))
            {
                return;
            }
            // Write jumps
            WriteJump(&RealZwOpenProcsss[ZwOpenProcsssHookLen], 
                (PVOID)((ULONG)SymbolAddress 
                + ZwOpenProcsssHookLen));
            WriteJump((PVOID)SymbolAddress, FuckZwOpenProcsss);
        }
    }
    else
    {

        RtlInitUnicodeString(&SymbolName, L"NtOpenProcess");
        if ((SymbolAddress = MmGetSystemRoutineAddress(&SymbolName)))
        { 
            OldIrql = KeRaiseIrqlToDpcLevel();
            CliAndDisableWP();
            RtlMoveMemory((PVOID)SymbolAddress, BackupZwOpenProcsss, ZwOpenProcsssHookLen);
            EnableWPAndSti();
            KeLowerIrql(OldIrql);
        }
    }
    ZwOpenProcsssEnabled = UnHook;
}


UNICODE_STRING ImagePath;
PVOID FullImageName;

__declspec(naked) void FuckNtCreateFile()
{
    __asm
    {
        push eax
        mov eax, [esp + 0x10]
        mov eax, [eax + 0x8]
        mov FullImageName, eax
    }
    RtlInitUnicodeString(&ImagePath, L"\\??\\d:\\bin\\Fingering.exe");
    if (RtlCompareUnicodeString((PCUNICODE_STRING)FullImageName, &ImagePath, TRUE) == 0)
    {
        __asm
        {
            pop eax
            mov eax, 0xC000000FL
            ret 0x2C
        }
    }
    __asm pop eax
    __asm
    {
        nop
        call edi
        push eax
        nop
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
        NOP
    }
}
ULONG NtCreateFileHookLen = 0;
UCHAR BackupNtCreateFile[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
UCHAR RealNtCreateFile[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
BOOLEAN NtCreateFileEnabled = FALSE;
#pragma LOCKEDCODE
VOID EnableNtCreateFileHook(ULONG uImageBase, BOOLEAN UnHook)
{
    // KdBreakPoint();
    KIRQL OldIrql;
    INSTRUCTION Instruction;
    ULONG uLength = 0;
    ANSI_STRING FuncName;
    UNICODE_STRING SymbolName;

    PVOID SymbolAddress = NULL;;
    PVOID OldSymbolAddress = NULL;
    ULONG uReg = 0;

    if (UnHook == NtCreateFileEnabled) 
    {        
        return;
    }
    if (UnHook)
    {
        RtlInitUnicodeString(&SymbolName, L"NtCreateFile");

        RtlInitAnsiString(&FuncName, "NtCreateFile");

        OldSymbolAddress = MiFindExportedRoutineByName((PVOID)uImageBase, &FuncName);
        if ((SymbolAddress = MmGetSystemRoutineAddress(
            &SymbolName)) && OldSymbolAddress)
        {
            CliAndDisableWP();
            PUCHAR p = (PUCHAR)FuckNtCreateFile;
            while (1)
            {
                if ((*(p) == 0x90) && 
                    (*(p + 0x1) == 0xff) &&
                    (*(p + 0x2) == 0xd7) &&
                    (*(p + 0x3) == 0x50) &&
                    (*(p + 0x4) == 0x90))
                {
                    KdPrint(("%0X \n",(ULONG)p));
                    break;
                }
                //推动指针向前走
                p++;
            }

            EnableWPAndSti();
            CopyFuncByte((ULONG)SymbolAddress, (ULONG)OldSymbolAddress, 
                (ULONG)p);

            // Measure the code length to be copied
            NtCreateFileHookLen = 
                MeasureCodeLength((PVOID)SymbolAddress, 5);

            if (NtCreateFileHookLen == 0 
                || NtCreateFileHookLen > 11)
            {
                return;
            }
            // Copy the code
            RtlMoveMemory(BackupNtCreateFile, 
                (PVOID)SymbolAddress, NtCreateFileHookLen);
            RtlMoveMemory(RealNtCreateFile, 
                (PVOID)SymbolAddress, NtCreateFileHookLen);

            // Relocate jmps and calls
            if (!RelocateJumps(RealNtCreateFile, 
                (ULONG)RealNtCreateFile 
                - (ULONG)SymbolAddress, 
                NtCreateFileHookLen))
            {
                return;
            }
            // Write jumps
            WriteJump(&RealNtCreateFile[NtCreateFileHookLen], 
                (PVOID)((ULONG)SymbolAddress 
                + NtCreateFileHookLen));
            WriteJump((PVOID)SymbolAddress, FuckNtCreateFile);
        }
    }
    else
    {

        RtlInitUnicodeString(&SymbolName, L"NtCreateFile");
        if ((SymbolAddress = MmGetSystemRoutineAddress(&SymbolName)))
        { 
            OldIrql = KeRaiseIrqlToDpcLevel();
            CliAndDisableWP();
            RtlMoveMemory((PVOID)SymbolAddress, BackupNtCreateFile, NtCreateFileHookLen);
            EnableWPAndSti();
            KeLowerIrql(OldIrql);
        }
    }
    NtCreateFileEnabled = UnHook;
}

ULONG GetProcessId(PUCHAR pszProcessName)
{
    ULONG uRet = 0;
    if (pszProcessName != NULL)
    {
        return uRet;
    }
    ULONG uEprocess = 0;
    __asm
    {
        mov eax, fs:[0x124]    // _ethread
        mov eax, [eax+0x44]    // _kprocess
        mov uEprocess, eax
    }

    KdPrint(("EPROCESS: 0x%08x\n", uEprocess));
//     LIST_ENTRY ListHead;
//     InitializeListHead(&ListHead);

    ULONG uFirstEprocess = uEprocess;
    PLIST_ENTRY pActiveProcessLinks;

    ULONG uNameOffset = GetPlantformDependentInfo(FILE_NAME_OFFSET);
    ULONG uPidOffset = GetPlantformDependentInfo(PROCESS_ID_OFFSET);
    ULONG uLinkOffset = GetPlantformDependentInfo(PROCESS_LINK_OFFSET);
    ULONG uExitTime = GetPlantformDependentInfo(EXIT_TIME_OFFSET);
    // 遍历链表获得进程信息
    do 
    {
        PLARGE_INTEGER ExitTime;
        ExitTime = (PLARGE_INTEGER)(uEprocess + uExitTime);
        if (ExitTime->QuadPart == 0)
        {
            UCHAR pszFileName = uEprocess + uNameOffset;
  
            if (_stricmp((const char *)pszProcessName, (const char *)pszFileName) == 0)
            {
                uRet = *(PULONG)(uEprocess + uPidOffset);
                break;
            }
        }

        pActiveProcessLinks = (PLIST_ENTRY)(uEprocess + uLinkOffset);
        uEprocess = (ULONG)pActiveProcessLinks->Blink - uLinkOffset;
        if (uEprocess == uFirstEprocess)
        {
            break;
        }
    } while (uEprocess != 0);


    return uRet;
}

BOOLEAN IsTpObjecExist()
{
    BOOLEAN bRet = FALSE;
    UNICODE_STRING UniStrDriver;
    RtlInitUnicodeString(&UniStrDriver, L"\\Driver\\TesSafe");
    PVOID TsObject;;
    // OBJ_CASE_INSENSITIVE
    NTSTATUS status = ObReferenceObjectByName(&UniStrDriver, 
        0x40, 
        0, 
        0, 
        IoDriverObjectType, 
        KernelMode,
        NULL,
        &TsObject);

    if (!NT_SUCCESS(status))
    {
        KdPrint(("fails\n"));
        return FALSE;
    }   
    DRIVER_OBJECT *pObject =  (PDRIVER_OBJECT)TsObject;
    if (pObject == NULL)
    {
        bRet = FALSE;
    }
    else
    {
        bRet = TRUE;
    }
    //     g_uOldUnLoad = (ULONG)pObject->MajorFunction[IRP_MJ_QUERY_VOLUME_INFORMATION];
    //     pObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = (PDRIVER_DISPATCH)g_uOldUnLoad;
    ObDereferenceObject(TsObject);

    return bRet;
}