IoTimerInLineHook

/***************************************************************************************
* AUTHOR :
* DATE   : 2015-11-1
* MODULE : IoTimerInlineHook.H
*
* IOCTRL Sample Driver
*
* Description:
*        Demonstrates communications between USER and KERNEL.
*
****************************************************************************************
* Copyright (C) 2010 .
****************************************************************************************/

#ifndef CXX_IOTIMERINLINEHOOK_H
#define CXX_IOTIMERINLINEHOOK_H

#include <ntifs.h>

#include <ntimage.h>
#define DEVICE_NAME   L"\\Device\\IoTimerInlineHookDeviceName"

#define SEC_IMAGE  0x01000000

//定义SSDT表的结构
typedef struct _SYSTEM_SERVICE_TABLE_WIN7_X64{
PVOID          ServiceTableBase;
PVOID          ServiceCounterTableBase;
ULONG64      NumberOfServices;                     //SSDT表中的函数个数   0x191
PVOID          ParamTableBase;
} SYSTEM_SERVICE_TABLE_WIN7_X64, *PSYSTEM_SERVICE_TABLE_WIN7_X64;

typedef struct _SYSTEM_SERVICE_TABLE_WINXP_X86 {
PVOID   ServiceTableBase;
PVOID   ServiceCounterTableBase;
ULONG32 NumberOfServices;                         //SSDT表中的函数个数   0x11c
PVOID   ParamTableBase;
} SYSTEM_SERVICE_TABLE_WINXP_X86, *PSYSTEM_SERVICE_TABLE_WINXP_X86;

extern
char* PsGetProcessImageFileName(PEPROCESS EProcess);

extern
PIMAGE_NT_HEADERS
NTAPI
RtlImageNtHeader(PVOID BaseAddress);

typedef
NTSTATUS
(*pfnNtOpenProcess)(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,PCLIENT_ID ClientId);

NTSTATUS Fake_NtOpenProcess(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,PCLIENT_ID ClientId);

#ifdef _WIN64
#define PSYSTEM_SERVICE_TABLE PSYSTEM_SERVICE_TABLE_WIN7_X64
#else
#define PSYSTEM_SERVICE_TABLE PSYSTEM_SERVICE_TABLE_WINXP_X86
#endif

VOID  UnloadDriver(PDRIVER_OBJECT DriverObject);

BOOLEAN GetSSDTAddressInWinXP_X86(ULONG32* SSDTAddress);
BOOLEAN GetSSDTFunctionIndexFromNtdllExportTableByFunctionNameInWinXP_X86(CHAR* szFindFunctionName,
ULONG32* SSDTFunctionIndex);
BOOLEAN InlineHookSSDTWinXP_X86(ULONG32 ulOldVariable,ULONG32 ulFakeVariable,ULONG32 ulPatchSize);
VOID UnInlineHookSSDTWinXP_X86(ULONG32 ulCurrentVariable,ULONG32 ulOldVariable,ULONG32 ulPatchSize);

BOOLEAN GetSSDTAddressInWin7_X64(ULONG64* SSDTAddress);
BOOLEAN GetSSDTFunctionIndexFromNtdllExportTableByFunctionNameInWin7_X64(CHAR* szFindFunctionName,ULONG32* SSDTFunctionIndex);
BOOLEAN InlineHookSSDTWin7_X64(ULONG64 ulOldVariable,ULONG64 ulFakeVariable,ULONG32 ulPatchSize);
VOID UnInlineHookSSDTWin7_X64(ULONG64 ulCurrentVariable,ULONG64 ulOldVariable,ULONG32 ulPatchSize);

PVOID
GetExportVariableAddressFormNtosExportTableByVariableName(WCHAR *wzVariableName);

BOOLEAN
MappingPEFileInRing0Space(WCHAR* wzFileFullPath,OUT PVOID* MappingBaseAddress,PSIZE_T MappingViewSize);

VOID WPOFF();
VOID WPON();

VOID
CallBackProcedure(PDEVICE_OBJECT DeviceObject,PVOID Context);

#endif