NSI Module Hook : Hiding Port Under Windows Vista

最新推荐文章于 2023-08-04 22:24:20 发布

转载最新推荐文章于 2023-08-04 22:24:20 发布 · 1.9k 阅读

文章标签：

#module #windows #hook #wrapper #network #list

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一种在Windows Vista系统中隐藏端口的方法。通过深入解析Vista的网络模块变化，文章详细阐述了如何利用NSIKernelModuleDispatchRoutineHook技术实现端口隐藏，并提供了测试过的示例代码。

cardmagic writes: Windows Vista has changed alot on network module, many old port hiding materials are no longer usable.
In this post, I will share with you a simple code to hide port under Vista,hope it is useful for some guys .
Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports,then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys. nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys .
Here ,we will use a relatively easy way -- "NSI Kernel Module Dispatch Routine Hook" to demostrate the specified port hiding uner Vista. Dispatch routine hook is an old topic, this time ,we will apply this method to nsiproxy.sys. Please focus on how to handle the content filtering of NSI:)
Check the following code(Notice: I only tested it under Windows Vista RTM 32bit):

http://www.rootkit.com/vault/cardmagic/PortHidDemo_Vista.c