1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
| proc unhook() =
var
process: HANDLE = GetCurrentProcess()
mi: MODULEINFO
ntdllModule: HMODULE = GetModuleHandleA("ntdll.dll")
GetModuleInformation(process, ntdllModule, &mi, (DWORD)sizeof(mi))
var
ntdllBase: LPVOID = mi.lpBaseOfDll
ntdllFile: HANDLE = CreateFileA("c:\\windows\\system32\\ntdll.dll", GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, 0)
ntdllMapping: HANDLE = CreateFileMapping(ntdllFile, NULL, PAGE_READONLY or SEC_IMAGE, 0, 0, NULL)
ntdllMappingAddress: LPVOID = MapViewOfFile(ntdllMapping, FILE_MAP_READ, 0, 0, 0)
hookedDosHeader: PIMAGE_DOS_HEADER = cast[PIMAGE_DOS_HEADER](ntdllBase)
hookedNtHeader: PIMAGE_NT_HEADERS = cast[PIMAGE_NT_HEADERS](cast[DWORD_PTR](ntdllBase) + hookedDosHeader.e_lfanew)
for i in 0..(int)hookedNtHeader.FileHeader.NumberOfSections - 1:
var hookedSectionHeader: PIMAGE_SECTION_HEADER = cast[PIMAGE_SECTION_HEADER](cast[DWORD_PTR](IMAGE_FIRST_SECTION(hookedNtHeader)) + (DWORD_PTR)(IMAGE_SIZEOF_SECTION_HEADER * i))
var text = ".text"
if cmpMem(hookedSectionHeader.Name[0].addr, text[0].addr, len(text)) == 0:
var
oldProtection: DWORD = 0
isProtected = VirtualProtect(cast[LPVOID](cast[DWORD_PTR](ntdllBase) + (DWORD_PTR)hookedSectionHeader.VirtualAddress), hookedSectionHeader.Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtection)
copyMem(cast[LPVOID](cast[DWORD_PTR](ntdllBase) + (DWORD_PTR)hookedSectionHeader.VirtualAddress), cast[LPVOID](cast[DWORD_PTR](ntdllMappingAddress) + (DWORD_PTR)hookedSectionHeader.VirtualAddress), hookedSectionHeader.Misc.VirtualSize)
isProtected = VirtualProtect(cast[LPVOID](cast[DWORD_PTR](ntdllBase) + (DWORD_PTR)hookedSectionHeader.VirtualAddress), hookedSectionHeader.Misc.VirtualSize, oldProtection, &oldProtection)
CloseHandle(process)
CloseHandle(ntdllFile)
CloseHandle(ntdllMapping)
FreeLibrary(ntdllModule)
unhook()
|
