| View previous topic :: View next topic |
| Author |
Message |
Zerith
Master Cheater
 Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
 Posted: Fri Jan 30, 2009 8:36 am Post subject: Question| Interrupt Hooking |
 |
|
Hello, i'm trying to hook interrupts, and for some reason it doesn't work.
Here's my code:
http://pastebin.com/m33877ede
Output:
| Code: |
MyKbdRoutine: 0xF8ABC4C0
Original: int15_entry: 0x80543A50
New: int15_entry: 0xF8ABC4C0
Unhooked: int15_entry: 0x80543A50
Unhooking Successful!
|
The original handler is being overwritten with my function according to the output.
I tried pressing keys but nothing was outputted.
so i tried to change KEYBOARD_INT to 21 (For int 21h), and i got 0x0000000 as it's handler.
Why am i getting an invalid address for INT 21 handler?
Is there a problem with my code?
Thank you for your help.
Why am i getting an invalid address when changing to 21?
|
|
| Back to top |
|
 |
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Fri Jan 30, 2009 6:57 pm Post subject: |
|
|
| So... why are you calling any sort of Windows API inside an interrupt handler again? Death wish?
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Jan 31, 2009 12:01 am Post subject: |
|
|
| Flyte wrote: | | So... why are you calling any sort of Windows API inside an interrupt handler again? Death wish? |
That though is irrelevant, since my handler isn't even being called.
I think i am getting the wrong address of the real handler, any suggestions?
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Sat Jan 31, 2009 12:08 am Post subject: |
|
|
| Zerith wrote: | | Flyte wrote: | | So... why are you calling any sort of Windows API inside an interrupt handler again? Death wish? |
That though is irrelevant, since my handler isn't even being called.
I think i am getting the wrong address of the real handler, any suggestions? |
I bet you are running it on a multi-core processor. 
Oh, and I said that because in your code you commented that you BSOD'd when you called in yourself. My previous post is why.
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Jan 31, 2009 12:10 am Post subject: |
|
|
| Flyte wrote: | | Zerith wrote: | | Flyte wrote: | | So... why are you calling any sort of Windows API inside an interrupt handler again? Death wish? |
That though is irrelevant, since my handler isn't even being called.
I think i am getting the wrong address of the real handler, any suggestions? |
I bet you are running it on a multi-core processor.
Oh, and I said that because in your code you commented that you BSOD'd when you called in yourself. My previous post is why. |
Ahh, i know you need to hook both IDTs for a multi-core processor, but i have one processor.
sadly that isn't the problem.
Alright, i'll try removing the dbgprint and calling it. i'll come back with results in a minute.
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Sat Jan 31, 2009 12:16 am Post subject: |
|
|
| Also, you didn't fix the stack after you were done. Assuming that when you declare a variable in a function with the __declspec(naked) attribute only allocates it and doesn't fix the stack itself. I've actually never checked (always done everything in ASM in naked functions).
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Jan 31, 2009 12:24 am Post subject: |
|
|
Alright, i tried removing everything but the jmp to the original handler.
I called INT 15, and crashed. 
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Sat Jan 31, 2009 12:47 am Post subject: |
|
|
| Zerith wrote: | Alright, i tried removing everything but the jmp to the original handler.
I called INT 15, and crashed. |
Well, I don't have a DDK installed on this machine, so I can't do any testing with it. However, if memory serves me correctly:
| Code: | #pragma pack(1)
typedef struct
{
WORD LowOffset;
WORD selector;
BYTE unused_lo;
unsigned char unused_hi:5;
unsigned char DPL:2;
unsigned char P:1;
WORD HiOffset;
} IDTENTRY;
#pragma pack() |
Should be:
| Code: | typedef struct {
WORD Low;
WORD Selector;
WORD Garbage;
WORD T:5;
WORD DPL:2;
WORD P:1;
WORD High;
} IDTENTRY; |
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Sat Jan 31, 2009 10:09 am Post subject: |
|
|
DbgPrint is exported by the kernel no need to worry about that api....
you should keep the DbgPrints and at Key Locations where you think bsod is happening use KeDelayExecutionThread to see where it actualy gets to.
my thought being is the crash is that you are installing the handler the wrong way..(i went over your code, and it should be entirely workable) (hopefully)
Regards BanMe
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Jan 31, 2009 10:39 am Post subject: |
|
|
I'm crashing when calling INT 15, if i remove that line i get no BSODs.
But nothing calls my handler.
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Sat Jan 31, 2009 11:23 am Post subject: |
|
|
try just __asm int15;
instead of far jmping to the handler address 
|
|
| Back to top |
|
|
Zerith
Master Cheater
Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sat Jan 31, 2009 11:31 am Post subject: |
|
|
| BanMe wrote: | try just __asm int15;
instead of far jmping to the handler address |
You didn't read my post and obviously not my code either.
I did try using INT 15. and crashed.
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Sat Jan 31, 2009 2:31 pm Post subject: |
|
|
I'm quite sure this is the correct structure (small difference from the one I posted above).
| Code: | typedef struct {
WORD Low;
WORD Selector;
WORD Garbage:8;
WORD T:5;
WORD DPL:2;
WORD P:1;
WORD High;
} IDTENTRY; |
Honestly, whoever wrote the other structure must of been on drugs. It makes no sense to have unused_lo be 8 bits, and unused_hi be 5. My structure may be wrong, as I'm working off of memory, but I doubt it (it shouldn't make any difference in the long run, as they are both the same size; it's just for clarity purposes).
I'm also sure that you don't need to deal with hi/lo words in the IDTINFO struct, this should be sufficient:
| Code: | typedef struct {
WORD IDTLimit;
DWORD IDTBase;
} IDTINFO; |
Again, I may wrong since I'm working off of memory, but as usual I doubt it. 
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
