X64 HOOK IDT

一个人在漂

kd> dt nt!_KIDTENTRY64 @idtr + @@(sizeof(nt!_KIDTENTRY64))
+0x000 OffsetLow  : 0x44c0
+0x002 Selector   : 0x10
+0x004 IstIndex   : 0y000
+0x004 Reserved0  : 0y00000 (0)
+0x004 Type     : 0y01110 (0xe)
+0x004 Dpl    : 0y00
+0x004 Present    : 0y1
+0x006 OffsetMiddle : 0x40e
+0x008 OffsetHigh   : 0xfffff800
+0x00c Reserved1  : 0
+0x000 Alignment  : 0x40e8e00`001044c0
kd> !idt 1

Dumping IDT:

01:    fffff800040e44c0 nt!KiDebugTrapOrFault

#pragma pack(1)
typedef struct{
    USHORT limit;
    ULONG64 BASE;


}IDT_INFO,*PIDT_INFO;


typedef union _KIDTENTRY64
{
    struct
   {
        USHORT OffsetLow;
        USHORT Selector;
        USHORT IstIndex : 3;
        USHORT Reserved0 : 5;
        USHORT Type : 5;
        USHORT Dpl : 2;
        USHORT Present : 1;
        USHORT OffsetMiddle;
        ULONG OffsetHigh;
        ULONG Reserved1;
        };
    UINT64 Alignment;
    } KIDTENTRY64, *PKIDTENTRY64;

#pragma pack()
typedef NTSTATUS(NTAPI *_KeSetAffinityThread)(
    IN PKTHREAD Thread,
    IN KAFFINITY Affinity
    );
NTSTATUS HOOKIDT(ULONG IDTID, PVOID NewfcuncAddress,__out PVOID * oldTRAP1){


KIRQL oldIrql;
ULONG lowpart;
KAFFINITY processOrs;
PKTHREAD thread;
LONG i;
IDT_INFO idtinfo;
ULONG_PTR oldTrap = 0;
ULONG_PTR newTrap;
KIDTENTRY64*idt_entry;
UNICODE_STRING ustrKeSetAffinityThread;
_KeSetAffinityThread KeSetAffinityThread;
RtlInitUnicodeString(&ustrKeSetAffinityThread, L"KeSetAffinityThread");
KeSetAffinityThread = (_KeSetAffinityThread)MmGetSystemRoutineAddress(&ustrKeSetAffinityThread);
processOrs = KeQueryActiveProcessors();
thread = KeGetCurrentThread();
newTrap = (ULONG_PTR)NewfcuncAddress;
if (!MmIsAddressValid(oldTRAP1))
{ return 1; }


for (i = 0; i < 32; i++){
KAFFINITY curProc = processOrs &amp;(1 << i);
if (curProc != 0){

KeSetAffinityThread(thread, curProc);
__sidt(&amp;idtinfo);
idt_entry = idtinfo.BASE;


oldTrap = (ULONG_PTR)((((ULONGLONG)idt_entry[IDTID].OffsetHigh) << 32) | (ULONGLONG)(((idt_entry[IDTID].OffsetMiddle << 16) | idt_entry[IDTID].OffsetLow) &amp; 0x00000000ffffffff));
if ( *oldTRAP1 == NULL)
{
*oldTRAP1 = (PVOID)oldTrap;
}



KeRaiseIrql(HIGH_LEVEL, &amp;oldIrql);
lowpart = (ULONG)((ULONGLONG)(newTrap));
idt_entry[IDTID].OffsetLow = (USHORT)lowpart;
idt_entry[IDTID].OffsetMiddle = (USHORT)(lowpart >> 16);
idt_entry[IDTID].OffsetHigh = (ULONG)((ULONGLONG)newTrap >> 32);
KeLowerIrql(oldIrql);
}



}
KeSetAffinityThread(thread, processOrs);


return STATUS_SUCCESS;
}