fiyher / infinityhookpro Goto Github PK

View Code? Open in Web Editor NEW

467.0 18.0 168.0 1.62 MB

InfinityHookPro Win7 -> Win11 latest

License: MIT License

C++ 80.02% C 19.98%

infinityhook hook patchguard rootkit kernel driver win7 win8 win10 win11

infinityhookpro's Introduction

InfinityHookPro

InfinityHookPro Win7 -> Win11 latest

最近来了兴致,拿起了InfinityHook,原始的版本有点小问题,后来改了支持Win7到Win10 1909的,后来就没有然后了

今天参考了网上大佬发出来的各种版本,最终出了这份代码,理论上支持Win7到最新版本的Win11了

Win11支持完毕,也只是GetCpuClock偏移变动而已

代码里面有很详细的注释,不懂的地方可以结合博客

再次接力,Make InfinityHook Great Again Again 💪💪💪

参考博客
https://bbs.pediy.com/thread-266207.htm (带逆向分析)
https://bbs.pediy.com/thread-266136.htm	(挂钩失效问题)
https://bbs.pediy.com/thread-260962.htm	(19041)
https://bbs.pediy.com/thread-253450.htm	(雪碧)
https://www.anquanke.com/post/id/206288#h2-1	(19041)
https://www.freebuf.com/articles/system/278857.html	(2004)

参考源码
https://github.com/everdox/InfinityHook	(原版)
https://github.com/fIappy/infhook19041	(19041)
https://github.com/huoji120/MakeInfinityHookGreatAgain	(2004)

测试系统 Win7, Win8, Win10 1909, Win10 21h1, Win11 22000

infinityhookpro's People

Contributors

Stargazers

Watchers

Forkers

kungia09 ellen2015 fengjixuchui kingking888 bb33bb garfield-chen w1nds explife0011 y11en mfxiaosheng xiaoshzx crackercat wonderzdh bopin2020 classic130 binguoa cloutain wyrover yuaom 2217936322 wdnmd-rushb bobh233 testcc2c lmhmike jilvan1234 stuxnet147 icxldd flyc05 goldguyu xyddnljydd kycgni my-git-li blackchicken20 yankaish crack5 qiutao1204 he1094388343 dogkill ashtestone liushouhuo archar123 rythorndoran meqq752224848 fiappy tzf-omkey sitansime anti-ghosts kenuosec damen0909 1210141387 welain lllzed rocker9527 asdlei99 gzsgcser getsync duckycy bixingbin 54208039 killvxk ltears decay88 d34d633f talkitnexttime sumtaron orange150 18243133 lengye7 joker594302831 mifeng-super zzz-monster boa9448 wbaby nil-ref ylkcy oldyang1983 bypasscc hugmyndakassi defensexs lthcweb imkk666 yeah9782 shahriyarb innovationlou aoniam opensesamedoors directoree jiajinrong12138 qing666888 abcz1114 kdreamforest kaganisildak ckwindowsproject yangfan6888 zezebackup jdzjames data-gami wei858910 lyingsimon sionthanatos

infinityhookpro's Issues

加载驱动后死机

如上图，没有任何报错和蓝屏日志，在程序中显示成功注册，特征码也已修复。但是虚拟机操作无反应，windbg显示仍在调试中，点击关机按钮就立刻关机。（有可能是系统仍在运行但是卡死）
系统版本10.0.22621.1778
版本号19045。

此问题测试环境vmware win10-22h2(19045.2251),win11-22h2
if (!address) return false; //代码执行到这里就false了.在start里因为m_HvlGetQpcBias为零就直接蓝屏了
m_HvlGetQpcBias = reinterpret_cast(reinterpret_cast<char*>(address) + 7 + reinterpret_cast<int>(reinterpret_cast<char*>(address) + 3));
DbgPrintEx(0, 0, "[%s] hvl get qpc bias is 0x%llX \n", FUNCTION, m_HvlGetQpcBias);
if (!m_HvlGetQpcBias) return false;
不知是否因为是系统版本问题。请问有办法兼容22h2么？

kdmapper 内存加载 InfinityHookPro.sys 出现问题

您好，当我尝试使用 https://github.com/TheCruZ/kdmapper
内存加载 InfinityHookPro.sys 时，它执行失败了，原因是 NtTraceControl 返回了 c0000005 。
我明白这应该是内存加载驱动自身的缺陷，但我仍然好奇。

如果您遇到过类似的问题，希望能得到您的指点。

最后，希望这个项目越来越好😁。

您好驱动貌似有点问题系统版本为10941.264

设置CpuClock=2后已经替换了HvlGetBias钩子但是似乎没有执行仿佛没调用这个函数

驱动一点小bug

在虚拟机测试没问题，但是在本机就没效果，有的人有效果，很奇怪，有没有人解决呀，win10系统

> 感谢大佬开源

感谢大佬开源

Reference

所以朋友你到底改了什么？

Originally posted by @Skycn999 in #4 (comment)

一个小问题

不需要bypass PG吗?

7600测试失败

win10下hook ZwQuerySystemInformation失败

win10 版本1067 hook ZwQuerySystemInformation函数失败

[k_hook::initialize] call back ptr is 0xFFFFF80B7FBA2A80
[k_hook::initialize] build number is 14393
[k_hook::initialize] ntoskrnl address is 0xFFFFF803A901C000
[k_hook::initialize] etwp debugger data is 0xFFFFF803A930EE58
[k_hook::initialize] etwp debugger data silo is 0xFFFFBF0723441390
[k_hook::initialize] ckcl wmi logger context is 0xFFFFBF0725835040
[k_hook::initialize] get cpu clock is 0xFFFFF803A905477C
[k_hook::initialize] syscall table is 0xFFFFF803A9170000
[k_hook::start] start ckcl fail

用法：
UNICODE_STRING str;
RtlInitUnicodeString(&str, L"ZwQuerySystemInformation");
fnZwQuerySystemInformation = (pfnZwQuerySystemInformation)MmGetSystemRoutineAddress(&str);

    if (!k_hook::initialize(call_back))
    {
        DbgPrintEx(0, 0, "[%s] k_hook::initialize fail 0x%p \n", __FUNCTION__, fnZwQuerySystemInformation);
    }
    else {
        k_hook::start();
    }