HalpCreateInterrupt正确使用方法不需要patch了idt

原创

于 2025-01-31 11:57:36 发布 · 116 阅读

0 ·

CC 4.0 BY-SA版权

始于C#，精于C&C++，醉心于Windows内核与Com组件安全研究

文章标签：

#windows

使用方法


 VOID	 NTAPI	 KeInitializeInterrupt(
	 IN PKINTERRUPT Interrupt,
	 IN PKSERVICE_ROUTINE ServiceRoutine,
	 IN PVOID MessageServiceRoutine,
	 IN PVOID ServiceContext,
	 IN ULONG MessageIndex,
	 IN PKSPIN_LOCK SpinLock,
	 IN ULONG Vector,
	 IN KIRQL Irql,
	 IN KIRQL SynchronizeIrql,
	 IN KINTERRUPT_MODE InterruptMode,
	 IN BOOLEAN ShareVector,
	 IN KAFFINITY ProcessorNumber
	);

 PVOID NTAPI KeConnectInterruptForHal(
	 IN PKINTERRUPT Interrupt);
VOID HalpCreateInterrupt()
{
	NTSTATUS status = STATUS_SUCCESS;
	KAFFINITY affnift = 1 << vpidxmax;
	PKINTERRUPT InterruptObject = (PKINTERRUPT)ExAllocatePool2(POOL_FLAG_NON_PAGED, VSM_PAGE_SIZE, HARNESS_POOL_TAG);
	KeInitializeInterrupt(InterruptObject, ProcessSynicChannelMsg, nullptr, pDeviceObject,0, nullptr, HYPERVISOR_CALLBACK_VECTOR, PASSIVE_LEVEL, DISPATCH_LEVEL, Latched, true, affnift);
	PVOID ret = KeConnectInterruptForHal(InterruptObject);
	DbgPrintEx(DPFLTR_IHVDRIVER_ID, DEBUG_LEVEL, "KHV: vpidx %08x KeCon