syscall hook
ShahriyarB opened this issue · comments
Hello
I want to thank you for the driver, it's clean and works just fine without any modifications
My problem is that I can't hook functions that are not exported in kernel like NtGetContextThread
I managed to get it's address using this and place the hook successfully but there is a SYSTEM_SERVICE_EXCEPTION bsod.
Code:
NTSTATUS (*NtGetContextThreadOrig)(HANDLE ThreadHandle, PCONTEXT Context);
NTSTATUS NtGetContextThreadHook(HANDLE ThreadHandle, PCONTEXT Context)
{
const NTSTATUS result = NtGetContextThreadOrig(ThreadHandle, Context);
HvUtilLog("NtGetContextThreadHook called !");
return result;
}
BOOL HvEptLogicalProcessorInitialize(PVMM_PROCESSOR_CONTEXT ProcessorContext)
{
...
PVOID NtGetContextThread = SyscallHookGetFunctionAddress(0x00ed, FALSE);
if (NtGetContextThread)
{
if (HvEptAddPageHook(ProcessorContext, NtGetContextThread, (PVOID)NtGetContextThreadHook, (PVOID*)&NtGetContextThreadOrig))
HvUtilLog("NtGetContextThread hooked");
}
return TRUE;
}
Dump:
Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff803`4dc00000 PsLoadedModuleList = 0xfffff803`4e048170
Debug session time: Sun May 17 14:58:15.417 2020 (UTC + 4:30)
System Uptime: 0 days 0:13:47.093
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000008f`f51ea018). Type ".hh dbgerr001" for details
Loading unloaded module list
......
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`4ddc2390 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9906`67f74770=000000000000003b
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8034e226583, Address of the instruction which caused the bugcheck
Arg3: ffff990667f750a0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
Page 200 not present in the dump file. Type ".hh dbgerr004" for details
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 3
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on SHAHRIYAR
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 3
Key : Analysis.Memory.CommitPeak.Mb
Value: 64
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8034e226583
BUGCHECK_P3: ffff990667f750a0
BUGCHECK_P4: 0
CONTEXT: ffff990667f750a0 -- (.cxr 0xffff990667f750a0)
rax=0000000000000000 rbx=0000000000000550 rcx=ffffc2030f397080
rdx=ffffc203014c2c40 rsi=0000000000000501 rdi=0000000000000000
rip=fffff8034e226583 rsp=ffff990667f75a90 rbp=000001b23b760080
r8=ffff840134062001 r9=fffff8034dc00000 r10=0000fffff8034e00
r11=ffff840133e2b040 r12=0000000000000001 r13=000001b23b760080
r14=00000000000004d0 r15=00000000000009a0
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!NtGetContextThread+0x53:
fffff803`4e226583 f7437400040000 test dword ptr [rbx+74h],400h ds:002b:00000000`000005c4=????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
PROCESS_NAME: svchost.exe
STACK_TEXT:
ffff9906`67f75a90 fffff803`4eb21fd4 : ffffc203`0f397080 ffff9906`67f75b80 00000000`00000550 00000000`00000550 : nt!NtGetContextThread+0x53
ffff9906`67f75ad0 fffff803`4ddd3c18 : 00000000`0000503a ffff9906`67f75b80 00000000`dc0019ff ffffc203`0801d860 : gbhv!NtGetContextThreadHook+0xc [E:\D Drive\Projects\gbhv\gbhv\ept.c @ 441]
ffff9906`67f75b00 00007fff`866fde04 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000008f`f577e4b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`866fde04
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff8034e170799-fffff8034e17079a 2 bytes - nt!_guard_check_icall_fptr+1
[ 60 d7:ae dc ]
fffff8034e1707a0-fffff8034e1707a2 3 bytes - nt!_guard_dispatch_icall_fptr (+0x07)
[ 40 e6 db:60 ae dc ]
fffff8034e226527-fffff8034e226529 3 bytes - nt!RtlpValidRelativeAttribute+ff
[ cc cc cc:57 65 22 ]
Page 200 not present in the dump file. Type ".hh dbgerr004" for details
fffff8034e226532-fffff8034e226536 5 bytes - nt!NtGetContextThread+2 (+0x0b)
[ dc 49 89 5b 08:00 00 00 00 00 ]
13 errors : !nt (fffff8034e170799-fffff8034e226536)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .cxr 0xffff990667f750a0 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
---------