Cheat Engine

[iPromise]

I have a few questions in regards to drivers as well as hooking kernel functions. I've personally created my own driver so I know that KeStackAttachProcess is a crucial function to any driver that accesses memory be it for anti-hacking purposes or for hacking purposes.

What i've noticed however is these functions don't have their own libraries (understandable) but then if they don't have their own libraries, where does the call to the function end up at? What application handles the call to the function?

I'm attempting to set a hook on the function in order to prevent specific drivers from attaching to specific processes. I figured that if 64-bit machines reject unsigned drivers from loading, and if they are loaded, from running correctly then I must be able to set a hook on KeStackAttachProcess without receiving much of an error from the game such as "Can't communicate with the driver".

But theres a big difference from setting a hook in usermode and kernelmode.

I don't know where to set the hook and I also don't have to the ability to read the inline assembly of the kernel function like I can read it in usermode in order for me to create an appropriate hook. I have a variety of tools for usermode functions such as Cheat Engine and ollydbg but I don't have those luxories when I want to view kernelmode memory so I was wondering if there is any softwares similiar to OllyDbg which allows to be view kernel memory.

If anybody can clear up my questions that would be awesome.

[Zerith]

This is something you could have easily found by searching.
Many kernel debuggers exist, such as WingDbg, which is a very powerful tool, and Syser.

Moreover, I did not understand your original question: "What application handles the call to the function? ". I suggest you read a good book, like Windows Internals.

[Dark Byte]

Cheat engine can view kernel memory as well, just enable kernelmode readprocessmemory in settings. And for debugging use dbvm when in 64bit

Anyhow, you can't hook KeAttachProcess in 64-bit as windows does an integrity check now and then

Also, mov cr3 is a very useful instruction that works without that api

You can call obRegisterCallback to register a signed function to block everything from getting a handle to your process and threads (not windows i think), but KeAttachProcess will keep working

[iPromise]

Thanks for your detailed response.

My goal is to hook KeStackAttachProcess on 32 bit computers so I shouldn't have to worry about an integrity check should I?

Anyhow, I dived right into the subject and currently i'm attempting to hook KeStackAttachProcess after using MmGetSystemRoutine to locate its address.

This is my following hooking code, short but breif:

[Dark Byte]

Your hook function is not declared as naked, so it places a push ebp/mov ebp,esp at the start, causing your own push ebp/mov ebp,esp to be duplicate and thus mess up the return address, causing it to jump to a random location.(stack)

And yes, most kernelmode memory is shared by all processes, so if you change it in one process, you're changing it in all (You can bypass that by setting up your own pagetable entries for the .code section of ntoskrnl.exe though so that your own process never sees the hooked code, but that's very ugly)

[iPromise]

Thanks for your help.

I got everything working, however there is one final problem. Everytime I load up my driver, it halts any driver including cheat engine's from loading up if it hasn't already loaded up until my driver has finished and unloaded. StartService () doesn't return until my driver has been unloaded.

I have no clue how to solve this as I am new to driver coding and the documentation on the DriverEntry function in MSDN doesn't to my knowledge cover where you should initialize your main code. Can you guide me to any links that covers this issue?

If you need to look at my driverentry code, here it is:

[Dark Byte]

Try commenting out Setup ( pKeStackAttachProcess, &Hook ); and see if it still freezes

[iPromise]

Its not a problem of freezing.

The problem is that each time I start up my driver, it works wonders. However, it for some reason doesn't allow any other driver to load up until it has unloaded.

I assumed that was because I had something screwed up in DriverEntry.