Hello,
I am trying to hook the Shadow SSDT on Windows 7.
I have obtained a source code from this forum and I am doing it like this:
- Get ShadowSSDTPtr by going through KeAddSystemServiceTable function
-Obtain all handles in the system with NtQuerySystemInformation
-Iterate over all handles to get PID of crss.exe
And here is the problem. I dont seem to find the PID of crss.exe
Here is the code I am using:
Now, do you see anything wrong? I looked up every Api and the parameters are fine. What I dont really understand is:
I am trying to hook the Shadow SSDT on Windows 7.
I have obtained a source code from this forum and I am doing it like this:
- Get ShadowSSDTPtr by going through KeAddSystemServiceTable function
-Obtain all handles in the system with NtQuerySystemInformation
-Iterate over all handles to get PID of crss.exe
And here is the problem. I dont seem to find the PID of crss.exe
Here is the code I am using:
Code: Select all
HANDLE GetCRSSPID()
{
HANDLE Process = (HANDLE)0;
HANDLE hObject = (HANDLE)0;
HANDLE CsrId = (HANDLE)0;
OBJECT_ATTRIBUTES obj;
CLIENT_ID cid;
UCHAR Buff[0x100];
POBJECT_NAME_INFORMATION ObjName = (POBJECT_NAME_INFORMATION)&Buff;
PSYSTEM_HANDLE_INFORMATION_EX Handles;
ULONG r;
Handles = (PSYSTEM_HANDLE_INFORMATION_EX)GetInfoTable(SystemHandleInformation);
if(!Handles)
return CsrId;
for (r = 0; r < Handles->NumberOfHandles; r++)
{
if (Handles->Information[r].ObjectTypeNumber == 21) //Port object
{
InitializeObjectAttributes(&obj, NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
cid.UniqueProcess = (HANDLE)Handles->Information[r].ProcessId;
cid.UniqueThread = 0;
obj.ObjectName = NULL;
if (NT_SUCCESS(NtOpenProcess(&Process, PROCESS_DUP_HANDLE, &obj, &cid)))
{
if ( NT_SUCCESS( ZwDuplicateObject(Process, Handles->Information[r].Handle, NtCurrentProcess(), &hObject, 0, 0, DUPLICATE_SAME_ACCESS) ) )
{
if ( NT_SUCCESS( ZwQueryObject(hObject, ObjectNameInformation, ObjName, 0x100, NULL) ) )
{
if ( ObjName->Name.Buffer && !wcsncmp(L"\\Windows\\ApiPort", ObjName->Name.Buffer, 20) )
{
CsrId = (HANDLE)Handles->Information[r].ProcessId;
break;
}
}
ZwClose(hObject);
}
ZwClose(Process);
}
}
}
ExFreePool(Handles);
return CsrId;
}
Now, do you see anything wrong? I looked up every Api and the parameters are fine. What I dont really understand is:
Code: Select all
Why are we comparing to "\\Windows\\ApiPort" if I am actually looking for crss.exe?!wcsncmp(L"\\Windows\\ApiPort", ObjName->Name.Buffer, 20)
