Alt Syscall Hook Driver

參考 https://fluxsec.red/alt-syscalls-for-windows-11 做的 alt syscall hook

主要是為了學習以及紀錄一下之前學習的驅動寫法 還有這東西實在太酷了忍不住自己實驗起來 沒想到 2026 還能有 SSDT Hook

還有太久沒寫驅動了 把環境重新架起來

Note

Because I don't have certificate so I used KDU to load the driver

Before use it u should compile KDU and put in the same directory as the client

Files

File	Description
KD_test/main.cpp	Driver entry point, IoCreateDriver bootstrap
KD_test/ssdt_hook.hpp	Core hook logic: setup, teardown, callback, SSN table
KD_test/device_io.hpp	Device creation, IOCTL dispatch
client/client.cpp	Usermode client: KDU loader, IOCTL sender

Callback Customization / 自訂 Callback

Edit syscallCallback in ssdt_hook.hpp:

extern "C" int syscallCallback(PVOID pNtFunction, ULONG ssn, PVOID argsBase, PVOID p3Home)
{
    // Block NtCreateFile — target process can't open/save files
    if (ssn == 0x0055) {
        DbgPrint("[+] BLOCKED NtCreateFile!\n");
        return 0;  // skip original syscall / 跳過原始 syscall
    }

    return 1;  // passthrough / 放行
}

Return	Behavior
0	Block — original Nt function is not executed / 攔截，原始函數不執行
1	Passthrough — original Nt function executes normally / 放行，正常執行

Note: Only intercepts syscalls made by the target process's own threads. Syscalls from other processes (e.g. Task Manager calling NtTerminateProcess) are not intercepted.

References

• Alt Syscall
• KDU