首页
论坛
课程
招聘
[原创]奇技淫巧之隐藏线程地址
2022-5-14 18:41 6435

[原创]奇技淫巧之隐藏线程地址

2022-5-14 18:41
6435
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
#include <ntddk.h>
 
VOID
DrvCreateThreadCancel(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
    PVOID StartContext = NULL;
    PKSTART_ROUTINE StartRoutine = NULL;
 
    if (pIrp)
    {
        IoReleaseCancelSpinLock(PASSIVE_LEVEL);
        StartContext = pIrp->UserBuffer;
        StartRoutine = (PKSTART_ROUTINE)pIrp->MdlAddress;
        IoFreeIrp(pIrp);
 
        if (StartRoutine)
        {
            StartRoutine(StartContext);
        }
    }
 
    PsTerminateSystemThread(STATUS_SUCCESS);
    return;
}
 
NTSTATUS
DrvCreateSystemThread(PHANDLE ThreadHandle,
                      ULONG DesiredAccess,
                      POBJECT_ATTRIBUTES ObjectAttributes,
                      HANDLE ProcessHandle,
                      PCLIENT_ID ClientId,
                      PKSTART_ROUTINE StartRoutine,
                      PVOID StartContext)
{
    PIRP pIrp = NULL;
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
 
    do
    {
        pIrp = IoAllocateIrp(2, FALSE);
        if (!pIrp)
        {
            break;
        }
        IoSetNextIrpStackLocation(pIrp);
 
        pIrp->UserBuffer = StartContext;
        pIrp->MdlAddress = (PMDL)StartRoutine;
        IoSetCancelRoutine(pIrp, DrvCreateThreadCancel);
        Status = PsCreateSystemThread(ThreadHandle,
        DesiredAccess, ObjectAttributes, ProcessHandle,
        ClientId, (PKSTART_ROUTINE)IoCancelIrp, (PVOID)pIrp);
    } while (FALSE);
 
    if (NT_ERROR(Status) && pIrp)
    {
        IoFreeIrp(pIrp);
        pIrp = NULL;
    }
 
    return Status;
}
 
VOID
StartRoutine(PVOID StartContext)
{
    DbgPrint((PCSTR)StartContext);
}
 
NTSTATUS
DriverEntry(PDRIVER_OBJECT pDrvObj,
            PUNICODE_STRING pRegPath)
{
    HANDLE hThread = NULL;
    OBJECT_ATTRIBUTES Oba ={0};
    NTSTATUS Status = STATUS_UNSUCCESSFUL;
 
    InitializeObjectAttributes(&Oba,
    NULL, OBJ_KERNEL_HANDLE, NULL, NULL);
    Status = DrvCreateSystemThread(&hThread,
                                   THREAD_ALL_ACCESS,
                                   &Oba,
                                   NULL,
                                   NULL,
                                   StartRoutine,
                                   "$$StartContext");
    if (NT_SUCCESS(Status))
    {
        ZwClose(hThread);
    }
 
    return Status;
}

[2023春季班]《安卓高级研修班(网课)》月薪两万班招生中~

最后于 2022-5-14 18:51 被简单未遂编辑 ,原因:
收藏
点赞6
打赏
分享
最新回复 (7)
雪    币: 14
活跃值: 活跃值 (80)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
lovenikola 活跃值 2022-5-17 05:33
2
0
 稳定吗
雪    币: 52
活跃值: 活跃值 (694)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
简单未遂 活跃值 2022-5-17 10:41
3
0
lovenikola [em_4] 稳定吗
代码并没有使用任何未文档化的东西或者是硬编码,并不会触发PG之类的,稳如老狗。
雪    币: 79
活跃值: 活跃值 (933)
能力值: ( LV8,RANK:130 )
在线值:
发帖
回帖
粉丝
killpy 活跃值 2 2022-5-17 13:15
4
0
6666 但是 怎么隐藏堆栈回溯呢 
雪    币: 12044
活跃值: 活跃值 (7257)
能力值: ( LV9,RANK:270 )
在线值:
发帖
回帖
粉丝
hzqst 活跃值 3 2022-5-17 15:01
5
0
这跟在ntos.text节里找个jmp rcx 给context填真实函数地址有啥本质区别?
雪    币: 52
活跃值: 活跃值 (694)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
简单未遂 活跃值 2022-5-17 15:43
6
0
killpy 6666 但是 怎么隐藏堆栈回溯呢
这个主要是过ARK工具的线程对象枚举查地址,你要解决栈回溯的话,可以调用_AddressOfReturnAddress 随意修改,只是一般没这个需求。
雪    币: 52
活跃值: 活跃值 (694)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
简单未遂 活跃值 2022-5-17 15:46
7
0
hzqst 这跟在ntos.text节里找个jmp rcx 给context填真实函数地址有啥本质区别?
没有本质的区别,你说的那种需要硬编码搜索,这个不需要。
雪    币: 1001
活跃值: 活跃值 (1904)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
小希希 活跃值 2023-1-11 14:03
8
0
mark
游客
登录 | 注册 方可回帖
返回