栈回溯法的一个例子

驱动防火墙实例

最新推荐文章于 2023-03-09 17:27:35 发布

原创最新推荐文章于 2023-03-09 17:27:35 发布 · 2.6k 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#distance #string #byte #null #attributes #hook

C/C++ 专栏收录该内容

7 篇文章

订阅专栏

代码转自看雪论坛【驱动防火墙的一个例子】，直接复制过来的，看起来比较乱，不过还是很容易看懂的

看了几个例子，一般都是在ExAllocatePoolWithTag这里挂钩啊，根据MemoryTag来判断，以后再发现发现有没有更精准的挂钩位置

#include <ntddk.h> #include <windef.h> #include <stdio.h> #include <string.h> #include "MmLoadSystemImage.h" #define pwszModuleName L"ntoskrnl.exe" //这里只考虑单核的情况 #define ObjectNameInformation 1 UCHAR oldcode[5]={0}; UCHAR jmpcode[5]={0xE9,0x00,0x00,0x00,0x00}; ULONG g_ntoskrnl_addr=0; ULONG g_ntoskrnl_size=0; ULONG oldExAllocatePoolWithTagaddr=0; ULONG Address_MmLoadSystemImage=0;//通过栈回溯（技术难点）得到MmLoadSystemImage函数的地址 /* 这里说明一下原先通过东方微点的Mp110003的驱动是通过Hook KeWaitForSingleObject, 然后通过栈回溯来找到MmLoadSystemImage的地址，但是通过我跟踪堆栈调用, 发现要经过很多次KeWaitForSingleObject调用，才会进入到 KeWaitForSingleObject MmLoadSystemImage NtSetSystemInformation nt!KiFastCallEntry nt!ZwSetSystemInformation 反正是猥琐，我就更猥琐，大米兄就是这么干的，调用流程中来找到MmLoadSystemImage地址，调用过程如下： ExAllocatePoolWithTag MmLoadSystemImage NtSetSystemInformation nt!KiFastCallEntry nt!ZwSetSystemInformation 因此我直接HOOK ExAllocatePoolWithTag来进行栈回溯 */ __declspec(naked) PVOID fake_ExAllocatePoolWithTag( IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag) { ULONG *PEBP; _asm{ mov edi,edi push ebp mov ebp,esp mov eax,[ebp+0xc] //参数是NumberOfBytes cmp eax,0x100 jnz end mov eax,[ebp+0x10] //第三个参数Tag cmp eax,0x6E4C6D4D //标志为"nLmM",也就是MmLoadSystemImage装载的镜像标志 jnz end mov eax,[ebp] //堆栈回溯的原理 mov eax,[eax+4] push eax //上一个函数的地址 call StackTrace_for_ExAllocatePoolWithTag end: mov eax,oldExAllocatePoolWithTagaddr add eax,5 jmp eax } } //通过栈回溯找到 ULONG StackTrace_for_ExAllocatePoolWithTag(ULONG RetAddress) { ULONG CallAddress=0; ULONG JmpOffset=0; if (RetAddress) { CallAddress=(ULONG)RetAddress- 5 ;//Ret --->call Address //跳转的偏移量 JmpOffset=*(ULONG*)((PUCHAR)CallAddress+1); //(PUCHAR)CallAddress+1--->指针CallAddress往后走一位,(PULONG)CallAddress+1,指针CallAddress往后走（sizeof(ULONG)=4）字节 //MmLoadSystemImage函数的地址 Address_MmLoadSystemImage=(ULONG)CallAddress + 5 +JmpOffset; KdPrint(("MmLoadSystemImage Address=0x%x/n",Address_MmLoadSystemImage)); //加入判定如果ntoskrnl.Base<Address_MmLoadSystemImage<ntoskrnl.Base+size,则说明可以进行inlineHook_MmLoadSystemImage() if (Address_MmLoadSystemImage>g_ntoskrnl_addr&&Address_MmLoadSystemImage<(g_ntoskrnl_addr+g_ntoskrnl_size)) { unlineHook_ExAllocatePoolWithTag(); inlineHook_MmLoadSystemImage(); KdPrint(("inlineHook MmLoadSystemImage Success!")); } } return 0; } __declspec(naked) NTSTATUS OrigiMmLoadSystemImage( IN PUNICODE_STRING ImageFileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedBaseName OPTIONAL, IN ULONG LoadFlags, OUT PVOID *ImageHandle, OUT PVOID *ImageBaseAddress) { __asm{ push 174h mov eax,Address_MmLoadSystemImage add eax,5 jmp eax } } //拦截驱动的过程 NTSTATUS fake_MmLoadSystemImage( IN PUNICODE_STRING ImageFileName, IN PUNICODE_STRING NamePrefix OPTIONAL, IN PUNICODE_STRING LoadedBaseName OPTIONAL, IN ULONG LoadFlags, OUT PVOID *ImageHandle, OUT PVOID *ImageBaseAddress) { ANSI_STRING ImageName; RtlUnicodeStringToAnsiString(&ImageName,ImageFileName,TRUE); KdPrint(("MmLoadSystemImage LoadDriver :%s/n",ImageName.Buffer)); return OrigiMmLoadSystemImage(ImageFileName, NamePrefix, LoadFlags, LoadFlags, ImageHandle, ImageBaseAddress); } NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PIRP Irp) { NTSTATUS status; PEPROCESS crsEProc; ANSI_STRING TestSysName; SYSTEM_LOAD_AND_CALL_IMAGE sysImage; DriverObject->DriverUnload=DriverUnload; status=PsLookupProcessByProcessId((ULONG)GetCsrPid(),&crsEProc); if (!NT_SUCCESS(status)) { KdPrint(("PsLookupProcessByProcessId() error/n")); return status; } //通过DriverObject->DriverSection获得加载驱动的模块 if (GetBase((ULONG)DriverObject)&&inlineHook_ExAllocatePoolWithTag()) { //下面是调用ZwSetSystemInformation来加载驱动，从而引发跳转到fake_ExAllocatePoolWithTag中,先依附进csrss.exe,再加载测试驱动 KeAttachProcess(crsEProc); //加载测试驱动; RtlInitAnsiString(&TestSysName,"//??//c://Hooksys.sys"); RtlAnsiStringToUnicodeString(&(sysImage.ModuleName),&TestSysName,TRUE); status= ZwSetSystemInformation(SystemExtendServiceTableInformation,&sysImage,sizeof(sysImage)); if (!NT_SUCCESS(status)) { KdPrint(("Driver STATUS=0X%x/n",status)); } KeDetachProcess(); } return STATUS_SUCCESS; } NTSTATUS DriverUnload(IN PDRIVER_OBJECT DriverObject ) { unlineHook_MmLoadSystemImage(); KdPrint(("DriverUnload!/n")); return STATUS_SUCCESS; } //得到模块的基址和映像大小 int GetBase(IN ULONG EntryAddress) { ULONG listHead; ULONG currentList; ULONG NameAddress; int reault=0; listHead=*(ULONG*)(EntryAddress+0x14); currentList=*(ULONG*)(listHead+0x4); //Blink if (currentList!=listHead) { while (1) { NameAddress=*(ULONG*)(currentList+0x030); if ((PCWSTR)NameAddress!=NULL) { KdPrint(("ModuleName=%ws/n",(PCWSTR)NameAddress)); } if(!_wcsicmp((PCWSTR)NameAddress,pwszModuleName)) { g_ntoskrnl_addr=*(ULONG*)(currentList+0x18); g_ntoskrnl_size=*(ULONG*)(currentList+0x20); KdPrint(("ntoskrnl.exe [base]=0x%X,[size]=0x%X/n",g_ntoskrnl_addr,g_ntoskrnl_size)); reault=1; break; } currentList=*(DWORD*)(currentList + 0x4);//下一个Blink if (currentList == listHead) { KdPrint(("链表查询结束!/n")); break; } } } return reault; } PVOID GetInfoTable(ULONG ATableType) { ULONG mSize=0x4000; PVOID mPtr=NULL; NTSTATUS status; do { mPtr=ExAllocatePool(PagedPool,mSize); memset(mPtr, 0, mSize); if (mPtr) { status = ZwQuerySystemInformation(ATableType,mPtr,mSize,NULL); }else return NULL; if (status == STATUS_INFO_LENGTH_MISMATCH) { ExFreePool(mPtr); mSize *=2; } } while(status == STATUS_INFO_LENGTH_MISMATCH); if (status == STATUS_SUCCESS) return mPtr; ExFreePool(mPtr); return NULL; } //得到csrss.exe的PID HANDLE GetCsrPid() { HANDLE Process,hObject; HANDLE CsrssId=(HANDLE)0; OBJECT_ATTRIBUTES obj; CLIENT_ID cid; UCHAR buff[0x100]; POBJECT_NAME_INFORMATION objName=(PVOID)&buff; PSYSTEM_HANDLE_INFORMATION_EX Handles; ULONG i; Handles=GetInfoTable(SystemHandleInformation); if (!Handles) return CsrssId; for (i=0;i<Handles->NumberOfHandles;i++) { if (Handles->Information[i].ObjectTypeNumber == 21) { InitializeObjectAttributes(&obj,NULL,OBJ_KERNEL_HANDLE,NULL,NULL); cid.UniqueProcess=(HANDLE)Handles->Information[i].ProcessId; cid.UniqueThread = 0; if (NT_SUCCESS(NtOpenProcess(&Process,PROCESS_DUP_HANDLE,&obj,&cid))) { if (NT_SUCCESS(ZwDuplicateObject(Process,(HANDLE)Handles->Information[i].Handle,NtCurrentProcess(),&hObject,0,0,DUPLICATE_SAME_ACCESS))) { if (NT_SUCCESS(ZwQueryObject(hObject, ObjectNameInformation, objName, 0x100, NULL))) { if (objName->Name.Buffer&& !wcsncmp(L"//Windows//ApiPort",objName->Name.Buffer,20)) { CsrssId=(HANDLE)Handles->Information[i].ProcessId; } } ZwClose(hObject); } ZwClose(Process); } } } ExFreePool(Handles); return CsrssId; } //inline Hook ExAllocatePoolWithTag BOOLEAN inlineHook_ExAllocatePoolWithTag() { KIRQL oldIrql; DWORD distance; UNICODE_STRING unamestr; BOOLEAN result; RtlInitUnicodeString(&unamestr,L"ExAllocatePoolWithTag"); oldExAllocatePoolWithTagaddr=(ULONG)MmGetSystemRoutineAddress(&unamestr); if (oldExAllocatePoolWithTagaddr) { //保存原来开始的5个字节 RtlCopyMemory(oldcode,(BYTE*)oldExAllocatePoolWithTagaddr,5); distance=(BYTE*)fake_ExAllocatePoolWithTag - (BYTE*)oldExAllocatePoolWithTagaddr -5; RtlCopyMemory(jmpcode+1,&distance,4); WPOff(); oldIrql=KeRaiseIrqlToDpcLevel(); RtlCopyMemory((BYTE*)oldExAllocatePoolWithTagaddr,jmpcode,5); KeLowerIrql(oldIrql); WPOn(); result=TRUE; } else result=FALSE; return result; } VOID unlineHook_ExAllocatePoolWithTag() { KIRQL oldIrql; WPOff(); oldIrql=KeRaiseIrqlToDpcLevel(); RtlCopyMemory((BYTE*)oldExAllocatePoolWithTagaddr,oldcode,5); KeLowerIrql(oldIrql); WPOn(); return; } BOOLEAN inlineHook_MmLoadSystemImage() { KIRQL oldIrql; DWORD distance; BOOLEAN result; if (Address_MmLoadSystemImage) { //保存原来开始的5个字节 RtlCopyMemory(oldcode,(BYTE*)Address_MmLoadSystemImage,5); distance=(BYTE*)fake_MmLoadSystemImage - Address_MmLoadSystemImage -5; RtlCopyMemory(jmpcode+1,&distance,4); WPOff(); oldIrql=KeRaiseIrqlToDpcLevel(); RtlCopyMemory((BYTE*)Address_MmLoadSystemImage,jmpcode,5); KeLowerIrql(oldIrql); WPOn(); result=TRUE; }else result=FALSE; return result; } VOID unlineHook_MmLoadSystemImage() { KIRQL oldIrql; WPOff(); oldIrql=KeRaiseIrqlToDpcLevel(); RtlCopyMemory((BYTE*)Address_MmLoadSystemImage,oldcode,5); KeLowerIrql(oldIrql); WPOn(); return; } VOID WPOn() { __asm { mov eax,cr0 or eax,0x10000 mov cr0,eax STI } } VOID WPOff() { __asm{ cli mov eax, cr0 and eax,not 0x10000 mov cr0,eax } }