ktdistreamsocket.cpp

尔罗斯著名黑客写的rootkit

#include "KTdiStreamSocket.h"
//#include "../KLocker/KLocker.h"

#define ALIGN_4(x) \
        (((x) & 0x00000003) ? (((x) & 0xfffffffc) + 4) : (x))



KTdiStreamSocket::KTdiStreamSocket()
                : KTdiInterface(),
m_bOpen(FALSE)
{
  m_pRequestListenInfo = NULL;
  
  m_bBind = FALSE;
  m_bConnected = FALSE;
  m_bListen = FALSE;

  //m_dwTreatAcceptIrpsCount = 0;
  m_TreatAcceptIrpsCount = 0;
}

KTdiStreamSocket::~KTdiStreamSocket()
{
  //Disconnect();
  Close();
}

BOOLEAN KTdiStreamSocket::Open(IN USHORT nLocalPort)
{
  //KLocker locker(&m_KSynchroObject);

  //Disconnect();
  if (Close() == FALSE)
    return FALSE;

  if (KTdiInterface::Open(DD_TCP_DEVICE_NAME) == TRUE)
  {
    //m_KSynchroObject.Lock();
   
    if (TdiOpenSocket(nLocalPort) == TRUE)
    {
      DbgPrint ("\tm_hTdiTransport = %08x\n"
                "\tm_pTdiTransportObject = %08x\n"
                "\tm_hTdiConnection = %08x\n"
                "\tm_pTdiConnectionObject = %08x\n",
                 m_hTdiTransport,
                 m_pTdiTransportObject,
                 m_hTdiConnection,
                 m_pTdiConnectionObject);
   
      //KeInitializeEvent(&m_kReceiveInProgressEvent, SynchronizationEvent, FALSE);
      //KeInitializeEvent(&m_kSendInProgressEvent, SynchronizationEvent, FALSE);
      
      m_bOpen = TRUE;
    }
   
    //m_KSynchroObject.UnLock();
  }

  return m_bOpen;
}

BOOLEAN KTdiStreamSocket::Close()
{
  //KLocker locker(&m_KSynchroObject);

  //Disconnect();

  //m_KSynchroObject.Lock();

  //if (m_bOpen == TRUE && m_dwTreatAcceptIrpsCount == 0)
  if (m_bOpen == TRUE && m_TreatAcceptIrpsCount.CompareExchange(0, 0) == TRUE)
  {
    Disconnect();
    Unbind();
    
    m_bOpen = FALSE;
    m_bBind = FALSE;
    m_bConnected = FALSE;
    m_bListen = FALSE;
  }

  if (m_bOpen == TRUE || KTdiInterface::Close() == FALSE)
    return FALSE;

  //m_KSynchroObject.UnLock();

  return !m_bOpen;
}

BOOLEAN KTdiStreamSocket::Bind()
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN         bRes = FALSE;
  PIRP            pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT  pDeviceObject;
  NTSTATUS        NtStatus;
  IO_STATUS_BLOCK IoStatusBlock;

  __try
  {
    if (m_bOpen == TRUE && Unbind() == TRUE)
    {
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
      pIrp = TdiBuildInternalDeviceControlIrp(
                    TDI_ASSOCIATE_ADDRESS, 
                    pDeviceObject, 
                    m_pTdiConnectionObject,
                    NULL, 
                    NULL);
      pIrpError = pIrp;
      if (pIrp != NULL)
      {
        TdiBuildAssociateAddress(
               pIrp, 
               pDeviceObject, 
               m_pTdiConnectionObject,
               NULL,
               NULL, 
               m_hTdiTransport);
        
        pIrpError = NULL;
        NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);
        if (NT_SUCCESS(NtStatus))
        {
          m_bBind = TRUE;
          bRes = TRUE;
        }
        else
        {
          DbgPrint ("TdiBind: ERROR (%08x)!!!\n", NtStatus);
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
  }

  return bRes;
}

BOOLEAN KTdiStreamSocket::Unbind()
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN         bRes = TRUE;
  PIRP            pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT  pDeviceObject;
  NTSTATUS        NtStatus;
  IO_STATUS_BLOCK IoStatusBlock;

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bConnected == FALSE && m_bListen == FALSE)
    {
      bRes = FALSE;

      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
      pIrp = TdiBuildInternalDeviceControlIrp(
                    TDI_DISASSOCIATE_ADDRESS, 
                    pDeviceObject, 
                    m_pTdiConnectionObject,
                    NULL, 
                    NULL);
      pIrpError = pIrp;
      if (pIrp != NULL)
      {
        TdiBuildDisassociateAddress(
               pIrp, 
               pDeviceObject, 
               m_pTdiConnectionObject,
               NULL,
               NULL);
        
        pIrpError = NULL;
        NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);
        if (NT_SUCCESS(NtStatus))
        {
          m_bBind = FALSE;
          bRes = TRUE;
        }
        else
        {
          DbgPrint ("TdiUnbind: ERROR (%08x)!!!\n", NtStatus);
        }
      }
    }
  }
  __finally
  {
   if (pIrpError != NULL)
     IoFreeIrp(pIrpError);
  }

  return bRes;
}

BOOLEAN KTdiStreamSocket::Connect(IN USHORT wPort, IN ULONG dwAddress, ULONG dwTimeOut)
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN                      bRes = FALSE;
  PIRP                         pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  PTDI_CONNECTION_INFORMATION  pRequestConnectionInfo = NULL;
  PTDI_CONNECTION_INFORMATION  pReturnConnectionInfo;
  PTA_IP_ADDRESS               pRequestAddress;
  PTDI_ADDRESS_IP              pIp;
  IO_STATUS_BLOCK              IoStatusBlock;
  LARGE_INTEGER                TimeOut;
  PLARGE_INTEGER               pTimeOut = NULL;

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bListen == FALSE && Disconnect() == TRUE)
    {
      m_nRemotePort = wPort;
      m_nRemoteAddress = dwAddress;

      if (dwTimeOut != 0)
      {
        pTimeOut = &TimeOut;
        TimeOut.QuadPart = dwTimeOut * 10000; // msec -> 100 nsec intervals
        TimeOut.QuadPart = -TimeOut.QuadPart;
      }
      
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
      pRequestConnectionInfo = (PTDI_CONNECTION_INFORMATION) new char[sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS)];
      if (pRequestConnectionInfo != NULL)
      {
        memset(pRequestConnectionInfo, 0, sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS));

        pReturnConnectionInfo = NULL;

        pRequestConnectionInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
        pRequestConnectionInfo->RemoteAddress = (PUCHAR)pRequestConnectionInfo + sizeof(TDI_CONNECTION_INFORMATION);

        pRequestAddress = (PTA_IP_ADDRESS)(pRequestConnectionInfo->RemoteAddress);
        pRequestAddress->TAAddressCount = 1;
        pRequestAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
        pRequestAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
        pIp = (PTDI_ADDRESS_IP)(pRequestAddress->Address[0].Address);
        pIp->sin_port = W_LITTLE_TO_BIG_ENDIAN(m_nRemotePort);
        pIp->in_addr = D_LITTLE_TO_BIG_ENDIAN(m_nRemoteAddress);;

        pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_CONNECT, 
                      pDeviceObject, 
                      m_pTdiConnectionObject,
                      NULL, 
                      NULL);
        pIrpError = pIrp;
        if (pIrp != NULL)
        {
          TdiBuildConnect(
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 pTimeOut, 
                 pRequestConnectionInfo,
                 pReturnConnectionInfo);
          
          pIrpError = NULL;
          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);
          if (NT_SUCCESS(NtStatus))
          {
            m_bConnected = TRUE;
            bRes = TRUE;
          }
          else
          {
            DbgPrint ("TdiConnect: ERROR (%08x)!!!\n", NtStatus);
          }
        }
        delete[] pRequestConnectionInfo;
        pRequestConnectionInfo = NULL;
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
    if (pRequestConnectionInfo != NULL)
      delete[] pRequestConnectionInfo;
  }

  return bRes;
}

BOOLEAN KTdiStreamSocket::Disconnect()
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN                      bRes = TRUE;
  PIRP                         pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  PTDI_CONNECTION_INFORMATION  pRequestConnectionInfo = NULL;
  PTDI_CONNECTION_INFORMATION  pReturnConnectionInfo;
  PTA_IP_ADDRESS               pRequestAddress;
  PTDI_ADDRESS_IP              pIp;
  IO_STATUS_BLOCK              IoStatusBlock;

  __try
  {
    if (m_bOpen == TRUE && (m_bConnected == TRUE || m_bListen == TRUE))
    {
      bRes = FALSE;
      
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
      pRequestConnectionInfo = (PTDI_CONNECTION_INFORMATION) new char[sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS)];
      if (pRequestConnectionInfo != NULL)
      {
        memset(pRequestConnectionInfo, 0, sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS));

        pReturnConnectionInfo = NULL;

        pRequestConnectionInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
        pRequestConnectionInfo->RemoteAddress = (PUCHAR)pRequestConnectionInfo + sizeof(TDI_CONNECTION_INFORMATION);

        pRequestAddress = (PTA_IP_ADDRESS)(pRequestConnectionInfo->RemoteAddress);
        pRequestAddress->TAAddressCount = 1;
        pRequestAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
        pRequestAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
        pIp = (PTDI_ADDRESS_IP)(pRequestAddress->Address[0].Address);
        pIp->sin_port = W_LITTLE_TO_BIG_ENDIAN(m_nRemotePort);
        pIp->in_addr = D_LITTLE_TO_BIG_ENDIAN(m_nRemoteAddress);

        pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_DISCONNECT, 
                      pDeviceObject, 
                      m_pTdiConnectionObject,
                      NULL, 
                      NULL);
        pIrpError = pIrp;
        if (pIrp != NULL)
        {
          TdiBuildDisconnect(
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 NULL,           // timeout
                 TDI_DISCONNECT_ABORT, //TDI_DISCONNECT_RELEASE,
                 pRequestConnectionInfo,
                 pReturnConnectionInfo);
          
          pIrpError = NULL;

          BOOLEAN bConnected = m_bConnected;
          BOOLEAN bListen = m_bListen;
          
          m_bConnected = FALSE;
          m_bListen = FALSE;

          if (bListen == TRUE)
          {
            KeSetEvent(&m_kAcceptDestroyEvent, 0, FALSE);
            SetEventHandler(TDI_EVENT_CONNECT, (PVOID)NULL, (PVOID)NULL);
          }