以下部分全部为转贴，特此声明！
***********************************************************
在Windows 2003中HOOK ZwCreateProcessEx 创建时间：2005-03-09 文章属性：原创 文章提交： suei8423 (suei8423_at_163.com) 作者：ZwelL 工作需要，想控制进程的创建，于是HOOK了ZwCreateProcess，后来发现xp和2003中创建进程的都用NtCreateProcessEx(参见[1]）。 但是ZwCreateProcessEx未被ntoskrnl.exe导出，用softice的ntcall命令也没有看到,网上也没有找到相关代码。没办法，跟踪ntoskrnl!ZwCreateProcess >u ntoskrnl!ZwCreateProcessEx _ZwCreateProcess 0008:804e7ae2 bb32000000 mov eax, 00000032 但是ZwCreateProcessEx有9个参数，最后一个未知，4字节，猜成HANDLE型。 原型如下： typedef NTSTATUS (*NTCREATEPROCESSEX)( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN HANDLE Unknown ); 最终用硬编码HOOK 成功，代码如下： #include "ntddk.h" #include "stdarg.h" #include "stdio.h" #include "ntiologc.h" #define DWORD unsigned long #define WORD unsigned short #define BOOL unsigned long typedef struct ServiceDescriptorEntry { unsigned int *ServiceTableBase; unsigned int *ServiceCounterTableBase; //Used only in checked build unsigned int NumberOfServices; unsigned char *ParamTableBase; } ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry; extern PServiceDescriptorTableEntry KeServiceDescriptorTable; typedef NTSTATUS (*NTCREATEPROCESSEX)( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN HANDLE Unknown ); NTCREATEPROCESSEX OldNtCreateProcessEx; // Length of process name (rounded up to next DWORD) #define PROCNAMELEN 20 // Maximum length of NT process name #define NT_PROCNAMELEN 16 ULONG gProcessNameOffset; void GetProcessNameOffset() { PEPROCESS curproc; int i; curproc = PsGetCurrentProcess(); for( i = 0; i < 3*PAGE_SIZE; i++ ) { if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") )) { gProcessNameOffset = i; } } } BOOL GetProcessName( PCHAR theName ) { PEPROCESS curproc; char *nameptr; ULONG i; KIRQL oldirql; if( gProcessNameOffset ) { curproc = PsGetCurrentProcess(); nameptr = (PCHAR) curproc + gProcessNameOffset; strncpy( theName, nameptr, NT_PROCNAMELEN ); theName[NT_PROCNAMELEN] = 0; /* NULL at end */ return TRUE; } return FALSE; } NTSTATUS NewNtCreateProcessEx( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN HANDLE SectionHandle OPTIONAL, IN HANDLE DebugPort OPTIONAL, IN HANDLE ExceptionPort OPTIONAL, IN HANDLE Unknown OPTIONAL) { CHAR aProcessName[PROCNAMELEN]; GetProcessName( aProcessName ); DbgPrint("rootkit: NewNtCreateProcessEx() from %s/n", aProcessName); //DbgPrint("ok"); return OldNtCreateProcessEx(ProcessHandle,DesiredAccess, ObjectAttributes,ParentProcess,InheritObjectTable,SectionHandle,DebugPort,ExceptionPort,Unknown); } NTSTATUS OnStubDispatch( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { Irp->IoStatus.Status = STATUS_SUCCESS; IoCompleteRequest (Irp, IO_NO_INCREMENT ); return Irp->IoStatus.Status; } VOID OnUnload( IN PDRIVER_OBJECT DriverObject ) { DbgPrint("ROOTKIT: OnUnload called/n"); _asm { CLI //dissable interrupt MOV EAX, CR0 //move CR0 register into EAX AND EAX, NOT 10000H //disable WP bit MOV CR0, EAX //write register back } (NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32))=OldNtCreateProcessEx; _asm { MOV EAX, CR0 //move CR0 register into EAX OR EAX, 10000H //enable WP bit MOV CR0, EAX //write register back STI //enable interrupt } } NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath ) { int i; DbgPrint("My Driver Loaded!"); GetProcessNameOffset(); // Register a dispatch function for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++) { theDriverObject->MajorFunction[i] = OnStubDispatch; } theDriverObject->DriverUnload = OnUnload; // save old system call locations //OldNtCreateProcessEx=(NTCREATEPROCESSEX)(SYSTEMSERVICE(0x32)); OldNtCreateProcessEx=(NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32)); _asm { CLI //dissable interrupt MOV EAX, CR0 //move CR0 register into EAX AND EAX, NOT 10000H //disable WP bit MOV CR0, EAX //write register back } (NTCREATEPROCESSEX)(*(((PServiceDescriptorTableEntry)KeServiceDescriptorTable)->ServiceTableBase + 0x32))= NewNtCreateProcessEx; _asm { MOV EAX, CR0 //move CR0 register into EAX OR EAX, 10000H //enable WP bit MOV CR0, EAX //write register back STI //enable interrupt } return STATUS_SUCCESS; } 这样很不爽，每次都要这样看索引号，问了SOBEIT，可以通过从NTDLL中这样获取服务索引号： 来自rookkit: #include #include BOOL GetId( char *FuncName, ULONG *FunctionID ) { //get the function's address PBYTE Function = (PBYTE)GetProcAddress( GetModuleHandle( "ntdll.dll" ), FuncName ); /* do some sanity checks, make sure this function has a corresponding kernel level function */ *FunctionID = 0; //func not found... if ( Function == NULL ) { return FALSE; } /* 77F5B438 B8 00000000 MOV EAX, _FUNCTION_ID_ 77F5B43D BA 0003FE7F MOV EDX,7FFE0300 77F5B442 FFD2 CALL EDX 77F5B444 C2 1800 RETN XX */ //mov eax if ( *Function != 0xB8 ) { return FALSE; } /* since the address of the function which actually makes the call (SYSCALL) may change, we just check for mov edx */ if ( *(Function + 5) != 0xBA ) { return FALSE; } //call edx /*if ( *(PWORD)(Function + 10) != 0xD2FF ) { return FALSE; } //retn if ( *(Function + 12) != 0xC2 ) { return FALSE; }*/ *FunctionID = *(PDWORD)(Function + 1); return TRUE; } int main(int argc, char* argv[]) { ULONG Id; printf( "function name: NtCreateProcessEx/n" ); GetId( "NtCreateProcessEx", &Id ); printf( "function id: %08X/n", Id ); return 0; } /// 这样也不爽，要从用户态传到驱动层不方便，最后，用这个代码： #include "ntddk.h" #include "stdarg.h" #include "stdio.h" #include "ntiologc.h" #include "ntimage.h" #define DWORD unsigned long #define WORD unsigned short #define BOOL unsigned long #define BYTE unsigned char #define SEC_IMAGE 0x01000000 typedef struct _SECTION_IMAGE_INFORMATION { PVOID EntryPoint; ULONG StackZeroBits; ULONG StackReserved; ULONG StackCommit; ULONG ImageSubsystem; WORD SubsystemVersionLow; WORD SubsystemVersionHigh; ULONG Unknown1; ULONG ImageCharacteristics; ULONG ImageMachineType; ULONG Unknown2[3]; } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION; DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName) { HANDLE hThread, hSection, hFile, hMod; SECTION_IMAGE_INFORMATION sii; IMAGE_DOS_HEADER* dosheader; IMAGE_OPTIONAL_HEADER* opthdr; IMAGE_EXPORT_DIRECTORY* pExportTable; DWORD* arrayOfFunctionAddresses; DWORD* arrayOfFunctionNames; WORD* arrayOfFunctionOrdinals; DWORD functionOrdinal; DWORD Base, x, functionAddress; char* functionName; STRING ntFunctionName, ntFunctionNameSearch; PVOID BaseAddress = NULL; SIZE_T size=0; OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE}; IO_STATUS_BLOCK iosb; //_asm int 3; ZwOpenFile(&hFile, FILE_EXECUTE | SYNCHRONIZE, &oa, &iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT); oa.ObjectName = 0; ZwCreateSection(&hSection, SECTION_ALL_ACCESS, &oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile); ZwMapViewOfSection(hSection, NtCurrentProcess(), &BaseAddress, 0, 1000, 0, &size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE); ZwClose(hFile); hMod = BaseAddress; dosheader = (IMAGE_DOS_HEADER *)hMod; opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader->e_lfanew+24); pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr->DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress); // now we can get the exported functions, but note we convert from RVA to address arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfFunctions); arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable->AddressOfNames); arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable->AddressOfNameOrdinals); Base = pExportTable->Base; RtlInitString(&ntFunctionNameSearch, lpFunctionName); for(x = 0; x < pExportTable->NumberOfFunctions; x++) { functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]); RtlInitString(&ntFunctionName, functionName); functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0 // this is the funny bit. you would expect the function pointer to simply be arrayOfFunctionAddresses[x]... // oh no... thats too simple. it is actually arrayOfFunctionAddresses[functionOrdinal]!! functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]); if (RtlCompareString(&ntFunctionName, &ntFunctionNameSearch, TRUE) == 0) { ZwClose(hSection); return functionAddress; } } ZwClose(hSection); return 0; } NTSTATUS OnStubDispatch( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { Irp->IoStatus.Status = STATUS_SUCCESS; IoCompleteRequest (Irp, IO_NO_INCREMENT ); return Irp->IoStatus.Status; } VOID OnUnload( IN PDRIVER_OBJECT DriverObject ) { DbgPrint("ROOTKIT: OnUnload called/n"); } NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath ) { int i; UNICODE_STRING dllName; DWORD functionAddress; int position; DbgPrint("My Driver Loaded!"); theDriverObject->DriverUnload = OnUnload; RtlInitUnicodeString(&dllName, L"//Device//HarddiskVolume1//Windows//System32//ntdll.dll"); functionAddress = GetDllFunctionAddress("ZwCreateProcessEx", &dllName); position = *((WORD*)(functionAddress+1)); DbgPrint("Id:%d/n", position); return STATUS_SUCCESS; } 上面的代码从驱动层加载NTDLL，再从输出表中找出函数地址，mov eax,[ID]对应的b8后面的字就是索引号，其实跟前一个代码作用是相似的， 只是驱动层没有LoadLibrary,只能这样解决了。将上面的代码整合起来就比较完善了，大家看着改吧。这里顺便把2003中的服务描述表发出来，希望对大家有帮助： Service table address:0x80567980 Number of services:280=0x127 Index Address Parameters Name ------------------------------------------------------------------------------------------------- 0x0 0x8058ddce 6 NtAcceptConnectPort 0x1 0x80596b7e 8 NtAccessCheck 0x2 0x805976ce b NtAccessCheckAndAuditAlarm 0x3 0x805a8bb7 b NtAccessCheckByType 0x4 0x8059968a 10 NtAccessCheckByTypeAndAuditAlarm 0x5 0x80658705 b NtAccessCheckByTypeResultList 0x6 0x8065a9b2 10 NtAccessCheckByTypeResultListAndAuditAlarm 0x7 0x8065a9f5 11 NtAccessCheckByTypeResultListAndAuditAlarmByHandle 0x8 0x8059dc4f 3 NtAddAtom 0xb 0x806581e2 6 NtAdjustGroupsToken 0xc 0x80597836 6 NtAdjustPrivilegesToken 0xd 0x8065104b 2 NtAlertResumeThread 0xe 0x805971ea 1 NtAlertThread 0xf 0x805996cc 1 NtAllocateLocallyUniqueId 0x10 0x80647eb9 3 NtAllocateUserPhysicalPages 0x11 0x805a70dc 4 NtAllocateUuids 0x12 0x80583188 6 NtAllocateVirtualMemory 0x13 0x8058faff 2 NtApphelpCacheControl 0x14 0x805e92fb 2 NtAreMappedFilesTheSame 0x15 0x805aae6f 2 NtAssignProcessToJobObject 0x16 0x804ebbcc 3 NtCallbackReturn 0x18 0x805eb49d 2 NtCancelIoFile 0x19 0x804f7445 2 NtCancelTimer 0x1a 0x8058c43a 1 NtClearEvent 0x1b 0x805768ac 1 NtClose 0x1c 0x80596eea 3 NtCloseObjectAuditAlarm 0x1d 0x80626f6f 2 NtCompactKeys 0x1e 0x8065b8ff 3 NtCompareTokens 0x1f 0x8058dc82 1 NtCompleteConnectPort 0x20 0x806271d6 1 NtCompressKey 0x21 0x8058c55a 8 NtConnectPort 0x22 0x804eb14b 2 NtContinue 0x23 0x805b0b1e 4 NtCreateDebugObject 0x24 0x805aabaf 3 NtCreateDirectoryObject 0x25 0x80578522 5 NtCreateEvent 0x26 0x80668009 3 NtCreateEventPair 0x27 0x805790cb b NtCreateFile 0x28 0x8059f5ab 4 NtCreateIoCompletion 0x29 0x805e09eb 3 NtCreateJobObject 0x2a 0x80651805 3 NtCreateJobSet 0x2b 0x80592a39 7 NtCreateKey 0x2c 0x805f225d 8 NtCreateMailslotFile 0x2d 0x805863a1 4 NtCreateMutant 0x2e 0x8058f416 e NtCreateNamedPipeFile 0x2f 0x805c8e1e 4 NtCreatePagingFile 0x30 0x805a32a4 5 NtCreatePort 0x31 0x805bd684 8 NtCreateProcess 0x32 0x8058efe3 9 NtCreateProcessEx 0x33 0x806685b7 9 NtCreateProfile 0x34 0x80573eca 7 NtCreateSection 0x35 0x8059afa9 5 NtCreateSemaphore 0x36 0x805ab548 4 NtCreateSymbolicLinkObject 0x37 0x80588254 8 NtCreateThread 0x38 0x805a2688 4 NtCreateTimer 0x39 0x805a62a4 d NtCreateToken 0x3a 0x805bc212 5 NtCreateWaitablePort 0x3b 0x805b12c1 2 NtDebugActiveProcess 0x3c 0x805b17dc 3 NtDebugContinue 0x3d 0x80574c08 2 NtDelayExecution 0x3e 0x8059ab90 1 NtDeleteAtom 0x41 0x805b7979 1 NtDeleteFile 0x42 0x805eca87 1 NtDeleteKey 0x43 0x8065aa3a 3 NtDeleteObjectAuditAlarm 0x44 0x805a20d4 2 NtDeleteValueKey 0x45 0x80586f5e a NtDeviceIoControlFile 0x46 0x805c9f0b 1 NtDisplayString 0x47 0x8058051e 7 NtDuplicateObject 0x48 0x8059cc7c 6 NtDuplicateToken 0x4b 0x8059a085 6 NtEnumerateKey 0x4c 0x80667a42 3 NtEnumerateSystemEnvironmentValuesEx 0x4d 0x8059d849 6 NtEnumerateValueKey 0x4e 0x805ac037 2 NtExtendSection 0x4f 0x805e41d5 6 NtFilterToken 0x50 0x8059e01a 3 NtFindAtom 0x51 0x805920a7 2 NtFlushBuffersFile 0x52 0x8058a8b5 3 NtFlushInstructionCache 0x53 0x805e715b 1 NtFlushKey 0x54 0x805a130d 4 NtFlushVirtualMemory 0x55 0x80648b20 0 NtFlushWriteBuffer 0x56 0x8064852a 3 NtFreeUserPhysicalPages 0x57 0x8057b2bf 4 NtFreeVirtualMemory 0x58 0x8057f504 a NtFsControlFile 0x59 0x805e8674 2 NtGetContextThread 0x5a 0x8064de05 2 NtGetDevicePowerState 0x5b 0x805e8ccb 4 NtGetPlugPlayEvent 0x5c 0x80544ec4 7 NtGetWriteWatch 0x5d 0x805f12e2 1 NtImpersonateAnonymousToken 0x5e 0x80597fdf 2 NtImpersonateClientOfPort 0x5f 0x8059b9c8 3 NtImpersonateThread 0x60 0x805b77c8 1 NtInitializeRegistry 0x61 0x8064dc59 4 NtInitiatePowerAction 0x62 0x8058ec31 2 NtIsProcessInJob 0x63 0x8064ddf2 0 NtIsSystemResumeAutomatic 0x64 0x805bc19c 2 NtListenPort 0x65 0x805b9dfe 1 NtLoadDriver 0x66 0x805b2d8f 2 NtLoadKey 0x67 0x8062758c 3 NtLoadKey2 0x68 0x805b4a6c 4 NtLoadKeyEx 0x69 0x805a2342 a NtLockFile 0x6a 0x805e4eaa 2 NtLockProductActivationKeys 0x6b 0x805de064 1 NtLockRegistryKey 0x6c 0x805e4a65 4 NtLockVirtualMemory 0x6d 0x805ab8ba 1 NtMakePermanentObject 0x6e 0x805abb05 1 NtMakeTemporaryObject 0x6f 0x80647392 3 NtMapUserPhysicalPages 0x70 0x80647859 3 NtMapUserPhysicalPagesScatter 0x71 0x80589905 a NtMapViewOfSection 0x74 0x805ef59d 9 NtNotifyChangeDirectoryFile 0x75 0x80599f1c a NtNotifyChangeKey 0x76 0x80599d2d c NtNotifyChangeMultipleKeys 0x77 0x8058ef66 3 NtOpenDirectoryObject 0x78 0x80599615 3 NtOpenEvent 0x79 0x806680f4 3 NtOpenEventPair 0x7a 0x8057909d 6 NtOpenFile 0x7b 0x80634e03 3 NtOpenIoCompletion 0x7c 0x805af8b0 3 NtOpenJobObject 0x7d 0x80578d88 3 NtOpenKey 0x7e 0x80586508 3 NtOpenMutant 0x7f 0x805ed885 c NtOpenObjectAuditAlarm 0x80 0x80593613 4 NtOpenProcess 0x81 0x8057e110 3 NtOpenProcessToken 0x82 0x8057e816 4 NtOpenProcessTokenEx 0x83 0x8058a94b 3 NtOpenSection 0x84 0x805b3152 3 NtOpenSemaphore 0x85 0x8058ea10 3 NtOpenSymbolicLinkObject 0x86 0x805a2a8c 4 NtOpenThread 0x87 0x8057f976 4 NtOpenThreadToken 0x88 0x8057f8e5 5 NtOpenThreadTokenEx 0x89 0x805eb40f 3 NtOpenTimer 0x8a 0x805a24a2 3 NtPlugPlayControl 0x8b 0x805ae364 5 NtPowerInformation 0x8c 0x805a2c28 3 NtPrivilegeCheck 0x8d 0x805e48ce 6 NtPrivilegeObjectAuditAlarm 0x8e 0x805a7bf0 5 NtPrivilegedServiceAuditAlarm 0x8f 0x80584a67 5 NtProtectVirtualMemory 0x90 0x8059f752 2 NtPulseEvent 0x91 0x80585755 2 NtQueryAttributesFile 0x94 0x80508c75 2 NtQueryDebugFilterState 0x95 0x8057ffd5 2 NtQueryDefaultLocale 0x96 0x80587c53 1 NtQueryDefaultUILanguage 0x97 0x8058731c b NtQueryDirectoryFile 0x98 0x80595d65 7 NtQueryDirectoryObject 0x9a 0x80635410 9 NtQueryEaFile 0x9b 0x805a2d89 5 NtQueryEvent 0x9c 0x8059b735 2 NtQueryFullAttributesFile 0x9d 0x805edffe 5 NtQueryInformationAtom 0x9e 0x805852cf 5 NtQueryInformationFile 0x9f 0x805af5ab 5 NtQueryInformationJobObject 0xa0 0x80644a66 5 NtQueryInformationPort 0xa1 0x8057fdea 5 NtQueryInformationProcess 0xa2 0x80576dc6 5 NtQueryInformationThread 0xa3 0x8057e718 5 NtQueryInformationToken 0xa4 0x8059d58c 1 NtQueryInstallUILanguage 0xa5 0x80668a4e 2 NtQueryIntervalProfile 0xa6 0x80634ebc 5 NtQueryIoCompletion 0xa7 0x80580c31 5 NtQueryKey 0xa8 0x80626765 6 NtQueryMultipleValueKey 0xa9 0x80668412 5 NtQueryMutant 0xaa 0x805f1cad 5 NtQueryObject 0xab 0x80626953 2 NtQueryOpenSubKeys 0xac 0x80626b89 4 NtQueryOpenSubKeysEx 0xad 0x8057f59e 2 NtQueryPerformanceCounter 0xae 0x80635c9d 9 NtQueryQuotaInformationFile 0xaf 0x8058679a 5 NtQuerySection 0xb0 0x805997e7 5 NtQuerySecurityObject 0xb1 0x80667325 5 NtQuerySemaphore 0xb2 0x8058e816 3 NtQuerySymbolicLinkObject 0xb3 0x80667a76 4 NtQuerySystemEnvironmentValue 0xb5 0x8057cbe2 4 NtQuerySystemInformation 0xb6 0x80597e57 1 NtQuerySystemTime 0xb7 0x8058c677 5 NtQueryTimer 0xb8 0x8059e436 3 NtQueryTimerResolution 0xb9 0x80577d61 6 NtQueryValueKey 0xba 0x80582264 6 NtQueryVirtualMemory 0xbb 0x8057960d 5 NtQueryVolumeInformationFile 0xbc 0x8058c78e 5 NtQueueApcThread 0xbd 0x804eb198 3 NtRaiseException 0xbe 0x80667075 6 NtRaiseHardError 0xbf 0x8057d886 9 NtReadFile 0xc0 0x805aeb82 9 NtReadFileScatter 0xc1 0x8059859d 6 NtReadRequestData 0xc2 0x805861e0 5 NtReadVirtualMemory 0xc3 0x80588402 1 NtRegisterThreadTerminatePort 0xc4 0x80574b77 2 NtReleaseMutant 0xc5 0x80598eb5 3 NtReleaseSemaphore 0xc6 0x80577945 5 NtRemoveIoCompletion 0xc7 0x8066e462 2 NtRemoveProcessDebug 0xc8 0x80626dec 2 NtRenameKey 0xc9 0x8062748f 3 NtReplaceKey 0xca 0x80580e50 2 NtReplyPort 0xcb 0x8057b2a0 4 NtReplyWaitReceivePort 0xcc 0x8057adb0 5 NtReplyWaitReceivePortEx 0xcd 0x80644b39 2 NtReplyWaitReplyPort 0xce 0x80667a4f 1 NtModifyDriverEntry 0xcf 0x805985f2 2 NtRequestPort 0xd0 0x8058cbc3 3 NtRequestWaitReplyPort 0xd1 0x8064dc04 1 NtRequestWakeupLatency 0xd2 0x805a4751 2 NtResetEvent 0xd3 0x8054543e 3 NtResetWriteWatch 0xd4 0x80627286 3 NtRestoreKey 0xd5 0x80650ff5 1 NtResumeProcess 0xd6 0x805806fa 2 NtResumeThread 0xd7 0x80627325 2 NtSaveKey 0xd8 0x806273b2 3 NtSaveKeyEx 0xd9 0x80625f0d 3 NtSaveMergedKeys 0xda 0x8058d4b2 9 NtSecureConnectPort 0xdd 0x805b16f1 2 NtSetContextThread 0xde 0x8066e4f1 3 NtSetDebugFilterState 0xdf 0x805ca1ac 1 NtSetDefaultHardErrorPort 0xe0 0x805b748b 2 NtSetDefaultLocale 0xe1 0x805b7433 1 NtSetDefaultUILanguage 0xe2 0x80667a5c 2 NtSetBootEntryOrder 0xe3 0x8063594e 4 NtSetEaFile 0xe4 0x8057abd7 2 NtSetEvent 0xe5 0x80575690 1 NtSetEventBoostPriority 0xe6 0x806683b0 1 NtSetHighEventPair 0xe7 0x806682e6 1 NtSetHighWaitLowEventPair 0xe8 0x8066e255 5 NtSetInformationDebugObject 0xe9 0x80578747 5 NtSetInformationFile 0xea 0x805e0b5f 4 NtSetInformationJobObject 0xeb 0x80626400 4 NtSetInformationKey 0xec 0x8059223e 4 NtSetInformationObject 0xed 0x80580221 4 NtSetInformationProcess 0xee 0x80577629 4 NtSetInformationThread 0xef 0x805a6844 4 NtSetInformationToken 0xf0 0x806685a0 2 NtSetIntervalProfile 0xf1 0x8057c39a 5 NtSetIoCompletion 0xf2 0x806508db 6 NtSetLdtEntries 0xf3 0x8066834f 1 NtSetLowEventPair 0xf4 0x8066827d 1 NtSetLowWaitHighEventPair 0xf5 0x80635c7e 4 NtSetQuotaInformationFile 0xf6 0x805a5626 3 NtSetSecurityObject 0xf7 0x80667d39 2 NtSetSystemEnvironmentValue 0xf8 0x80667a35 5 NtSetSystemEnvironmentValueEx 0xf9 0x80597238 3 NtSetSystemInformation 0xfa 0x8067b325 3 NtSetSystemPowerState 0xfb 0x8066697b 2 NtSetSystemTime 0xfc 0x805abc19 2 NtSetThreadExecutionState 0xfd 0x804ee9bf 7 NtSetTimer 0xfe 0x805acb3b 3 NtSetTimerResolution 0xff 0x805bc73c 1 NtSetUuidSeed 0x100 0x80592859 6 NtSetValueKey 0x101 0x806361ed 5 NtSetVolumeInformationFile 0x102 0x8066614b 1 NtShutdownSystem 0x103 0x80546d9e 4 NtSignalAndWaitForSingleObject 0x104 0x806687ec 1 NtStartProfile 0x105 0x80668999 1 NtStopProfile 0x106 0x80650fa0 1 NtSuspendProcess 0x107 0x805b0163 2 NtSuspendThread 0x108 0x80668af2 6 NtSystemDebugControl 0x109 0x80651a9b 2 NtTerminateJobObject 0x10a 0x80590cba 2 NtTerminateProcess 0x10b 0x80576714 2 NtTerminateThread 0x10c 0x8057e4f8 0 NtTestAlert 0x10d 0x8051ed5e 4 NtTraceEvent 0x10e 0x80667a69 4 NtTranslateFilePath 0x10f 0x806383c5 1 NtUnloadDriver 0x110 0x8062747c 1 NtUnloadKey 0x111 0x80625fc6 2 NtUnloadKey2 0x112 0x806261cb 2 NtUnloadKeyEx 0x113 0x805a220b 5 NtUnlockFile 0x114 0x805ae977 4 NtUnlockVirtualMemory 0x115 0x80589e79 2 NtUnmapViewOfSection 0x116 0x805c5aa2 2 NtVdmControl 0x117 0x805b07c8 4 NtWaitForDebugEvent 0x118 0x80574d38 5 NtWaitForMultipleObjects 0x119 0x8057428d 3 NtWaitForSingleObject 0x11a 0x8066821c 1 NtWaitHighEventPair 0x11b 0x806681bb 1 NtWaitLowEventPair 0x11c 0x80578248 9 NtWriteFile 0x11d 0x805aefe1 9 NtWriteFileGather 0x11e 0x805990a6 6 NtWriteRequestData 0x11f 0x805862d7 5 NtWriteVirtualMemory 0x120 0x805091c1 0 NtYieldExecution 0x121 0x805d7d7f 4 NtCreateKeyedEvent 0x122 0x8058f5cf 3 NtOpenKeyedEvent 0x123 0x8066922f 4 NtReleaseKeyedEvent 0x124 0x806694aa 4 NtWaitForKeyedEvent 0x125 0x8064f170 0 NtQueryPortInformationProcess 0x126 0x8064f1a4 0 NtGetCurrentProcessorNumber 参考资料： 1.MSDN系列(3)--Administrator用户直接获取SYSTEM权限 scz http://www.nsfocus.net/index.php?act=magazine&do=view&mid=1900 2.hooking functions not exported by ntoskrnl http://www.rootkit.com/newsread.php?newsid=151 3.Simple Hooking of Functions not Exported by Ntoskrnl.exe http://www.rootkit.com/newsread.php?newsid=248
