DebugPort清零代码

stop718

这几天翻看论坛里的精华里，谈到了DebugPort清零。但似乎都是说怎么anti，没讲怎么实现。于是便动手写了一个不知道游戏保护中是不是也这么个思路。。在XP SP3下测试过。有不好的地方请大家指正。。

1. #include <ntddk.h>
   
2. 
   
3. PETHREAD pThreadObj = NULL;
   
4. BOOLEAN bTerminated = FALSE;
   
5. UCHAR szProcessName[16] = "TestCrackMe.exe";
   
6. 
   
7. VOID DriverUnload(PDRIVER_OBJECT pDriverObject);
   
8. VOID AntiDbgThread(PVOID pContext);
   
9. 
   
10. NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
    
11. {
    
12.   OBJECT_ATTRIBUTES ObjAddr = {0};
    
13.   HANDLE ThreadHandle = 0;
    
14.   NTSTATUS NtStatus = STATUS_SUCCESS;
    
15. 
    
16.   KdPrint(("Driver Entry"));
    
17. 
    
18.   pDriverObject->DriverUnload = DriverUnload;
    
19. 
    
20.   InitializeObjectAttributes(&ObjAddr,NULL,OBJ_KERNEL_HANDLE,0,NULL);
    
21. 
    
22.   NtStatus = PsCreateSystemThread(&ThreadHandle,THREAD_ALL_ACCESS,&ObjAddr,NULL,NULL,AntiDbgThread,NULL);
    
23. 
    
24.   if(NT_SUCCESS(NtStatus))
    
25.   {
    
26.     KdPrint(("Thread Created"));
    
27. 
    
28.     NtStatus = ObReferenceObjectByHandle(ThreadHandle,THREAD_ALL_ACCESS,*PsThreadType,KernelMode,&pThreadObj,NULL);
    
29. 
    
30.     ZwClose(ThreadHandle);
    
31. 
    
32.     if(!NT_SUCCESS(NtStatus))
    
33.     {
    
34.       bTerminated = TRUE;
    
35.     }
    
36.   }
    
37. 
    
38.   return NtStatus;
    
39. }
    
40. 
    
41. VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
    
42. {
    
43.   bTerminated = TRUE;
    
44.   KeWaitForSingleObject(pThreadObj,Executive,KernelMode,FALSE,NULL);
    
45. 
    
46.   ObDereferenceObject(pThreadObj);
    
47. }
    
48. 
    
49. VOID AntiDbgThread(PVOID pContext)
    
50. {
    
51.   PEPROCESS pCurrentProcess = NULL;
    
52.   PEPROCESS pFirstProcess = NULL;
    
53.   LARGE_INTEGER inteval;
    
54. 
    
55.   inteval.QuadPart = -20000000;
    
56. 
    
57.   KeSetPriorityThread(KeGetCurrentThread(),LOW_REALTIME_PRIORITY);
    
58. 
    
59.   while(1)
    
60.   {
    
61.     if(bTerminated)
    
62.     {
    
63.       break;
    
64.     }
    
65.    
    
66.     pCurrentProcess = IoGetCurrentProcess();
    
67.     pFirstProcess = pCurrentProcess;
    
68. 
    
69.     while(RtlCompareMemory(szProcessName,(PUCHAR)((ULONG)pCurrentProcess + 0x174),16) != 16)
    
70.     {
    
71.       pCurrentProcess = (PEPROCESS)(*(PULONG)((ULONG)pCurrentProcess + 0x88) - 0x88);
    
72. 
    
73.       if(pCurrentProcess == pFirstProcess)
    
74.       {
    
75.         goto END;
    
76.       }
    
77.     }
    
78.    
    
79.     *(PULONG)((ULONG)pCurrentProcess + 0xbc) = 0;
    
80. END:
    
81.     KeDelayExecutionThread(KernelMode,FALSE,&inteval);
    
82.   }
    
83. }
    

复制代码