Есть драйвер который активируется на этапе загрузки ОС. Т.е. StartType = SERVICE_SYSTEM_START. В DriverEntry происходит перехват сервисов, т.е. выполняется следующая функция: Код (Text): VOID HookSysService( void ) { ULONG CR0Reg; RealNtSetValueKey = ServiceTable->ServiceTable[ServiceOrdinal[0]]; RealNtDeleteValueKey = ServiceTable->ServiceTable[ServiceOrdinal[1]]; RealNtDeleteKey = ServiceTable->ServiceTable[ServiceOrdinal[2]]; __asm { cli // запрещаем прерывания mov eax, cr0 mov CR0Reg,eax and eax,0xFFFEFFFF // сбросить WP bit mov cr0, eax } ServiceTable->ServiceTable[ServiceOrdinal[0]] = (PVOID) HookNtSetValueKey; ServiceTable->ServiceTable[ServiceOrdinal[1]] = (PVOID) HookNtDeleteValueKey; ServiceTable->ServiceTable[ServiceOrdinal[2]] = (PVOID) HookNtDeleteKey; __asm { mov eax, CR0Reg mov cr0, eax // востановить содержимое CR0 sti // разрешаем прерывания } } После перехвата, через несколько секунд, падает Session Manager. Вот выдача дебагера: Код (Text): Process.Thread : 00000004.0000002C (System) is trying to create key: ObjectAttributes = F9DEFBC0 The caller should not rely on data written to the registry after shutdown... *** Fatal System Error: 0xc000021a (0xE1515568,0xC000000D,0x00000000,0x00000000) STOP: c000021a {Fatal System Error} The Session Manager Initialization system process terminated unexpectedly with a status of 0xc000000d (0x00000000 0x00000000). The system has been shut down. Break instruction exception - code 80000003 (first chance) A fatal system error has occurred. Debugger entered on first try; Bugcheck callbacks have not been invoked. A fatal system error has occurred. Connected to Windows XP 2600 x86 compatible target, ptr64 FALSE Loading Kernel Symbols ......................................................................................... Loading User Symbols Loading unloaded module list .... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck C000021A, {e1515568, c000000d, 0, 0} Probably caused by : PartMgr.sys ( PartMgr!PmPower+a1 ) Followup: MachineOwner --------- nt!RtlpBreakWithStatusInstruction: 80526da8 cc int 3 kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* WINLOGON_FATAL_ERROR (c000021a) The Winlogon process terminated unexpectedly. Arguments: Arg1: e1515568, String that identifies the problem. Arg2: c000000d, Error Code. Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ ERROR_CODE: (NTSTATUS) 0xc000021a - { ADDITIONAL_DEBUG_TEXT: Session Manager Initialization BUGCHECK_STR: 0xc000021a_smss.exe_c000000d DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO PROCESS_NAME: System LAST_CONTROL_TRANSFER: from 804f780d to 80526da8 SYMBOL_ON_RAW_STACK: 1 STACK_ADDR_RAW_STACK_SYMBOL: 17002000010004 STACK_COMMAND: dds F9DE39CC-0x20 ; kb STACK_TEXT: f9de39ac 817b284c f9de39b0 817b27b8 f9de39b4 817b2868 f9de39b8 817b288c f9de39bc 817b27b8 f9de39c0 00000000 f9de39c4 f9de3904 f9de39c8 f9c248de PartMgr!PmPower+0xa1 f9de39cc 819cd030 f9de39d0 819cd548 f9de39d4 80558ce8 nt!PopIrpSerialLock f9de39d8 819d1b58 f9de39dc 00000001 f9de39e0 817b2870 f9de39e4 f9de3928 f9de39e8 804eddf9 nt!IopfCallDriver+0x31 f9de39ec 819d0400 f9de39f0 f9de3928 f9de39f4 00000001 f9de39f8 804ee1cf nt!IopFreeIrp+0xe9 f9de39fc 00000000 f9de3a00 00000000 f9de3a04 817ac390 f9de3a08 f9de3978 f9de3a0c 804f3aae nt!IopCompleteRequest+0x316 f9de3a10 804f3ac4 nt!IopCompleteRequest+0x32c f9de3a14 817ac3d0 f9de3a18 819cb3c8 f9de3a1c 00000000 f9de3a20 00000030 f9de3a24 00000023 f9de3a28 00000023 FOLLOWUP_IP: PartMgr!PmPower+a1 f9c248de b803010000 mov eax,103h FOLLOWUP_NAME: MachineOwner MODULE_NAME: PartMgr IMAGE_NAME: PartMgr.sys DEBUG_FLR_IMAGE_TIMESTAMP: 3b7dc5a7 SYMBOL_NAME: PartMgr!PmPower+a1 FAILURE_BUCKET_ID: 0xc000021a_smss.exe_c000000d_PartMgr!PmPower+a1 BUCKET_ID: 0xc000021a_smss.exe_c000000d_PartMgr!PmPower+a1 Followup: MachineOwner --------- Если хукать уже когда ОС загруженна, то все нормально. В чем может быть дело?
gilg Интересно а какая там может быть ошибка если выполняется по суте просто оригинальный сервис, т.е. примерно так: Код (Text): NTSTATUS HookNtSetValueKey( IN HANDLE hKey, IN PUNICODE_STRING lpusValueName, IN ULONG ulTitleIndex, IN ULONG ulType, IN PVOID lpData, IN ULONG ulDataSize ) { NTSTATUS ns = STATUS_SUCCESS; ns = RealNtSetValueKey(hKey, lpusValueName, ulTitleIndex, ulType, lpData, ulDataSize); return ns; }
