注意返回時得使用iretd。
通過sidt取得idtr，找到里面的基址和limit。遍歷所有的表項，找到一個p位沒有置位的，添加一個調(diào)用門。和使用call gate沒什么大差別。
?
看了下，我機器里的第一個空白項是0x20，就懶得寫和ring3通信的東西了。
?
ring3：
#include <stdio.h>

int main()
{
????__asm int 0x20

????return 1;
}
?
ring0：
#include <ntddk.h>

#pragma pack(1)
typedef struct _IDTR
{
????USHORT limit;
????ULONG base;
}IDTR, *PIDTR;

typedef struct _IDT_ENTRY
{
????USHORT OffsetLow;
????USHORT selector;
????UCHAR reserved;
????UCHAR type :4;
????UCHAR always0 :1;
????UCHAR dpl :2;
????UCHAR present :1;
????USHORT OffsetHigh;
}IDT_ENTRY, *PIDT_ENTRY;
#pragma pack()

ULONG IdtIndex = 0;
IDT_ENTRY IdtEntry = {0};
PIDT_ENTRY OrigIdtEntry = NULL;

ULONG SetInterruptGate(PVOID MyFuncAddr);
MyFunc();
VOID ring0func();
VOID DriverUnload(PDRIVER_OBJECT pDriverObject);

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject,PUNICODE_STRING pRegistryPath)
{
????IdtIndex = SetInterruptGate(MyFunc);
????pDriverObject->DriverUnload = DriverUnload;

????return STATUS_SUCCESS;
}

ULONG SetInterruptGate(PVOID MyFuncAddr)
{
????IDTR idtr = {0};
????ULONG i = 0;
????PIDT_ENTRY pIdtEntry = NULL;

????__asm sidt idtr
????
????for(i = 0;i < idtr.limit;i++)
????{
????????pIdtEntry = (PIDT_ENTRY)(idtr.base + i * 8);

????????if(!pIdtEntry->present)
????????{
????????????OrigIdtEntry = pIdtEntry;

????????????IdtEntry.OffsetLow = pIdtEntry->OffsetLow;
????????????IdtEntry.OffsetHigh = pIdtEntry->OffsetHigh;
????????????IdtEntry.selector = pIdtEntry->selector;
????????????IdtEntry.reserved = pIdtEntry->reserved;
????????????IdtEntry.type = pIdtEntry->type;
????????????IdtEntry.always0 = pIdtEntry->always0;
????????????IdtEntry.dpl = pIdtEntry->dpl;
????????????IdtEntry.present = pIdtEntry->present;

????????????pIdtEntry->OffsetLow = (USHORT)MyFuncAddr;
????????????pIdtEntry->OffsetHigh = (USHORT)((ULONG)MyFuncAddr >> 16);
????????????pIdtEntry->selector = 0x8;
????????????pIdtEntry->reserved = 0;
????????????pIdtEntry->type = 0xE;
????????????pIdtEntry->always0 = 0;
????????????pIdtEntry->dpl = 3;
????????????pIdtEntry->present = 1;

????????????break;
????????}
????}

????return i;
}

__declspec(naked) MyFunc()
{
????__asm
????{
????????pushad
????????call ring0func
????????popad
????????iretd
????}
}

VOID ring0func()
{
????DbgPrint("interrupt gate");
}

VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
????OrigIdtEntry->OffsetLow = IdtEntry.OffsetLow;
????OrigIdtEntry->OffsetHigh = IdtEntry.OffsetHigh;
????OrigIdtEntry->selector = IdtEntry.selector;
????OrigIdtEntry->reserved = IdtEntry.reserved;
????OrigIdtEntry->type = IdtEntry.type;
????OrigIdtEntry->always0 = IdtEntry.always0;
????OrigIdtEntry->dpl = IdtEntry.dpl;
????OrigIdtEntry->present = IdtEntry.present;
}

?

轉(zhuǎn)載于:https://www.cnblogs.com/foohack/p/3582302.html

總結(jié)

以上是生活随笔為你收集整理的使用中断门的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。