I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is a table or some kind of place where the other dll functions reside. Let's say I wanna hook Advapi32!CryptEncrypt function in Kernel Mode. How can this be done?

  • 2
    can you be more specific - do you want to hook user-mode functions from within kernel-mode? Or do you want to hook kernel-mode functions (in which case, there is no Advapi32!CryptEncrypt, for example - it's a purely user-mode function)? Nov 17 '17 at 17:46
  • I wanna hook CryptEncrypt from kernel-mode. Or a kernel-mode function which CryptEncrypt calls in itself like CreateFile does for NtCreateFile. Nov 17 '17 at 19:53
  • 1
    then you're out of luck. As I said, CryptEncrypt is purely user-mode. It does not rely on kernel code for its work. Nov 17 '17 at 22:23

It feels like there are two questions here. 1) Finding addresses of system DLLs and 2) Hooking a specific function in the discovered DLL. I'll answer the first question, since it is the title of this post.

To find the address of all DLLs, call one of the following functions from your own custom application:

EnumProcessModules: https://msdn.microsoft.com/en-us/library/windows/desktop/ms682631(v=vs.85).aspx

EnumProcessModulesEx: https://msdn.microsoft.com/en-us/library/windows/desktop/ms682633(v=vs.85).aspx

The tradeoff here is that EnumProcessModules only fetches modules of the same bit-ness (ie if calling from a 64-bit program, only 64-bit modules are fetched)

EnumProcessModulesEx gives more control and allows fetching all modules, but is a bit trickier to use.

You can then check the module base address to see if is in user mode space or kernel mode space. Unfortunately this can vary depending on how the target program was compiled. 32-bit programs are generally kernel mode from 0x80000000 to 0xFFFFFFFF, and 64-bit programs are generally kernel mode from 0xFFFF0800'00000000 to 0xFFFFFFFF'FFFFFFFF. Additional information can be found below:

https://msdn.microsoft.com/en-us/library/windows/desktop/aa366912(v=vs.85).aspx and https://msdn.microsoft.com/en-us/library/windows/desktop/aa366778(v=vs.85).aspx

  • 2
    imho op wants to muck with usermode from kernelmode and wants to do it on arbitrary functions i dont think he can use usermoode function like enumxxx
    – blabb
    Nov 17 '17 at 3:08
  • more than that, I got the impression that he wants to hook kernel-mode functions, not user-mode ones, and that he means drivers rather than DLLs. Nov 17 '17 at 17:44
  • no I mean functions which other dlls export like MessageBox which is exported by user32.dll , CryptEncrypt which is exported by advapi32.dll. I wanna know the offsets to these functions like we have for NtCreateFile, NtQuerySystemInformation in SSDT. Nov 17 '17 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.