SSDT hook完整版

原理可以看:
https://blog.csdn.net/zhuhuibeishadiao/article/details/51114107

#include <ntddk.h>
#include <ntimage.h>
//SSDT表结构
#pragma pack(1)  //#pragma pack (n)             作用:C编译器将按照n个字节对齐
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()//#pragma pack ()               作用:取消自定义字节对齐方式
//导入:(表是导出的 直接导入就好)
__declspec(dllimport)  ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
#define SDT     SYSTEMSERVICE
#define KSDT KeServiceDescriptorTable

//---------------------------------------------------------------------------
//
// Defines
//
//---------------------------------------------------------------------------

#define FILE_DEVICE_UNKNOWN            0x00000022
#define IOCTL_UNKNOWN_BASE              FILE_DEVICE_UNKNOWN
#define IOCTL_INIT                       CTL_CODE(IOCTL_UNKNOWN_BASE, 0x0800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/********************************************************************************

    补充定义数据及结构

********************************************************************************/
//INITIAL_TEB 为新线程的TEB 结构提供初始值
typedef struct _INITIAL_TEB {
  PVOID                StackBase;
  PVOID                StackLimit;
  PVOID                StackCommit;
  PVOID                StackCommitMax;
  PVOID                StackReserved;
} INITIAL_TEB, *PINITIAL_TEB;
//被设置的系统信息的枚举类型
typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemNotImplemented1,
    SystemProcessesAndThreadsInformation,
    SystemCallCounts,
    SystemConfigurationInformation,
    SystemProcessorTimes,
    SystemGlobalFlag,
    SystemNotImplemented2,
    SystemModuleInformation,
    SystemLockInformation,
    SystemNotImplemented3,
    SystemNotImplemented4,
    SystemNotImplemented5,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPagefileInformation,
    SystemInstructionEmulationCounts,
    SystemInvalidInfoClass1,
    SystemCacheInformation,
    SystemPoolTagInformation,
    SystemProcessorStatistics,
    SystemDpcInformation,
    SystemNotImplemented6,
    SystemLoadImage,
    SystemUnloadImage,
    SystemTimeAdjustment,
    SystemNotImplemented7,
    SystemNotImplemented8,
    SystemNotImplemented9,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemLoadAndCallImage,
    SystemPrioritySeparation,
    SystemNotImplemented10,
    SystemNotImplemented11,
    SystemInvalidInfoClass2,
    SystemInvalidInfoClass3,
    SystemTimeZoneInformation,
    SystemLookasideInformation,
    SystemSetTimeSlipEvent,
    SystemCreateSession,
    SystemDeleteSession,
    SystemInvalidInfoClass4,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemAddVerifier,
    SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS;

typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG            ProcessId;
    UCHAR            ObjectTypeNumber;
    UCHAR            Flags;
    USHORT          Handle;
    PVOID            Object;
    ACCESS_MASK      GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

/*************************************************************************************************

     私有变量

*************************************************************************************************/

typedef struct _DEVICE_EXTENSION
{
    PDEVICE_OBJECT DeviceObject;
    PKEVENT Event;

    BOOLEAN bPCreate;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

//    全局设备对象
PDEVICE_OBJECT g_pDeviceObject;

UNICODE_STRING g_RegPath;

/********************************************************************************

    补充定义函数

********************************************************************************/

NTKERNELAPI NTSTATUS ObQueryNameString (
    IN PVOID                        Object,
    IN OUT PUNICODE_STRING            Name,
    IN ULONG                        MaximumLength,
    OUT PULONG                      ActualLength
);

NTKERNELAPI NTSTATUS ZwSetSecurityObject(
    IN HANDLE Handle,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR SecurityDescriptor
    );

NTKERNELAPI NTSTATUS ZwTerminateProcess(
  IN HANDLE              ProcessHandle OPTIONAL,
  IN NTSTATUS            ExitStatus );

NTKERNELAPI NTSTATUS ZwOpenProcess(
  OUT PHANDLE            ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTKERNELAPI NTSTATUS ZwOpenThread(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTKERNELAPI NTSTATUS ZwLoadDriver(
  IN PUNICODE_STRING DriverServiceName );
// ZwSetSystemInformation(
// IN SYSTEM_IMFORMATION_CALSS SystemInformationClass,
// IN OUT PVOID SystemInformation,
// IN ULONG SystemInformationLength);
//
//参数:
// SystemInformationClass:将被设置的系统信息的类型,值为SYSTEM_IMFORMATION_CALSS枚举的一个
// 子集,SystemLoadAndCallImage就是其中一个:
// typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE{//Information Class 38
// UNICODE_STRING ModuleName;
// }SYSTEM_LOAD_AND_CALL_IMAGE,*PSYSTEM_LOAD_AND_CALL_IMAGE;
//
// 成员:
// Module:要加载模块的NATIVE NT格式的完整路径
//
NTKERNELAPI NTSTATUS ZwSetSystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength );

NTKERNELAPI NTSTATUS ZwQuerySystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

/***********************************************************************************

    函数声明

***********************************************************************************/

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
void UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchIoCtrl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);

void StartHook(void);
void RemoveHook(void);

NTSTATUS Hook_ZwWriteFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

NTSTATUS Hook_ZwReadFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID              Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

NTSTATUS Hook_ZwSetSystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength );

NTSTATUS Hook_ZwQuerySystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

NTSTATUS Hook_ZwLoadDriver(
  IN PUNICODE_STRING DriverServiceName );

NTSTATUS Hook_ZwSetSecurityObject(
  IN HANDLE              ObjectHandle,
  IN SECURITY_INFORMATION SecurityInformationClass,
  IN PSECURITY_DESCRIPTOR DescriptorBuffer);

NTSTATUS Hook_ZwOpenKey(
    OUT PHANDLE  KeyHandle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_ATTRIBUTES  ObjectAttributes);

NTSTATUS Hook_ZwCreateKey (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL);

NTSTATUS Hook_ZwSetValueKey(
    IN HANDLE  KeyHandle,
    IN PUNICODE_STRING  ValueName,
    IN ULONG  TitleIndex  OPTIONAL,
    IN ULONG  Type,
    IN PVOID  Data,
    IN ULONG  DataSize);

NTSTATUS Hook_ZwDeleteKey(
  IN HANDLE  KeyHandle);

NTSTATUS Hook_ZwDeleteValueKey(
  IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);

NTSTATUS Hook_ZwOpenSection(
  OUT PHANDLE            SectionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes );

NTSTATUS Hook_ZwCreateSection(
  OUT PHANDLE            SectionHandle,
  IN ULONG                DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
  IN PLARGE_INTEGER      MaximumSize OPTIONAL,
  IN ULONG                PageAttributess,
  IN ULONG                SectionAttributes,
  IN HANDLE              FileHandle OPTIONAL );

NTSTATUS Hook_ZwCreateProcess(
  OUT PHANDLE          ProcessHandle,
  IN ACCESS_MASK        DesiredAccess,
  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
  IN HANDLE            ParentProcess,
  IN BOOLEAN            InheritObjectTable,
  IN HANDLE            SectionHandle OPTIONAL,
  IN HANDLE            DebugPort OPTIONAL,
  IN HANDLE            ExceptionPort OPTIONAL );

NTSTATUS Hook_ZwCreateProcessEx(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE UnknownHandle );

NTSTATUS Hook_ZwTerminateProcess(
  IN HANDLE              ProcessHandle OPTIONAL,
  IN NTSTATUS            ExitStatus );
NTSTATUS Hook_ZwOpenProcess(
  OUT PHANDLE            ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTSTATUS Hook_ZwCreateThread(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
  IN HANDLE              ProcessHandle,
  OUT PCLIENT_ID          ClientId,
  IN PCONTEXT            ThreadContext,
  IN PINITIAL_TEB        InitialTeb,
  IN BOOLEAN              CreateSuspended );

NTSTATUS Hook_ZwTerminateThread(
  IN HANDLE              ThreadHandle,
  IN NTSTATUS            ExitStatus );

NTSTATUS Hook_ZwOpenThread(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

NTSTATUS Hook_ZwCreateFile(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER      AllocationSize OPTIONAL,
  IN ULONG                FileAttributes,
  IN ULONG                ShareAccess,
  IN ULONG                CreateDisposition,
  IN ULONG                CreateOptions,
  IN PVOID                EaBuffer OPTIONAL,
  IN ULONG                EaLength );

NTSTATUS Hook_ZwOpenFile(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                ShareAccess,
  IN ULONG                OpenOptions );

NTSTATUS Hook_ZwClose(
  IN HANDLE ObjectHandle );

#ifdef ALLOC_PRAGMA
//把函数的代码放到分页池中
#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(INIT, StartHook)

#pragma alloc_text(PAGE, DispatchCreate)
#pragma alloc_text(PAGE, DispatchClose)
#pragma alloc_text(PAGE, DispatchIoCtrl)
#pragma alloc_text(PAGE, RemoveHook)

#pragma alloc_text(PAGE, UnloadDriver)

#pragma alloc_text(PAGE, Hook_ZwOpenKey)
#pragma alloc_text(PAGE, Hook_ZwSetSecurityObject)
#pragma alloc_text(PAGE, Hook_ZwCreateKey)
#pragma alloc_text(PAGE, Hook_ZwSetValueKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteValueKey)

#pragma alloc_text(PAGE, Hook_ZwOpenSection)
#pragma alloc_text(PAGE, Hook_ZwCreateSection)

#pragma alloc_text(PAGE, Hook_ZwOpenProcess)
#pragma alloc_text(PAGE, Hook_ZwTerminateProcess)

#pragma alloc_text(PAGE, Hook_ZwOpenThread)

#pragma alloc_text(PAGE, Hook_ZwCreateFile)
#pragma alloc_text(PAGE, Hook_ZwOpenFile)
#pragma alloc_text(PAGE, Hook_ZwClose)

#pragma alloc_text(PAGE, Hook_ZwLoadDriver)

#pragma alloc_text(PAGE, Hook_ZwSetSystemInformation)
#pragma alloc_text(PAGE, Hook_ZwQuerySystemInformation)

#pragma alloc_text(PAGE, Hook_ZwReadFile)
#pragma alloc_text(PAGE, Hook_ZwWriteFile)

#endif

/*******************************************************************************

  函数原型定义

********************************************************************************/

typedef NTSTATUS (*ZWLOADDRIVER)(
  IN PUNICODE_STRING DriverServiceName );

typedef NTSTATUS (*ZWCREATEFILE)(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER      AllocationSize OPTIONAL,
  IN ULONG                FileAttributes,
  IN ULONG                ShareAccess,
  IN ULONG                CreateDisposition,
  IN ULONG                CreateOptions,
  IN PVOID                EaBuffer OPTIONAL,
  IN ULONG                EaLength );

typedef NTSTATUS (*ZWOPENFILE)(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                ShareAccess,
  IN ULONG                OpenOptions );

typedef NTSTATUS (*ZWCLOSE)(
  IN HANDLE              ObjectHandle );

typedef NTSTATUS (*ZWWRITEFILE)(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWREADFILE)(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID              Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWCREATEPROCESS)(
  OUT PHANDLE          ProcessHandle,
  IN ACCESS_MASK        DesiredAccess,
  IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
  IN HANDLE            ParentProcess,
  IN BOOLEAN            InheritObjectTable,
  IN HANDLE            SectionHandle OPTIONAL,
  IN HANDLE            DebugPort OPTIONAL,
  IN HANDLE            ExceptionPort OPTIONAL);

typedef NTSTATUS (*ZWCREATEPROCESSEX)(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE Unknown );

typedef NTSTATUS (*ZWOPENPROCESS)(
  OUT PHANDLE            ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWTERMINATEPROCESS)(
  IN HANDLE              ProcessHandle OPTIONAL,
  IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWCREATETHREAD)(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
  IN HANDLE              ProcessHandle,
  OUT PCLIENT_ID          ClientId,
  IN PCONTEXT            ThreadContext,
  IN PINITIAL_TEB        InitialTeb,
  IN BOOLEAN              CreateSuspended );

typedef NTSTATUS (*ZWTERMINATETHREAD)(
  IN HANDLE              ThreadHandle,
  IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWOPENTHREAD)(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWCREATESECTION)(
  OUT PHANDLE            SectionHandle,
  IN ULONG                DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
  IN PLARGE_INTEGER      MaximumSize OPTIONAL,
  IN ULONG                PageAttributess,
  IN ULONG                SectionAttributes,
  IN HANDLE              FileHandle OPTIONAL );

typedef NTSTATUS (*ZWOPENSECTION)(
  OUT PHANDLE            SectionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes );

//注册表

typedef NTSTATUS (*ZWCREATEKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL
);

typedef NTSTATUS (*ZWOPENKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
);

typedef NTSTATUS (*ZWSETVALUEKEY)(
    IN HANDLE  KeyHandle,
    IN PUNICODE_STRING  ValueName,
    IN ULONG  TitleIndex  OPTIONAL,
    IN ULONG  Type,
    IN PVOID  Data,
    IN ULONG  DataSize
);

typedef NTSTATUS (*ZWSETSECURITYOBJECT)(
  IN HANDLE              ObjectHandle,
  IN SECURITY_INFORMATION SecurityInformationClass,
  IN PSECURITY_DESCRIPTOR DescriptorBuffer);

typedef NTSTATUS (*ZWDELETEKEY)(
    IN HANDLE  KeyHandle);
typedef NTSTATUS (*ZWDELETEVALUEKEY)(
    IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);

typedef NTSTATUS (*ZWSETSYSTEMINFORMATION)(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength );

typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL );

/***********************************************************

//       SDT 原函数地址

***********************************************************/

static ZWCREATEFILE                 OldZwCreateFile;
static ZWOPENFILE                   OldZwOpenFile;
static ZWCLOSE                      OldZwClose;
static ZWWRITEFILE                  OldZwWriteFile;
static ZWREADFILE                   OldZwReadFile;

static ZWTERMINATEPROCESS          OldZwTerminateProcess;
static ZWOPENPROCESS               OldZwOpenProcess;

static ZWOPENTHREAD                OldZwOpenThread;
static ZWCREATESECTION             OldZwCreateSection;
static ZWOPENSECTION               OldZwOpenSection;

static ZWCREATEKEY                 OldZwCreateKey;
static ZWSETVALUEKEY               OldZwSetValueKey;
static ZWDELETEKEY                 OldZwDeleteKey;
static ZWDELETEVALUEKEY            OldZwDeleteValueKey;
static ZWSETSECURITYOBJECT         OldZwSetSecurityObject;
static ZWOPENKEY                   OldZwOpenKey;

static ZWLOADDRIVER                OldZwLoadDriver;

static ZWSETSYSTEMINFORMATION      OldZwSetSystemInformation;
static ZWQUERYSYSTEMINFORMATION    OldZwQuerySystemInformation;

/***********************************************************************************

    挂接函数执行体

***********************************************************************************/

/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwWriteFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PVOID                Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwWriteFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}

/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwReadFile(
  IN HANDLE              FileHandle,
  IN HANDLE              Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID              Buffer,
  IN ULONG                Length,
  IN PLARGE_INTEGER      ByteOffset OPTIONAL,
  IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwReadFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}

/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwSetSystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  IN PVOID                SystemInformation,
  IN ULONG                SystemInformationLength )
{
    NTSTATUS rc;
    rc = OldZwSetSystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength);
    return rc;
}

/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwQuerySystemInformation(
  IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
  OUT PVOID              SystemInformation,
  IN ULONG                SystemInformationLength,
  OUT PULONG              ReturnLength OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwQuerySystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
    return rc;
}

/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwLoadDriver(
  IN PUNICODE_STRING DriverServiceName )
{
    NTSTATUS rc;

    rc = OldZwLoadDriver(DriverServiceName);
    return rc;
}
/************************************************************************************************

************************************************************************************************/

NTSTATUS Hook_ZwSetSecurityObject(
  IN HANDLE              ObjectHandle,
  IN SECURITY_INFORMATION SecurityInformationClass,
  IN PSECURITY_DESCRIPTOR DescriptorBuffer)
{

    NTSTATUS rc;

    rc = OldZwSetSecurityObject(ObjectHandle,SecurityInformationClass,DescriptorBuffer);

    return rc;
}

/************************************************************************************************

    ZwOpenKey

************************************************************************************************/

NTSTATUS Hook_ZwOpenKey(
    OUT PHANDLE  KeyHandle,
    IN ACCESS_MASK  DesiredAccess,
    IN POBJECT_ATTRIBUTES  ObjectAttributes)
{
    NTSTATUS rc;

    rc = OldZwOpenKey(KeyHandle,DesiredAccess,ObjectAttributes);

    return rc;
}

/*************************************************************************************************

  挂接函数 ZwCreateKey

***************************************************************************************************/

NTSTATUS Hook_ZwCreateKey (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL
)
{
    NTSTATUS rc;

    rc = OldZwCreateKey(KeyHandle, DesiredAccess, ObjectAttributes,
        TitleIndex, Class, CreateOptions, Disposition);

    return rc;
}

/***************************************************************************************************

****************************************************************************************************/

NTSTATUS Hook_ZwSetValueKey(
    IN HANDLE  KeyHandle,
    IN PUNICODE_STRING  ValueName,
    IN ULONG  TitleIndex  OPTIONAL,
    IN ULONG  Type,
    IN PVOID  Data,
    IN ULONG  DataSize
    )
{
    NTSTATUS rc;

    rc = OldZwSetValueKey(KeyHandle,ValueName,TitleIndex,Type,Data,DataSize);

    return rc;
}

/********************************************************************************************************

********************************************************************************************************/

NTSTATUS Hook_ZwDeleteKey(IN HANDLE  KeyHandle)
{
    NTSTATUS rc;

    rc = OldZwDeleteKey(KeyHandle);

    return rc;
}

/*********************************************************************************************************

*********************************************************************************************************/

NTSTATUS Hook_ZwDeleteValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
{
    NTSTATUS rc;

    rc = OldZwDeleteValueKey(KeyHandle,ValueName);

    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwOpenSection(
  OUT PHANDLE            SectionHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes )
{
    NTSTATUS rc;
//    DbgPrint("Hook_ZwOpenSection\n");
    rc = OldZwOpenSection(SectionHandle,DesiredAccess,ObjectAttributes);
    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwCreateSection(
  OUT PHANDLE            SectionHandle,
  IN ULONG                DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
  IN PLARGE_INTEGER      MaximumSize OPTIONAL,
  IN ULONG                PageAttributess,
  IN ULONG                SectionAttributes,
  IN HANDLE              FileHandle OPTIONAL )
{
    NTSTATUS rc;
    DbgPrint("Hook_ZwCreateSection");
    return OldZwCreateSection(SectionHandle,DesiredAccess,ObjectAttributes,
                                MaximumSize,PageAttributess,SectionAttributes,FileHandle);
    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwTerminateProcess(
  IN HANDLE              ProcessHandle OPTIONAL,
  IN NTSTATUS            ExitStatus )
{
    NTSTATUS rc;

    rc = OldZwTerminateProcess(ProcessHandle,ExitStatus);
    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwOpenProcess(
  OUT PHANDLE            ProcessHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId )

{
    NTSTATUS rc;

    rc = OldZwOpenProcess(ProcessHandle,AccessMask,ObjectAttributes,ClientId);
    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwOpenThread(
  OUT PHANDLE            ThreadHandle,
  IN ACCESS_MASK          AccessMask,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  IN PCLIENT_ID          ClientId )
{
    NTSTATUS rc;

    rc =  OldZwOpenThread(ThreadHandle,AccessMask,ObjectAttributes,ClientId);

    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

//Hook_NtCreatefile
NTSTATUS Hook_ZwCreateFile(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN PLARGE_INTEGER      AllocationSize OPTIONAL,
  IN ULONG                FileAttributes,
  IN ULONG                ShareAccess,
  IN ULONG                CreateDisposition,
  IN ULONG                CreateOptions,
  IN PVOID                EaBuffer OPTIONAL,
  IN ULONG                EaLength )
{
    NTSTATUS rc;

    rc = OldZwCreateFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,
                            AllocationSize,FileAttributes,ShareAccess,CreateDisposition,
                            CreateOptions,EaBuffer,EaLength);

    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwOpenFile(
  OUT PHANDLE            FileHandle,
  IN ACCESS_MASK          DesiredAccess,
  IN POBJECT_ATTRIBUTES  ObjectAttributes,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  IN ULONG                ShareAccess,
  IN ULONG                OpenOptions )
{
    NTSTATUS rc;

    rc =  OldZwOpenFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,ShareAccess,
                            OpenOptions);

    return rc;
}

/*************************************************************************************************

**************************************************************************************************/

NTSTATUS Hook_ZwClose(
  IN HANDLE              ObjectHandle )
{
    NTSTATUS rc;

    //在这里执行扫描必须十分注意,否则容易蓝屏

    rc = OldZwClose(ObjectHandle);
    return rc;
}

/*************************************************************************************************

  驱动函数入口

**************************************************************************************************/

NTSTATUS DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS        ntStatus;
    UNICODE_STRING  uszDriverString;
    UNICODE_STRING  uszDeviceString;
    UNICODE_STRING  uszEventString;

    PDEVICE_OBJECT    pDeviceObject;
    PDEVICE_EXTENSION extension;
    // 初始化设备对象名
    RtlInitUnicodeString(&uszDriverString, L"\\Device\\ITSys");
    // 创建并初始化对象
    ntStatus = IoCreateDevice(
        DriverObject,
        sizeof(DEVICE_EXTENSION),
        &uszDriverString,
        FILE_DEVICE_UNKNOWN,
        0,
        FALSE,
        &pDeviceObject
        );
    if(ntStatus != STATUS_SUCCESS)
        return ntStatus;
    extension = pDeviceObject->DeviceExtension;
    RtlInitUnicodeString(&uszDeviceString, L"\\DosDevices\\ITSys");
    // 创建用户可见连接名称
    ntStatus = IoCreateSymbolicLink(&uszDeviceString, &uszDriverString);
    if(ntStatus != STATUS_SUCCESS)
    {
        // 创建失败,删除对象并返回错误值
        IoDeleteDevice(pDeviceObject);
        return ntStatus;
    }
    // 赋值全局设备对象指针

    // Assign global pointer to the device object for use by the callback functions
    g_pDeviceObject = pDeviceObject;
    // 设置所有可用的DeviceIoControl的处理IRP的函数

    DriverObject->DriverUnload                            = UnloadDriver;
    DriverObject->MajorFunction[IRP_MJ_CREATE]            = DispatchCreate;
    DriverObject->MajorFunction[IRP_MJ_CLOSE]            = DispatchClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]    = DispatchIoCtrl;

#if DBG
    KdPrint(("RegistryPath : %ws\n",RegistryPath->Buffer));
#endif

    //SDT挂接
    StartHook();

    return ntStatus;
}

/*************************************************************************************************

  启用系统服务挂接

**************************************************************************************************/
//InterlockedExchange(a, b)能以原子操作的方式交换俩个参数a, b,并返回a以前的值;
//因为InterlockedExchange 是原子函数,不会要求中止中断,所以交换指针的方式是安全的。
void StartHook (void)
{
    //获取未导出的服务函数索引号
    HANDLE    hFile;
    PCHAR     pDllFile;
    ULONG     ulSize;
    ULONG     ulByteReaded;

    __asm     ////关闭内存保护
    {
        push       eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    //挂接SDT函数 必须是Zwxxxxx  而不能是Ntxxxxxx
    OldZwCreateFile                    = (ZWCREATEFILE)    InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateFile),
                                                        (LONG)Hook_ZwCreateFile);
    OldZwOpenFile                    = (ZWOPENFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenFile),
                                                        (LONG)Hook_ZwOpenFile);
    OldZwClose                        = (ZWCLOSE)            InterlockedExchange((PLONG)
                                                        &SDT(ZwClose),
                                                        (LONG)Hook_ZwClose);
    OldZwReadFile                    = (ZWREADFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwReadFile),
                                                        (LONG)Hook_ZwReadFile);
    OldZwWriteFile                    = (ZWWRITEFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwWriteFile),
                                                        (LONG)Hook_ZwWriteFile);

    OldZwTerminateProcess            = (ZWTERMINATEPROCESS)InterlockedExchange((PLONG)
                                                        &SDT(ZwTerminateProcess),
                                                        (LONG)Hook_ZwTerminateProcess);

    OldZwOpenProcess                = (ZWOPENPROCESS)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenProcess),
                                                        (LONG)Hook_ZwOpenProcess);

    OldZwOpenThread                    = (ZWOPENTHREAD)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenThread),
                                                        (LONG)Hook_ZwOpenThread);
    OldZwCreateSection                = (ZWCREATESECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateSection),
                                                        (LONG)Hook_ZwCreateSection);
    OldZwOpenSection                = (ZWOPENSECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenSection),
                                                        (LONG)Hook_ZwOpenSection);

    OldZwOpenKey                    = (ZWOPENKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenKey),
                                                        (LONG)Hook_ZwOpenKey);
    OldZwCreateKey                    = (ZWCREATEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateKey),
                                                        (LONG)Hook_ZwCreateKey);
    OldZwSetValueKey                = (ZWSETVALUEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwSetValueKey),
                                                        (LONG)Hook_ZwSetValueKey);
    OldZwDeleteKey                    = (ZWDELETEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwDeleteKey),
                                                        (LONG)Hook_ZwDeleteKey);
    OldZwDeleteValueKey                = (ZWDELETEVALUEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwDeleteValueKey),
                                                        (LONG)Hook_ZwDeleteValueKey);
    OldZwSetSecurityObject            = (ZWSETSECURITYOBJECT)InterlockedExchange((PLONG)
                                                        &SDT(ZwSetSecurityObject),
                                                        (LONG)Hook_ZwSetSecurityObject);

    OldZwLoadDriver                    = (ZWLOADDRIVER)InterlockedExchange((PLONG)
                                                        &SDT(ZwLoadDriver),
                                                        (LONG)Hook_ZwLoadDriver);

    OldZwSetSystemInformation        = (ZWSETSYSTEMINFORMATION)InterlockedExchange((PLONG)
                                                        &SDT(ZwSetSystemInformation),
                                                        (LONG)Hook_ZwSetSystemInformation);

    OldZwQuerySystemInformation        = (ZWQUERYSYSTEMINFORMATION)InterlockedExchange((PLONG)
                                                        &SDT(ZwQuerySystemInformation),
                                                        (LONG)Hook_ZwQuerySystemInformation);

    //关闭
    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    return ;
}

/*************************************************************************************************

  移除系统服务挂接

**************************************************************************************************/

void RemoveHook (void)
{
    __asm
    {
        push    eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }

    InterlockedExchange( (PLONG) &SDT(ZwCreateFile)                ,  (LONG) OldZwCreateFile                );
    InterlockedExchange( (PLONG) &SDT(ZwOpenFile)                ,  (LONG) OldZwOpenFile                    );
    InterlockedExchange( (PLONG) &SDT(ZwClose)                    ,  (LONG) OldZwClose                    );
    InterlockedExchange( (PLONG) &SDT(ZwReadFile)                ,  (LONG) OldZwReadFile                    );
    InterlockedExchange( (PLONG) &SDT(ZwWriteFile)                ,  (LONG) OldZwWriteFile                );

    InterlockedExchange( (PLONG) &SDT(ZwTerminateProcess)        ,  (LONG) OldZwTerminateProcess            );
    InterlockedExchange( (PLONG) &SDT(ZwOpenProcess)            ,  (LONG) OldZwOpenProcess                );
    InterlockedExchange( (PLONG) &SDT(ZwOpenThread)                ,  (LONG) OldZwOpenThread                );
    InterlockedExchange( (PLONG) &SDT(ZwCreateSection)            ,  (LONG) OldZwCreateSection            );
    InterlockedExchange( (PLONG) &SDT(ZwOpenSection)            ,  (LONG) OldZwOpenSection                );

    InterlockedExchange( (PLONG) &SDT(ZwOpenKey)                ,  (LONG) OldZwOpenKey                    );
    InterlockedExchange( (PLONG) &SDT(ZwCreateKey)                ,  (LONG) OldZwCreateKey                );
    InterlockedExchange( (PLONG) &SDT(ZwSetValueKey)            ,  (LONG) OldZwSetValueKey                );
    InterlockedExchange( (PLONG) &SDT(ZwDeleteKey)                ,  (LONG) OldZwDeleteKey                );
    InterlockedExchange( (PLONG) &SDT(ZwDeleteValueKey)            ,  (LONG) OldZwDeleteValueKey            );
    InterlockedExchange( (PLONG) &SDT(ZwSetSecurityObject)        ,  (LONG) OldZwSetSecurityObject        );

    InterlockedExchange( (PLONG) &SDT(ZwLoadDriver)                ,  (LONG) OldZwLoadDriver                );

    InterlockedExchange( (PLONG) &SDT(ZwSetSystemInformation)    ,  (LONG) OldZwSetSystemInformation        );
    InterlockedExchange( (PLONG) &SDT(ZwQuerySystemInformation)    ,  (LONG) OldZwQuerySystemInformation    );

    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
}

void UnloadDriver(IN PDRIVER_OBJECT DriverObject)
{
    UNICODE_STRING  uszDeviceString;
    NTSTATUS        ntStatus;

    //移除挂接
    RemoveHook();

    IoDeleteDevice(DriverObject->DeviceObject);

    RtlInitUnicodeString(&uszDeviceString, L"\\DosDevices\\ITSys");
    IoDeleteSymbolicLink(&uszDeviceString);

}

/*************************************************************************************************
//
// 创建与关闭驱动处理历程
//
**************************************************************************************************/

NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information=0;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return STATUS_SUCCESS;
}

NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
    NTSTATUS rc;

    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information=0;

    rc = Irp->IoStatus.Status;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return rc;
}

/**************************************************************************************************

    Win32 使用 DeviceIoControl 获取当前创建进程的信息的响应函数

***************************************************************************************************/

NTSTATUS DispatchIoCtrl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{

    NTSTATUS              ntStatus = STATUS_UNSUCCESSFUL;
    PIO_STACK_LOCATION    irpStack  = IoGetCurrentIrpStackLocation(Irp);
    PDEVICE_EXTENSION    extension = DeviceObject->DeviceExtension;

    switch(irpStack->Parameters.DeviceIoControl.IoControlCode)
    {
        default:
            break;
    }

    Irp->IoStatus.Status = ntStatus;

    // 设置返回给用户层程序的数据的字节数
    if(ntStatus == STATUS_SUCCESS)
        Irp->IoStatus.Information = irpStack->Parameters.DeviceIoControl.OutputBufferLength;
    else
        Irp->IoStatus.Information = 0;

    IoCompleteRequest(Irp, IO_NO_INCREMENT);
    return ntStatus;

}

原文地址:http://blog.51cto.com/haidragon/2304849

时间: 2024-11-07 00:21:55

SSDT hook完整版的相关文章

HOOK - 进程隐藏与进程保护(SSDT Hook 实现)(二)

进程隐藏与进程保护(SSDT Hook 实现)(二) 文章目录:                   1. 引子 – Demo 实现效果: 2. 进程隐藏与进程保护概念: 3. SSDT Hook 框架搭建: 4. Ring0 实现进程隐藏: 5. Ring0 实现进程保护: 6. 隐藏进程列表和保护进程列表的维护: 7. 小结: 1. 引子 – Demo 实现效果: 上一篇<进程隐藏与进程保护(SSDT Hook 实现)(一)>呢把 SSDT 说得差不多了, 博文地址: http://www

进程隐藏与进程保护(SSDT Hook 实现)(一)

读了这篇文章终于明白大致怎么回事了 文章目录:                   1. 引子 – Hook 技术: 2. SSDT 简介: 3. 应用层调用 Win32 API 的完整执行流程: 4. 详解 SSDT: 5. SSDT  Hook 原理: 6. 小结: 1. 引子 – Hook 技术: 前面一篇博文呢介绍了代码的注入技术(远程线程实现),博文地址如下: http://www.cnblogs.com/BoyXiao/archive/2011/08/11/2134367.html

进程隐藏与进程保护(SSDT Hook 实现)(二)

文章目录:                   1. 引子 – Demo 实现效果: 2. 进程隐藏与进程保护概念: 3. SSDT Hook 框架搭建: 4. Ring0 实现进程隐藏: 5. Ring0 实现进程保护: 6. 隐藏进程列表和保护进程列表的维护: 7. 小结: 1. 引子 – Demo 实现效果: 上一篇<进程隐藏与进程保护(SSDT Hook 实现)(一)>呢把 SSDT 说得差不多了, 博文地址: http://www.cnblogs.com/BoyXiao/archiv

vue组件间通信六种方式(完整版)

vue组件间通信六种方式(完整版) 前言 组件是 vue.js最强大的功能之一,而组件实例的作用域是相互独立的,这就意味着不同组件之间的数据无法相互引用.一般来说,组件可以有以下几种关系: 如上图所示,A 和 B.B 和 C.B 和 D 都是父子关系,C 和 D 是兄弟关系,A 和 C 是隔代关系(可能隔多代). 针对不同的使用场景,如何选择行之有效的通信方式?这是我们所要探讨的主题.本文总结了vue组件间通信的几种方式,如props.$emit/$on.vuex.$parent / $chil

office2016 软件全集 官方下载免费完整版(含破解文件)不含垃圾软件 win10完美激活

office2016官方下载免费完整版是新一代办公软件,office2016官方下载免费完整版已经分享到下面,office2016官方下载免费完整版包括了Word.Excel.PowerPoint.OneNote.Outlook.Skype.Project.Visio以及Publisher等组件和服务.下面分享:office2016软件的下载.安装及激活. 本文来自互联网,按原教程安装结果中招了,因含有垃圾软件,所以决定改写,以免你懂的... 注册文件下载中含有垃圾软件,请按下面的步骤操作会跳过

Hadoop实战视频教程完整版 完整的Hadoop大数据视频教程

分享一套迪伦老师的完整的Hadoop实战视频教程,教程从学习Hadoop需要的数据库.Java和Linux基础讲起,非常适合零基础的学员,课程最后结合了实战项目演练,理论结合实战,深入浅出,绝对是当前最为完整.实战的Hadoop教程. <Hadoop大数据零基础高端实战培训系列配文本挖掘项目(七大亮点.十大目标)> 课程讲师:迪伦 课程分类:大数据 适合人群:初级 课时数量:230课时 用到技术:部署Hadoop集群 涉及项目:京东商城.百度.阿里巴巴 咨询QQ:1337192913(小公子)

rip路由协议 细节分析及实例配置【完整版】

rip路由协议 细节分析及实例配置[完整版] RIP呢,这是一个比较重要的知识点,所以它的知识覆盖面很广泛:但是呢,我将会对碰到的问题进行一些分析解刨(主要是为了帮助自己理清思维):也希望能够从中发现自己不足的问题,也希望能够找到一些比较冷僻的问题,这样子才会有意思多了.   先上图,这个就是我准备做实验的基本用图了.现在已经按照图上标注的IP将所有基本配置设置好了. 在这个实验中,大多数都是基于ripv1,只有在需要比较的时候才会把版本改成ripv2,然后判断完之后再切换为ripv1: 第一步

信号处理必读的文章(-)—傅里叶分析之掐死教程(完整版)_转载至知乎

傅里叶分析之掐死教程(完整版)更新于2014.06.06 http://zhuanlan.zhihu.com/p/19763358 作 者:韩 昊 知 乎:Heinrich 微 博:@花生油工人 知乎专栏:与时间无关的故事 谨以此文献给大连海事大学的吴楠老师,柳晓鸣老师,王新年老师以及张晶泊老师. 转载的同学请保留上面这句话,谢谢.如果还能保留文章来源就更感激不尽了. ——更新于2014.6.6,想直接看更新的同学可以直接跳到第四章———— 我保证这篇文章和你以前看过的所有文章都不同,这是12年

CSS3弹性盒模型flexbox完整版教程

文章目录 基础知识 属性介绍 display: flex | inline-flex; (适用于父类容器元素上) 请注意: flex-direction (适用于父类容器的元素上) flex-wrap (适用于父类容器上) flex-flow (适用于父类容器上) justify-content (适用于父类容器上) align-items (适用于父类容器上) align-content (适用于父类容器上) order (适用于弹性盒模型容器子元素) flex-grow (适用于弹性盒模型容