ring0-Change Dbgport address offset over dbgport clear 0

http://blog.csdn.net/hgy413/article/details/7791390

Positive scenario:

Eprocess->debugport = NULL is cleared so that the debugger cannot accept the message and cannot debug the

Anti-scheme:

The following actions can be written as a script.

DebugPort and which functions are related 1. First Open a calc.exe: [CPP]View Plaincopy

1. Kd>!process 0 0 calc.exe
2. PROCESS 861a9020 sessionid:0 cid:068c peb:7ffdb000 parentcid:05c8
3. Dirbase:0c9801a0 objecttable:e21cdd28 handlecount:44.
4. Image:calc.exe

View the location of the next DebugPort [CPP]View Plaincopy

1. kd> DT _eprocess-y DebugPort 861a9020
2. Nt!_eprocess
3. +0X0BC DebugPort: (NULL)

Here we see the offset is 0XBC.

Read and write breakpoints to it under memory: (R is read or write)

[CPP]View Plaincopy

1. kd> BA R4 861A9020+0XBC
2. kd> BL
3. 0 e 861A90DC R 4 0001 (0001)

2.G operating system, virtual machine local open a WinDbg, attach to Calc.exe, then the system will definitely break down

[CPP]View Plaincopy

1. Kd> g
2. Breakpoint 0 Hit
3. Nt! DBGKPSETPROCESSDEBUGOBJECT+0X5C:
4. 8063A8B2 7573 jne nt! Dbgkpsetprocessdebugobject+0xd1 (8063a927)

The first function: Dbgkpsetprocessdebugobject (note that EDI+0BCH is the location of the debugport, which says the position is 0XBC), and is set when the debugger attaches the process DebugPort

[CPP]View Plaincopy

1. Kd> # BCH Nt! Dbgkpsetprocessdebugobject
2. Nt! DBGKPSETPROCESSDEBUGOBJECT+0X56:
3. 8063A8AC 399fbc000000 cmp DWORD ptr [EDI+0BCH],EBX

There is another place:

[CPP]View Plaincopy

1. Kd> # BCH
2. Nt! Dbgkpsetprocessdebugobject+0x64:
3. 8063A8BA 8987bc000000 mov dword ptr [Edi+0bch],eax

The second function: Dbgkpmarkprocesspeb (note that +0BCH is the location of the debugport, which says the position is 0XBC) when the debugger attaches the process to set the DebugPort

[CPP]View Plaincopy

1. Kd> # BCH Nt! Dbgkpmarkprocesspeb
2. Nt! dbgkpmarkprocesspeb+0x42:
3. 80639862 39bebc000000 cmp DWORD ptr [Esi+0bch],edi

The third function: Dbgkcreatethread (note that +0BCH is the location of the debugport, which says the position is 0XBC), the debug information that the sending thread or process created
[CPP]View Plaincopy

1. Kd> # BCH Nt! Dbgkcreatethread
2. Nt! DBGKCREATETHREAD+0X125:
3. 8063B0D7 399ebc000000 cmp DWORD ptr [ESI+0BCH],EBX

Fourth function: Dbgkpqueuemessage (note that the position of +0BCH is debugport, the position is 0XBC), send the Abnormal debugging information

[CPP]View Plaincopy

1. Kd> # BCH Nt! Dbgkpqueuemessage
2. Nt! dbgkpqueuemessage+0x7b:
3. 80639b8d 8b80bc000000 mov eax,dword ptr [EAX+0BCH]

Fifth function: Kidispatchexception (note that the position of +0BCH is debugport, the position is 0XBC), send the Abnormal debugging information

[CPP]View Plaincopy

1. Kd> # BCH Nt! Kidispatchexception
2. Nt! kidispatchexception+0x187:
3. 804FDAC5 39b8bc000000 cmp DWORD ptr [Eax+0bch],edi

Sixth function: Dbgkforwardexception (note that the position of +0BCH is debugport, the position is 0XBC), send the Abnormal debugging information

[CPP]View Plaincopy

1. Kd> # BCH Nt! Kidispatchexception
2. Nt! kidispatchexception+0x187:
3. 804FDAC5 39b8bc000000 cmp DWORD ptr [Eax+0bch],edi

Seventh function: Pspexitthread (note that +0BCH is the position of debugport, the position is 0XBC), the sending thread exits, the process exits the debug information

[CPP]View Plaincopy

1. Kd> # BCH Nt! Pspexitthread
2. Nt! pspexitthread+0x286:
3. 805c9554 399fbc000000 cmp DWORD ptr [EDI+0BCH],EBX

Eighth function: Dbgkexitthread (note that +0BCH is the position of debugport, the position is 0XBC), the sending thread exits, the process exits the debug information

[CPP]View Plaincopy

1. Kd> # BCH Nt! Dbgkexitthread
2. Nt! dbgkexitthread+0x20:
3. 8063b370 8b89bc000000 mov ecx,dword ptr [ECX+0BCH]

Nineth function: pspcreateprocess (note that +0BCH is the position of debugport, the position is 0XBC), process creation, setting DebugPort

[CPP]View Plaincopy

1. Kd> # BCH Nt! Pspcreateprocess
2. Nt! PSPCREATEPROCESS+0X1A9:
3. 805C7C35 8983bc000000 mov dword ptr [Ebx+0bch],eax

Statistics are as follows:

The functions are as follows:

Pspcreateprocess, MMCREATEPEB process creation, Setup DebugPort
Dbgkcreatethread Debug information for a send thread or process creation
Kidispatchexception, Dbgkforwardexception, and Dbgkpqueuemessage send exception debug information
Pspexitthread, Dbgkexitthread, and dbgkexitprocess debug information for sending thread exits, process exits
Dbgkmapviewofsection and dbgkunmapviewofsection send image mount unload debug information
Dbgkpsetprocessdebugobject and DBGKPMARKPROCESSPEB settings when the debugger attaches a process debugport

2. Replacement Address
mov Ecx,dword ptr [ecx+0bch]//0xbch is the offset of debugport
We can move debugport to another place in _eprocess. Use +0x070 createtime, which is the record process creation time, after the process is created, the system will not make any changes to it before the process exits, and we have no effect on the system or process after the modification. We can change all of the above code into this.
mov Ecx,dword ptr [ecx+070h]//pointing to Createtime, the actual debugport has been moved here
Just need to modify one byte, very simple

ring0-Change Dbgport address offset over dbgport clear 0