Function AntiRootkitDeviceControl

Anti-Rootkit/ARK.cpp:331–1434

�ڴ�����������ʱ���ں��е��ڴ������޵ģ�Ҫע���ֹ��������� 1.���ƻ������ij���

// �ڴ�����������ʱ���ں��е��ڴ������޵ģ�Ҫע���ֹ���������
//		1.���ƻ������ij���
_Use_decl_annotations_
NTSTATUS AntiRootkitDeviceControl(PDEVICE_OBJECT, PIRP Irp) {
	// get our IO_STACK_LOCATION
	auto status = STATUS_INVALID_DEVICE_REQUEST;
	const auto& dic = IoGetCurrentIrpStackLocation(Irp)->Parameters.DeviceIoControl;
	ULONG len = 0;

	switch (dic.IoControlCode) {
		case IOCTL_ARK_GET_SHADOW_SERVICE_TABLE:
		{
			if (Irp->AssociatedIrp.SystemBuffer == nullptr) {
				status = STATUS_INVALID_PARAMETER;
				break;
			}
			if (dic.InputBufferLength < sizeof(void*)) {
				status = STATUS_BUFFER_TOO_SMALL;
				break;
			}
			void* p = *(PULONG*)Irp->AssociatedIrp.SystemBuffer;
			if (!MmIsAddressValid(p))
				break;
			SystemServiceTable* pSystemServiceTable = (SystemServiceTable*)p;
			// �������������ij���
			if (dic.OutputBufferLength < sizeof(PULONG)) {
				status = STATUS_BUFFER_TOO_SMALL;
				break;
			}
			pSystemServiceTable += 1;
			khook::_win32kTable = pSystemServiceTable;
			*(PULONG*)Irp->AssociatedIrp.SystemBuffer = pSystemServiceTable->ServiceTableBase;
			len = sizeof(PULONG);
			status = STATUS_SUCCESS;
			break;
		}

		case IOCTL_ARK_GET_SSDT_API_ADDR:
		{
			if (Irp->AssociatedIrp.SystemBuffer == nullptr) {
				status = STATUS_INVALID_PARAMETER;
				break;
			}
			if (dic.InputBufferLength < sizeof(ULONG)) {
				status = STATUS_BUFFER_TOO_SMALL;
				break;
			}
			// �������������ij���
			if (dic.OutputBufferLength < sizeof(void*)) {
				status = STATUS_BUFFER_TOO_SMALL;
				break;
			}

			PVOID address;
			ULONG number = *(ULONG*)Irp->AssociatedIrp.SystemBuffer;
			bool success = khook::GetApiAddress(number,&address);
			if (success) {
				*(PVOID*)Irp->AssociatedIrp.SystemBuffer = address;
				len = sizeof(address);
				status = STATUS_SUCCESS;