你是否还在为x64断链隐藏驱动蓝屏而发愁?
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Driver.c
小弟这次来公开一种一直存在却有没人放出来的方法隐藏驱动,可瞒过xt和其他常规检测,稍加处理后,可瞒过更多检测
话不多说,直接上码
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Driver.h
#include <ntddk.h>
#include <windef.h>
#include <stdlib.h>
//定义符号链接，一般来说修改为驱动的名字即可
#define DEVICE_NAME L"\\Device\\TestDrv"
#define LINK_NAME L"\\DosDevices\\TestDrv"
#define LINK_GLOBAL_NAME L"\\DosDevices\\Global\\TestDrv"
//定义驱动功能号和名字，提供接口给应用程序调用
#define IOCTL_IO_TEST CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_SAY_HELLO CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
typedef struct _LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY HashLinks;
struct {
PVOID SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
PVOID LoadedImports;
};
};
PVOID PatchInformation;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
#include <ntddk.h>
#include <windef.h>
#include <stdlib.h>
//定义符号链接，一般来说修改为驱动的名字即可
#define DEVICE_NAME L"\\Device\\TestDrv"
#define LINK_NAME L"\\DosDevices\\TestDrv"
#define LINK_GLOBAL_NAME L"\\DosDevices\\Global\\TestDrv"
//定义驱动功能号和名字，提供接口给应用程序调用
#define IOCTL_IO_TEST CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_SAY_HELLO CTL_CODE(FILE_DEVICE_UNKNOWN, 0x801, METHOD_BUFFERED, FILE_ANY_ACCESS)
typedef struct _LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID DllBase;
PVOID EntryPoint;
ULONG SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG Flags;
USHORT LoadCount;
USHORT TlsIndex;
union {
LIST_ENTRY HashLinks;
struct {
PVOID SectionPointer;
ULONG CheckSum;
};
};
union {
struct {
ULONG TimeDateStamp;
};
struct {
PVOID LoadedImports;
};
};
PVOID PatchInformation;
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Driver.c
#include "driver.h"
//此模板来自Tesla.Angela
//HideDrv By isdebug
typedef VOID (NTAPI* pfn_MiProcessLoaderEntry) (IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN BOOLEAN Insert);
//nt!MiProcessLoaderEntry:
//fffff800`04169780 48895c2408 mov qword ptr[rsp + 8], rbx
//fffff800`04169785 48896c2418 mov qword ptr[rsp + 18h], rbp
//fffff800`0416978a 4889742420 mov qword ptr[rsp + 20h], rsi
//fffff800`0416978f 57 push rdi
//fffff800`04169790 4154 push r12
//fffff800`04169792 4155 push r13
//fffff800`04169794 4156 push r14
//fffff800`04169796 4157 push r15
//fffff800`04169798 4883ec30 sub rsp, 30h
//fffff800`0416979c 488bf9 mov rdi, rcx
//fffff800`0416979f 448bf2 mov r14d, edx
//fffff800`041697a2 bb01000000 mov ebx, 1
pfn_MiProcessLoaderEntry MiProcessLoaderEntry = 0xfffff80004169780;//这里直接填的地址,该函数未导出,不过只要思想不滑坡,办法总比问题多..
BOOLEAN KiSleep (ULONG MillionSecond) {
NTSTATUS st;
LARGE_INTEGER DelayTime;
DelayTime = RtlConvertLongToLargeInteger (-10000 * MillionSecond);
st = KeDelayExecutionThread (KernelMode, FALSE, &DelayTime);
return (NT_SUCCESS (st));
}
VOID TestDP (PVOID p) {
int j = 0;
while (1) {
KiSleep (1000);
j++;
KdPrint (("TestDP:%d \n", j));
}
}
VOID DriverUnload (PDRIVER_OBJECT pDriverObj) {
UNICODE_STRING strLink;
DbgPrint ("[TestDrv]DriverUnload\n");
MiProcessLoaderEntry (pDriverObj->DriverSection, FALSE);
pDriverObj->DriverSection = ExAllocatePool (NonPagedPool, 4096);
//删除符号连接和设备
RtlInitUnicodeString (&strLink, LINK_NAME);
IoDeleteSymbolicLink (&strLink);
IoDeleteDevice (pDriverObj->DeviceObject);
}
NTSTATUS DispatchCreate (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
DbgPrint ("[TestDrv]DispatchCreate\n");
pIrp->IoStatus.Status = STATUS_SUCCESS;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS DispatchClose (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
DbgPrint ("[TestDrv]DispatchClose\n");
pIrp->IoStatus.Status = STATUS_SUCCESS;
pIrp->IoStatus.Information = 0;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS DispatchIoctl (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
PIO_STACK_LOCATION pIrpStack;
ULONG uIoControlCode;
PVOID pIoBuffer;
ULONG uInSize;
ULONG uOutSize;
DbgPrint ("[TestDrv]DispatchIoctl\n");
//获得IRP里的关键数据
pIrpStack = IoGetCurrentIrpStackLocation (pIrp);
//控制码
uIoControlCode = pIrpStack->Parameters.DeviceIoControl.IoControlCode;
//输入和输出的缓冲区（DeviceIoControl的InBuffer和OutBuffer都是它）
pIoBuffer = pIrp->AssociatedIrp.SystemBuffer;
//EXE发送传入数据的BUFFER长度（DeviceIoControl的nInBufferSize）
uInSize = pIrpStack->Parameters.DeviceIoControl.InputBufferLength;
//EXE接收传出数据的BUFFER长度（DeviceIoControl的nOutBufferSize）
uOutSize = pIrpStack->Parameters.DeviceIoControl.OutputBufferLength;
switch (uIoControlCode) {
//在这里加入接口
case IOCTL_IO_TEST: {
DWORD dw = 0;
//输入
memcpy (&dw, pIoBuffer, sizeof (DWORD));
//使用
dw++;
//输出
memcpy (pIoBuffer, &dw, sizeof (DWORD));
//返回通信状态
status = STATUS_SUCCESS;
break;
}
case IOCTL_SAY_HELLO: {
DbgPrint ("[TestDrv]IOCTL_SAY_HELLO\n");
status = STATUS_SUCCESS;
break;
}
}
//这里设定DeviceIoControl的*lpBytesReturned的值（如果通信失败则返回0长度）
if (status == STATUS_SUCCESS)
{ pIrp->IoStatus.Information = uOutSize; }
else
{ pIrp->IoStatus.Information = 0; }
//这里设定DeviceIoControl的返回值是成功还是失败
pIrp->IoStatus.Status = status;
IoCompleteRequest (pIrp, IO_NO_INCREMENT);
return status;
}
NTSTATUS DriverEntry (PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString) {
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING ustrLinkName;
UNICODE_STRING ustrDevName;
PDEVICE_OBJECT pDevObj;
pDriverObj->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
pDriverObj->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
pDriverObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchIoctl;
pDriverObj->DriverUnload = DriverUnload;
//创建一个设备
RtlInitUnicodeString (&ustrDevName, DEVICE_NAME);
status = IoCreateDevice (pDriverObj, 0, &ustrDevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj);
if (!NT_SUCCESS (status)) { return status; }
//判断支持的WDM版本，其实这个已经不需要了，纯属WIN9X和WINNT并存时代的残留物
if (IoIsWdmVersionAvailable (1, 0x10)) {
RtlInitUnicodeString (&ustrLinkName, LINK_GLOBAL_NAME);
} else {
RtlInitUnicodeString (&ustrLinkName, LINK_NAME);
}
// 创建符号连接
status = IoCreateSymbolicLink (&ustrLinkName, &ustrDevName);
if (!NT_SUCCESS (status)) {
IoDeleteDevice (pDevObj);
return status;
}
DbgPrint ("[TestDrv]DriverEntry\n");
HANDLE hThread = 0;
if (NT_SUCCESS (PsCreateSystemThread (&hThread, 0, NULL, (HANDLE) - 1, NULL, &TestDP, NULL))) {
ZwClose (hThread);
}
//返回加载驱动的状态（如果返回失败，驱动讲被清除出内核空间）
return STATUS_SUCCESS;
}
#include "driver.h"
//此模板来自Tesla.Angela
//HideDrv By isdebug
typedef VOID (NTAPI* pfn_MiProcessLoaderEntry) (IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN BOOLEAN Insert);
//nt!MiProcessLoaderEntry:
//fffff800`04169780 48895c2408 mov qword ptr[rsp + 8], rbx
//fffff800`04169785 48896c2418 mov qword ptr[rsp + 18h], rbp
//fffff800`0416978a 4889742420 mov qword ptr[rsp + 20h], rsi
//fffff800`0416978f 57 push rdi
//fffff800`04169790 4154 push r12
//fffff800`04169792 4155 push r13
//fffff800`04169794 4156 push r14
//fffff800`04169796 4157 push r15
//fffff800`04169798 4883ec30 sub rsp, 30h
//fffff800`0416979c 488bf9 mov rdi, rcx
//fffff800`0416979f 448bf2 mov r14d, edx
//fffff800`041697a2 bb01000000 mov ebx, 1
pfn_MiProcessLoaderEntry MiProcessLoaderEntry = 0xfffff80004169780;//这里直接填的地址,该函数未导出,不过只要思想不滑坡,办法总比问题多..
BOOLEAN KiSleep (ULONG MillionSecond) {
NTSTATUS st;
LARGE_INTEGER DelayTime;
DelayTime = RtlConvertLongToLargeInteger (-10000 * MillionSecond);
st = KeDelayExecutionThread (KernelMode, FALSE, &DelayTime);
return (NT_SUCCESS (st));
}
VOID TestDP (PVOID p) {
int j = 0;
while (1) {
KiSleep (1000);
j++;
KdPrint (("TestDP:%d \n", j));
}
}
VOID DriverUnload (PDRIVER_OBJECT pDriverObj) {
UNICODE_STRING strLink;
DbgPrint ("[TestDrv]DriverUnload\n");
MiProcessLoaderEntry (pDriverObj->DriverSection, FALSE);
pDriverObj->DriverSection = ExAllocatePool (NonPagedPool, 4096);
//删除符号连接和设备
RtlInitUnicodeString (&strLink, LINK_NAME);
IoDeleteSymbolicLink (&strLink);
IoDeleteDevice (pDriverObj->DeviceObject);
}
NTSTATUS DispatchCreate (PDEVICE_OBJECT pDevObj, PIRP pIrp) {
DbgPrint ("[TestDrv]DispatchCreate\n");
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
iceway
malokch
