SDTrestore (Proof-of-Concept)

//*********************************************************************************************
// SDTrestore (Proof-of-Concept)
// Version 0.1
// by SIG^2 G-TEC Lab
//
// Coded by Chew Keong TAN
//
// Permission is hereby granted, free of charge, to any person obtaining a
// copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, and/or sell copies of the Software, and to permit persons
// to whom the Software is furnished to do so, provided that the above
// copyright notice(s) and this permission notice appear in all copies of
// the Software and that both the above copyright notice(s) and this
// permission notice appear in supporting documentation.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
// OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
// HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL
// INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING
// FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
// NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
// WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
//
// This program needs to access \device\physicalmemory, so you must be
// running as Administrator when using this.
//
//*********************************************************************************************

从www.rootkit.com找来的
用来恢复SSDT，使用了\device\physicalmemory进入ring0，看来过不了卡巴了。。。

代码太长了，不贴了。还是传附件好，这个是0.2版的代码

恢复SSDT还是在驱动层做好。。。

好古老的代码

求驱动恢复恢复SSDT的代码。。。。

这个东西好像不具通用性，部分机子上失效。

要过卡巴的先实现能不用注册表来加载驱动，再在驱动里恢复SSDT，网上使用ZwSetSystemInformation加载驱动的，不过我没有加载成功过，不知道这个是否和驱动的写法有关系，谁知道告诉一下方法

恢复后直接蓝屏 装卡巴6.0 或7.0的机子式

        在部分机器上失效应该是系统所采用的内核不一样，ntoskrnl.exe 或者 ntkrnlpa.exe等搞清楚后，重新编译下。
        卡巴下蓝屏，是因为卡巴在SSDT中自己多加了几个API（用IS可以看到），不要尝试还原这几个API。