D026-突破TP,NP等游戏保护跨进程读写内存方法2【瑞客论坛 www.ruike1.com】.txt

突破TP,NP保护跨进程读写内存2 2021在线班 郁金香灬老师 QQ 150330575 交流群:158280115 学习目标: 突破TP,NP保护跨进程读写内存2 League of Legends.exe 0x400000 #include<ntifs.h> //OK 测试通过 遇到2个坑 //第1个坑 sizeof(PKAPC_STATE)是指针 得改结构大小 sizeof(KAPC_STATE) //第2个坑 KeStackAttachProcess后 进程空间变化了 得用内核内存 中转 BUF缓冲区 //Address为目标进程的内存地址 //Buffer //当前进程的地址 BOOLEAN KReadProcessMemory2(IN PEPROCESS Process, IN PVOID Address, IN UINT32 Length, IN PVOID UserBuffer) { KAPC_STATE apc_state; RtlZeroMemory(&apc_state, sizeof(KAPC_STATE)); //1为UserBuffer 创建 MDL内存描述 //创建MDL来读取内存 UserBuffer=0x200000 DbgPrint("yjx:sys64 %s 行号=%d(Process=%p,Address=%p,Length=%d,UserBuffer=%p)", __FUNCDNAME__, __LINE__,Process,Address,Length,UserBuffer); PMDL g_pmdl = IoAllocateMdl(UserBuffer, Length, 0, 0, NULL); //8 可以修改成 要读取的内存大小 if (!g_pmdl) { return FALSE; } //2标记为非分页内存 MmBuildMdlForNonPagedPool(g_pmdl); //3锁定 映射用户内存 到 内核内存 0x100000 unsigned char* Mapped = (unsigned char*)MmMapLockedPages(g_pmdl, KernelMode); //UserMode if (!Mapped) { //映射失败 IoFreeMdl(g_pmdl); return FALSE; } //关键 重点 //成功 映射了 地址 //切换到 目标进程 3920 UserBuffer 能被访问 3796 Address 不能访问 KeStackAttachProcess((PVOID)Process, &apc_state); //切换到 目标进程 3920 UserBuffer 不能访问 3796 Address 能访问 //判断目标地址是否可以访问 UserBuffer不可访问 Mapped可以访问 BOOLEAN dwRet = MmIsAddressValid(Address); if (dwRet) { KdPrint(("yjx[sys64] RtlCopyMemory(Address, Buffer, Length);\r\n", Address, UserBuffer, Length)); //如果目标地址 可以访问 直接复制目标地址内容 到映射的内核地址区域 RtlCopyMemory(Mapped, Address, Length); //memcpy } else { KdPrint(("yjx:sys64:Error Line37")); } //分离目标进程空间 恢复环境 KeUnstackDetachProcess(&apc_state); DbgPrint("yjx: sys分离目标进程"); //MDL清理工作 ////释放MDL相关 资源 MmUnmapLockedPages((PVOID)Mapped, g_pmdl); IoFreeMdl(g_pmdl); return dwRet; } //dwPid为目标进程id //lpBaseAddress 目标进程地址 //lpBuffer 当前进程地址 1 //内核内存地址 当前进程地址 2 int ReadProcessMemoryForPid2(UINT32 dwPid, PVOID pBase, PVOID lpBuffer, UINT32 nSize) { //根据pid获取PEPROCESS PEPROCESS Seleted_pEPROCESS = NULL; DbgPrint("yjx:sys64 %s 行号=%d %s", __FUNCDNAME__, __LINE__); if (PsLookupProcessByProcessId((PVOID)(UINT_PTR)(dwPid), &Seleted_pEPROCESS) == STATUS_SUCCESS) { BOOLEAN br = KReadProcessMemory2(Seleted_pEPROCESS, (PVOID)pBase, nSize, lpBuffer); ObDereferenceObject(Seleted_pEPROCESS); if (br) { return nSize; } } else { KdPrint(("yjx sys64 PsLookupProcessByProcessId Fail...")); } return 0;// STATUS_UNSUCCESSFUL; } //int ReadProcessMemoryForPid2(UINT32 dwPid, PVOID pBase, PVOID lpBuffer, UINT32 nSize); NTSTATUS IRP_ReadProcessMemory2(/*PDEVICE_OBJECT device_Object,*/ PIRP pirp) { // UNREFERENCED_PARAMETER(device_Object); //未使用的参数 禁止警告 DbgPrint("yjx:sys64 %s 行号=%d %s", __FUNCDNAME__,__LINE__); NTSTATUS ntStatus = STATUS_SUCCESS; PIO_STACK_LOCATION irpStack = NULL; irpStack = IoGetCurrentIrpStackLocation(pirp); #pragma pack(push) #pragma pack(8) typedef struct TINPUT_BUF { UINT64 dwPid;//目标进程PID PVOID pBase; //目标进程地址 UINT64 nSize;//要读取的长度 }TINPUT_BUF; #pragma pack(pop) //结构 PVOID BaseAddress = NULL; //返回地址 PEPROCESS selectedprocess = NULL;//目标进程 SIZE_T RegionSize = 0;//分配大小 TINPUT_BUF*bufInput =(TINPUT_BUF*)(pirp->AssociatedIrp.SystemBuffer); //读“TINPUT_BUF 输入缓冲区” //写 UserBuferr &返回数据,//返回缓冲区 UserBuffer=&返回数据 ReadProcessMemoryForPid2(bufInput->dwPid, bufInput->pBase, bufInput/*保存读取的数据*/, bufInput->nSize); //ENDCODE: //pirp->IoStatus.Status = STATUS_SUCCESS;// ////pirp->IoStatus.Information = 4;//返回给DeviceIoControl中的 倒数第二个参数lpBytesReturned //IoCompleteRequest(pirp, IO_NO_INCREMENT);//调用方已完成所有I/O请求处理操作 并且不增加优先级 if (irpStack) // { if (ntStatus == STATUS_SUCCESS) { //成功则返回 缓冲区大小 pirp->IoStatus.Information = irpStack->Parameters.DeviceIoControl.OutputBufferLength;//DeviceIoControl } else { //失败则不返回 pirp->IoStatus.Information = 0; } //完成请求 IoCompleteRequest(pirp, IO_NO_INCREMENT); } pirp->IoStatus.Status = ntStatus; return ntStatus; }