#include <ntifs.h>
#include <ntdef.h>
#include <ntstatus.h>
#include <ntddk.h>
#define MAX_BACKTRACE_DEPTH 20
#define SYMBOL L"\\??\\xia0ji2333"
#define kprintf(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, format, ##__VA_ARGS__)
UINT64
BaseAddr=NULL, DLLSize=0;
NTSTATUS CreateDevice(PDEVICE_OBJECT driver) {
NTSTATUS status;
UNICODE_STRING MyDriver;
PDEVICE_OBJECT device = NULL;
RtlInitUnicodeString(&MyDriver, L
"\\DEVICE\\xia0ji233"
);
status = IoCreateDevice(
driver,
sizeof
(driver->DeviceExtension),
&MyDriver,
FILE_DEVICE_UNKNOWN,
FILE_DEVICE_SECURE_OPEN,
FALSE,
&device
);
if
(status == STATUS_SUCCESS) {
UNICODE_STRING Sym;
RtlInitUnicodeString(&Sym, SYMBOL);
status = IoCreateSymbolicLink(&Sym, &MyDriver);
if
(status == STATUS_SUCCESS) {
kprintf((
"Line %d:xia0ji233: symbol linked success\n"
), __LINE__);
}
else
{
kprintf((
"Line %d:xia0ji233: symbol linked failed status=%x\n"
), __LINE__, status);
}
}
else
{
kprintf((
"Line %d:xia0ji233: create device fail status=%x\n"
), __LINE__, status);
}
}
void
DeleteDevice(PDRIVER_OBJECT pDriver) {
kprintf((
"Line %d:xia0ji233: start delete device\n"
), __LINE__);
if
(pDriver->DeviceObject) {
UNICODE_STRING Sym;
RtlInitUnicodeString(&Sym, SYMBOL);
kprintf((
"Line %d:xia0ji233: Delete Symbol\n"
), __LINE__);
IoDeleteSymbolicLink(&Sym);
kprintf((
"Line %d:xia0ji233: Delete Device\n"
), __LINE__);
IoDeleteDevice(pDriver->DeviceObject);
}
kprintf((
"Line %d:xia0ji233: end delete device\n"
), __LINE__);
}
char
newcode[] = {
0x48,0xB8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0xFF,0xE0
};
char
oldcode[] = {
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,
};
char
*target;
KIRQL WPOFFx64()
{
KIRQL irql = KeRaiseIrqlToDpcLevel();
UINT64
cr0 = __readcr0();
cr0 &= 0xfffffffffffeffff;
__writecr0(cr0);
_disable();
return
irql;
}
void
WPONx64(KIRQL irql)
{
UINT64
cr0 = __readcr0();
cr0 |= 0x10000;
_enable();
__writecr0(cr0);
KeLowerIrql(irql);
}
NTSTATUS Unhook() {
KIRQL irql = WPOFFx64();
for
(
int
i = 0; i <
sizeof
(newcode); i++) {
target[i] = oldcode[i];
}
WPONx64(irql);
return
STATUS_SUCCESS;
}
NTSTATUS Hook() {
KIRQL irql = WPOFFx64();
for
(
int
i = 0; i <
sizeof
(newcode); i++) {
target[i] = newcode[i];
}
WPONx64(irql);
return
STATUS_SUCCESS;
}
typedef
NTSTATUS(*Copy)(
PVOID
, MM_COPY_ADDRESS,
SIZE_T
,
ULONG
,
SIZE_T
*);
PDRIVER_OBJECT g_Object = NULL;
typedef
struct
_LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks;
LIST_ENTRY InMemoryOrderLinks;
LIST_ENTRY InInitializationOrderLinks;
PVOID
DllBase;
PVOID
EntryPoint;
ULONG
SizeOfImage;
UNICODE_STRING FullDllName;
UNICODE_STRING BaseDllName;
ULONG
Flags;
USHORT
LoadCount;
USHORT
TlsIndex;
union
{
LIST_ENTRY HashLinks;
struct
{
PVOID
SectionPointer;
ULONG
CheckSum;
};
};
union
{
struct
{
ULONG
TimeDateStamp;
};
struct
{
PVOID
LoadedImports;
};
};
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
VOID
bianliqudongmokuai(PUNICODE_STRING name,
UINT64
* pBaseAddr,
UINT64
* pSize)
{
LDR_DATA_TABLE_ENTRY *TE, *Tmp;
TE = (LDR_DATA_TABLE_ENTRY*)g_Object->DriverSection;
PLIST_ENTRY LinkList;
;
int
i = 0;
LinkList = TE->InLoadOrderLinks.Flink;
while
(LinkList != &TE->InLoadOrderLinks)
{
Tmp = (LDR_DATA_TABLE_ENTRY*)LinkList;
if
(RtlCompareUnicodeString(&Tmp->BaseDllName, name, FALSE))
{
}
else
{
kprintf((
"Found Module!\n"
));
*pBaseAddr = (
UINT64
)(Tmp->DllBase);
*pSize = (
UINT64
)(Tmp->SizeOfImage);
}
LinkList = LinkList->Flink;
i++;
}
}
NTSTATUS
myMmCopyMemory(
_In_
PVOID
TargetAddress,
_In_ MM_COPY_ADDRESS SourceAddress,
_In_
SIZE_T
NumberOfBytes,
_In_
ULONG
Flags,
_Out_
PSIZE_T
NumberOfBytesTransferred
) {
if
(!BaseAddr) {
UNICODE_STRING name;
RtlInitUnicodeString(&name, L
"ace.sys"
);
bianliqudongmokuai(&name,&BaseAddr,&DLLSize);
if
(!BaseAddr) {
goto
end;
}
}
PVOID
backtrace[MAX_BACKTRACE_DEPTH];
USHORT
capturedFrames = RtlCaptureStackBackTrace(0, MAX_BACKTRACE_DEPTH, backtrace, NULL);
UINT64
addr = BaseAddr;
UINT64
size = DLLSize;
int
flag = 0;
for
(
USHORT
i = 0; i < capturedFrames; i++)
{
if
(backtrace[i] >= addr && backtrace[i] <= addr + size) {
flag = 1;
}
}
if
(flag) {
kprintf((
"xia0ji233: calls MmCopyMemory(%p,%p,%d,%p,%p)\n"
), TargetAddress, SourceAddress, NumberOfBytes, Flags, NumberOfBytesTransferred);
kprintf((
"Here is data: "
));
for
(
INT64
i = 0; i < NumberOfBytes; i++) {
kprintf((
"%02x "
), *((unsigned
char
*)SourceAddress.VirtualAddress + i));
}
kprintf((
"\n"
));
}
end:
Unhook();
Copy func = (Copy)target;
NTSTATUS s = func(TargetAddress, SourceAddress, NumberOfBytes, Flags, NumberOfBytesTransferred);
Hook();
return
s;
}
void
DriverUnload(PDRIVER_OBJECT pDriver) {
kprintf((
"Line %d:xia0ji233: start unload\n"
), __LINE__);
Unhook();
DeleteDevice(pDriver);
}
NTSTATUS DriverEntry(
_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath
) {
DriverObject->DriverUnload = DriverUnload;
CreateDevice(DriverObject);
kprintf((
"Line %d:xia0ji233: RegistryPath = %S\n"
), __LINE__, RegistryPath->Buffer);
target = MmCopyMemory;
kprintf((
"Line %d:xia0ji233: MmCopyMemory=%p\n"
), __LINE__, target);
g_Object = DriverObject;
if
(target) {
for
(
int
i = 0; i <
sizeof
(oldcode); i++) {
oldcode[i] = target[i];
}
*(
UINT64
*)(newcode + 2) = myMmCopyMemory;
Hook();
}
else
{
kprintf((
"xia0ji233:hahaha"
));
}
return
0;
}