高级Hook示例(1)

NTSTATUS __stdcall lfOpenObjectByName(POBJECT_ATTRIBUTES ObjectAttributes, POBJECT_TYPE ObjectType, KPROCESSOR_MODE AccessMode, PACCESS_STATE AccessState, ACCESS_MASK DesiredAccess, PVOID ParseContext, PHANDLE Handle)
{
    NTSTATUS        Status  = STATUS_UNSUCCESSFUL;
    PUCHAR          InstPool= NULL; 
    UNICODE_STRING  ApiName = RTL_CONST_STRING( L"ObOpenObjectByName" );    
    PVOID           _ObOpenObjectByName = MmGetSystemRoutineAddress(&ApiName);
    
    if( _ObOpenObjectByName )
    {
        InstPool = (PUCHAR)ExAllocatePoolWithTag( NonPagedPool, 5, 'x360');        
        if( InstPool )
        {
            *InstPool = 0xC3;
            __asm
            {
                push loc_ret
                push Handle
                push ParseContext
                push DesiredAccess
                push AccessState
                push AccessMode
                push ObjectType
                push ObjectAttributes
                push InstPool
                mov  eax , _ObOpenObjectByName
                jmp  eax
            loc_ret:
                mov  Status, eax
            }
            
            ExFreePoolWithTag( InstPool,'x360' );
        }
    }
    
    return Status;
}