首页
社区
课程
招聘
5
[原创]驱动层代码隐藏执行(有码)
发表于: 2019-8-9 00:54 15108

[原创]驱动层代码隐藏执行(有码)

2019-8-9 00:54
15108

使用方法及注意事项:

此方法局限性比较大,对代码的api调用等要求较高,且只适用于代码较少的情况。
其他注意事项见HiddenExecute.h

关键代码:

添加、删除隐藏页面记录:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
NTSTATUS AddHiddenPageRecord(ULONG64 CR3, PVOID pHiddenPageBase, PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //check count
    MyPrint(_TitleAndFunc"pHiddenPageRecord->Count:%16IX\n", pHiddenPageRecord->Count);
    if (pHiddenPageRecord->Count == MAX_HIDDEN_PAGE_COUNT)
        goto Lable_Error;
 
    //add pPTE record
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = &pHiddenPageRecord->Record[pHiddenPageRecord->Count];
 
    pCurrentRecord->pPTE = pGetSpecificAddresspPTEPhysical(CR3, pHiddenPageBase);
    MyPrint(_TitleAndFunc"pCurrentRecord->pPTE:%16IX\n", pCurrentRecord->pPTE);
    if (pCurrentRecord->pPTE == NULL)
        goto Lable_Error;
     
    //add hidden virtual address record
    pCurrentRecord->pHiddenBase = pHiddenPageBase;
    MyPrint(_TitleAndFunc"pCurrentRecord->pHiddenBase:%16IX\n", pCurrentRecord->pHiddenBase);
 
    //add original pfn record
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    pCurrentRecord->OriginalPfn = pCurrentRecord->pPTE->PageFrameNumber;
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    MyPrint(_TitleAndFunc"pCurrentRecord->OriginalPfn:%16IX\n", pCurrentRecord->OriginalPfn);
 
    //add hidden pfn record 
    //allocate memory
    //record the physical address
    //then free the memory and mark it as bad
    PVOID   TemporaryVirtual = MmAllocateNonCachedMemory(PAGE_SIZE);
    if (TemporaryVirtual == NULL)
        goto Lable_Error;
 
    PHYSICAL_ADDRESS    TemporaryPhysical = MmGetPhysicalAddress(TemporaryVirtual);
    LARGE_INTEGER       PhysicalLength = { 0 };
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    pCurrentRecord->HiddenPfn = pPhysicalAddresstoPTEPFN((PVOID)(TemporaryPhysical.QuadPart));
    MyPrint(_TitleAndFunc"pCurrentRecord->HiddenPfn:%16IX\n", pCurrentRecord->HiddenPfn);
 
    MmFreeNonCachedMemory(TemporaryVirtual, PAGE_SIZE);
     
    Status = MmMarkPhysicalMemoryAsBad(&TemporaryPhysical, &PhysicalLength);
 
    //copy codes to the new non-mapped physical address
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    RtlCopyMemory((PVOID)(TemporaryPhysical.QuadPart),
        pCurrentRecord->pHiddenBase,
        PAGE_SIZE
    );
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    //check the mark state
    if (!NT_SUCCESS(Status))
        goto Lable_Error;
 
    //the last step:count +1
    pHiddenPageRecord->Count++;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
NTSTATUS RemoveAndRestoreAllHiddenPageRecord(PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //assert we have elements
    if (pHiddenPageRecord->Count == 0)
        goto Lable_Error;
 
    //restore all records and mark all the hidden physical memory as good
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = NULL;
    PHYSICAL_ADDRESS                CurrentHiddenPhysical = { 0 };
    LARGE_INTEGER                   PhysicalLength = { 0 };
 
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    for (int i = 0; i < pHiddenPageRecord->Count; i++)
    {
        pCurrentRecord = &pHiddenPageRecord->Record[i];
        CurrentHiddenPhysical.QuadPart = (ULONG64)pPTEPFNtoPhysicalAddress(pCurrentRecord->HiddenPfn);
 
        //mark it as good
        MmMarkPhysicalMemoryAsGood(&CurrentHiddenPhysical, &PhysicalLength);
 
        //restore all page mapping relations
        ContextVirtualToPhysical(&g_PhysicalOpCR3);
        pCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->OriginalPfn;
        ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
        //invalid the TLB of current hidden address
        __invlpg(pCurrentRecord->pHiddenBase);
    }
 
    //set count to zero
    pHiddenPageRecord->Count = 0;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}

彩蛋:

PhysicalMemoryOperation.h是个好玩的东西,想想还能怎么玩?

下载:

此方法局限性比较大,对代码的api调用等要求较高,且只适用于代码较少的情况。
其他注意事项见HiddenExecute.h

关键代码:

添加、删除隐藏页面记录:
添加、删除隐藏页面记录:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
NTSTATUS AddHiddenPageRecord(ULONG64 CR3, PVOID pHiddenPageBase, PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //check count
    MyPrint(_TitleAndFunc"pHiddenPageRecord->Count:%16IX\n", pHiddenPageRecord->Count);
    if (pHiddenPageRecord->Count == MAX_HIDDEN_PAGE_COUNT)
        goto Lable_Error;
 
    //add pPTE record
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = &pHiddenPageRecord->Record[pHiddenPageRecord->Count];
 
    pCurrentRecord->pPTE = pGetSpecificAddresspPTEPhysical(CR3, pHiddenPageBase);
    MyPrint(_TitleAndFunc"pCurrentRecord->pPTE:%16IX\n", pCurrentRecord->pPTE);
    if (pCurrentRecord->pPTE == NULL)
        goto Lable_Error;
     
    //add hidden virtual address record
    pCurrentRecord->pHiddenBase = pHiddenPageBase;
    MyPrint(_TitleAndFunc"pCurrentRecord->pHiddenBase:%16IX\n", pCurrentRecord->pHiddenBase);
 
    //add original pfn record
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    pCurrentRecord->OriginalPfn = pCurrentRecord->pPTE->PageFrameNumber;
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    MyPrint(_TitleAndFunc"pCurrentRecord->OriginalPfn:%16IX\n", pCurrentRecord->OriginalPfn);
 
    //add hidden pfn record 
    //allocate memory
    //record the physical address
    //then free the memory and mark it as bad
    PVOID   TemporaryVirtual = MmAllocateNonCachedMemory(PAGE_SIZE);
    if (TemporaryVirtual == NULL)
        goto Lable_Error;
 
    PHYSICAL_ADDRESS    TemporaryPhysical = MmGetPhysicalAddress(TemporaryVirtual);
    LARGE_INTEGER       PhysicalLength = { 0 };
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    pCurrentRecord->HiddenPfn = pPhysicalAddresstoPTEPFN((PVOID)(TemporaryPhysical.QuadPart));
    MyPrint(_TitleAndFunc"pCurrentRecord->HiddenPfn:%16IX\n", pCurrentRecord->HiddenPfn);
 
    MmFreeNonCachedMemory(TemporaryVirtual, PAGE_SIZE);
     
    Status = MmMarkPhysicalMemoryAsBad(&TemporaryPhysical, &PhysicalLength);
 
    //copy codes to the new non-mapped physical address
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    RtlCopyMemory((PVOID)(TemporaryPhysical.QuadPart),
        pCurrentRecord->pHiddenBase,
        PAGE_SIZE
    );
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    //check the mark state
    if (!NT_SUCCESS(Status))
        goto Lable_Error;
 
    //the last step:count +1
    pHiddenPageRecord->Count++;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
NTSTATUS RemoveAndRestoreAllHiddenPageRecord(PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //assert we have elements
    if (pHiddenPageRecord->Count == 0)
        goto Lable_Error;
 
    //restore all records and mark all the hidden physical memory as good
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = NULL;
    PHYSICAL_ADDRESS                CurrentHiddenPhysical = { 0 };
    LARGE_INTEGER                   PhysicalLength = { 0 };
 
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    for (int i = 0; i < pHiddenPageRecord->Count; i++)
    {
        pCurrentRecord = &pHiddenPageRecord->Record[i];
        CurrentHiddenPhysical.QuadPart = (ULONG64)pPTEPFNtoPhysicalAddress(pCurrentRecord->HiddenPfn);
 
        //mark it as good
        MmMarkPhysicalMemoryAsGood(&CurrentHiddenPhysical, &PhysicalLength);
 
        //restore all page mapping relations
        ContextVirtualToPhysical(&g_PhysicalOpCR3);
        pCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->OriginalPfn;
        ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
        //invalid the TLB of current hidden address
        __invlpg(pCurrentRecord->pHiddenBase);
    }
 
    //set count to zero
    pHiddenPageRecord->Count = 0;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}

彩蛋:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
NTSTATUS AddHiddenPageRecord(ULONG64 CR3, PVOID pHiddenPageBase, PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //check count
    MyPrint(_TitleAndFunc"pHiddenPageRecord->Count:%16IX\n", pHiddenPageRecord->Count);
    if (pHiddenPageRecord->Count == MAX_HIDDEN_PAGE_COUNT)
        goto Lable_Error;
 
    //add pPTE record
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = &pHiddenPageRecord->Record[pHiddenPageRecord->Count];
 
    pCurrentRecord->pPTE = pGetSpecificAddresspPTEPhysical(CR3, pHiddenPageBase);
    MyPrint(_TitleAndFunc"pCurrentRecord->pPTE:%16IX\n", pCurrentRecord->pPTE);
    if (pCurrentRecord->pPTE == NULL)
        goto Lable_Error;
     
    //add hidden virtual address record
    pCurrentRecord->pHiddenBase = pHiddenPageBase;
    MyPrint(_TitleAndFunc"pCurrentRecord->pHiddenBase:%16IX\n", pCurrentRecord->pHiddenBase);
 
    //add original pfn record
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    pCurrentRecord->OriginalPfn = pCurrentRecord->pPTE->PageFrameNumber;
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    MyPrint(_TitleAndFunc"pCurrentRecord->OriginalPfn:%16IX\n", pCurrentRecord->OriginalPfn);
 
    //add hidden pfn record 
    //allocate memory
    //record the physical address
    //then free the memory and mark it as bad
    PVOID   TemporaryVirtual = MmAllocateNonCachedMemory(PAGE_SIZE);
    if (TemporaryVirtual == NULL)
        goto Lable_Error;
 
    PHYSICAL_ADDRESS    TemporaryPhysical = MmGetPhysicalAddress(TemporaryVirtual);
    LARGE_INTEGER       PhysicalLength = { 0 };
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    pCurrentRecord->HiddenPfn = pPhysicalAddresstoPTEPFN((PVOID)(TemporaryPhysical.QuadPart));
    MyPrint(_TitleAndFunc"pCurrentRecord->HiddenPfn:%16IX\n", pCurrentRecord->HiddenPfn);
 
    MmFreeNonCachedMemory(TemporaryVirtual, PAGE_SIZE);
     
    Status = MmMarkPhysicalMemoryAsBad(&TemporaryPhysical, &PhysicalLength);
 
    //copy codes to the new non-mapped physical address
    ContextVirtualToPhysical(&g_PhysicalOpCR3);
    RtlCopyMemory((PVOID)(TemporaryPhysical.QuadPart),
        pCurrentRecord->pHiddenBase,
        PAGE_SIZE
    );
    ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
    //check the mark state
    if (!NT_SUCCESS(Status))
        goto Lable_Error;
 
    //the last step:count +1
    pHiddenPageRecord->Count++;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
NTSTATUS RemoveAndRestoreAllHiddenPageRecord(PHIDDEN_PAGE_RECORD pHiddenPageRecord)
{
    KIRQL       EntryIrql;
    NTSTATUS    Status = STATUS_UNSUCCESSFUL;
    //prevent mulit-thread change the page record count
    KeAcquireSpinLock(&pHiddenPageRecord->SpinLock, &EntryIrql);
 
    //assert we have elements
    if (pHiddenPageRecord->Count == 0)
        goto Lable_Error;
 
    //restore all records and mark all the hidden physical memory as good
    PSPECIFIC_HIDDEN_PAGE_RECORD    pCurrentRecord = NULL;
    PHYSICAL_ADDRESS                CurrentHiddenPhysical = { 0 };
    LARGE_INTEGER                   PhysicalLength = { 0 };
 
    PhysicalLength.QuadPart = PAGE_SIZE;
 
    for (int i = 0; i < pHiddenPageRecord->Count; i++)
    {
        pCurrentRecord = &pHiddenPageRecord->Record[i];
        CurrentHiddenPhysical.QuadPart = (ULONG64)pPTEPFNtoPhysicalAddress(pCurrentRecord->HiddenPfn);
 
        //mark it as good
        MmMarkPhysicalMemoryAsGood(&CurrentHiddenPhysical, &PhysicalLength);
 
        //restore all page mapping relations
        ContextVirtualToPhysical(&g_PhysicalOpCR3);
        pCurrentRecord->pPTE->PageFrameNumber = pCurrentRecord->OriginalPfn;
        ContextPhysicalToVirtual(&g_PhysicalOpCR3);
 
        //invalid the TLB of current hidden address
        __invlpg(pCurrentRecord->pHiddenBase);
    }
 
    //set count to zero
    pHiddenPageRecord->Count = 0;
 
    //release spin lock
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_SUCCESS;
 
Lable_Error:
    KeReleaseSpinLock(&pHiddenPageRecord->SpinLock, EntryIrql);
    return STATUS_UNSUCCESSFUL;
}

彩蛋:


[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
点赞 5
支持
分享
赞赏记录
参与人
雪币
留言
时间
PLEBFE
为你点赞~
2023-1-23 05:51
wangzesen
为你点赞~
2021-11-12 22:01
TopC
为你点赞~
2019-8-9 13:38
MsScotch
为你点赞~
2019-8-9 10:18
不吃麻婆豆腐
为你点赞~
2019-8-9 01:22
最新回复 (7)
雪    币: 300
活跃值: (2647)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
mark
2019-8-9 11:25
0
雪    币: 7063
活跃值: (1931)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
3
感谢分享
2019-8-9 13:39
0
雪    币: 433
活跃值: (2015)
能力值: ( LV4,RANK:40 )
在线值:
发帖
回帖
粉丝
4
我也实现过,但是对于某些ac来说会造成系统很卡的情况
2019-8-9 19:52
0
雪    币: 3330
活跃值: (2802)
能力值: ( LV12,RANK:330 )
在线值:
发帖
回帖
粉丝
5
谢谢楼主!
2019-8-13 11:41
0
雪    币: 5271
活跃值: (3505)
能力值: ( LV7,RANK:117 )
在线值:
发帖
回帖
粉丝
6
萌克力 我也实现过,但是对于某些ac来说会造成系统很卡的情况
哪些?
2019-8-16 02:24
0
雪    币: 43
能力值: ( LV1,RANK:0 )
在线值:
发帖
回帖
粉丝
7
感谢鬼才zxy分享
2019-10-4 18:10
0
雪    币: 6304
活跃值: (5177)
能力值: ( LV10,RANK:160 )
在线值:
发帖
回帖
粉丝
8
mark
2019-11-3 22:03
0
游客
登录 | 注册 方可回帖
返回

账号登录
验证码登录

忘记密码?
没有账号?立即免费注册