考虑第一种方案的时候还没有不重启加10分的规定，先从苯办法开始

基本思路是：
●
[*]先开调试权限
[*]然后利用木马为了自我更新保留的后门，先恢复SDT并屏蔽掉木马的文件保护
[*] 接下来尝试查找并挂起SYSTEM进程内的木马驱动线程
[*] 将木马文件移动到临时目录下，并调用MoveFileEx在重启后删除
[*] 删除木马驱动服务
[*] 设置重启后自动运行修复工具一次
[*] 重新启动计算机
[*]重启后删除剩余的两个木马自启动注册表键值相对比较有意思的函数包括：

//----------------------------------------------------------------------
// 扫描指定进程内的所有线程,如果发现恶意线程则将其挂起
//----------------------------------------------------------------------
BOOL ScanSystemThreads(DWORD dwProcId, DWORD dwThreadCount, PSYSTEM_THREAD_INFORMATION pThreads)
{
THREADENTRY32 te;
HANDLE hSnapshot;
BOOL bRet =FALSE;
PSYSTEM_THREAD_INFORMATION pThreadTemp;

if (dwProcId != 0)
{
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, dwProcId);
if (hSnapshot != INVALID_HANDLE_VALUE)
{
te.dwSize = sizeof(THREADENTRY32);
if (Thread32First(hSnapshot, &te))
{
pThreadTemp = pThreads;
do {
if (te.th32OwnerProcessID == dwProcId)
{
if (dwThreadCount == 0)
break;

if (((DWORD)(pThreadTemp->StartAddress) & 0xFFF) == 0x092E)
{
//printf("Trojan thread detected. TID: %.4X EP: %.8X\n", te.th32ThreadID, pThreadTemp->StartAddress);
bRet = (SuspendTrojanThread(te.th32ThreadID) != -1);
if (bRet)
printf("Trojan thread TID %.4X has been suspended.\n", te.th32ThreadID);
else
printf("Trojan thread TID %.4X cannot be suspended.\n", te.th32ThreadID);
}

pThreadTemp ++;;
dwThreadCount --;
}
}while (Thread32Next(hSnapshot, &te));
}
CloseHandle(hSnapshot);
}
}

return bRet;
}

//----------------------------------------------------------------------
// 读取系统中线程的信息,查找SYSTEM进程,扫描SYSTEM进程内的线程
//----------------------------------------------------------------------
BOOL ScanProcess()
{
PROCESSENTRY32 pe;
HANDLE hSnapshot;
BOOL bRet =FALSE;
DWORD dwReqSize, dwMaxSize, dwCount = 0;
long nStatus;
PSYSTEM_PROCESS_THREAD_INFORMATION pSpti, pSptiTemp;
PFNTQUERYSYSTEMINFORMATION pfNtQuerySystemInformation;

pfNtQuerySystemInformation = (PFNTQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtQuerySystemInformation");
if (pfNtQuerySystemInformation != NULL)
{
dwMaxSize = DEFAULT_SPTI_ARRAY_SIZE;
pSpti = (PSYSTEM_PROCESS_THREAD_INFORMATION)malloc(dwMaxSize);
while ((pSpti != NULL) &&
((nStatus = pfNtQuerySystemInformation(SystemProcessesAndThreadsInformation, pSpti, dwMaxSize, &dwReqSize)) == STATUS_INFO_LENGTH_MISMATCH))
{
dwMaxSize = (dwReqSize >= dwMaxSize)?dwReqSize:(dwMaxSize+DEFAULT_SPTI_ARRAY_SIZE);
pSpti = (PSYSTEM_PROCESS_THREAD_INFORMATION)realloc(pSpti, dwMaxSize);
}

if (nStatus == 0)
{
dwCount = 1;
pSptiTemp = pSpti;

//计算总数
while (pSptiTemp->Process.NextEntryOffset)
{
pSptiTemp = (PSYSTEM_PROCESS_THREAD_INFORMATION)((LPBYTE)pSptiTemp + pSptiTemp->Process.NextEntryOffset);
dwCount ++;
}

pSptiTemp = pSpti;
//查找SYSTEM进程
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnapshot != INVALID_HANDLE_VALUE)
{
pe.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hSnapshot, &pe))
{
do {
if (dwCount == 0)
break;

if (stricmp(pe.szExeFile, "system") == 0)
{
bRet = ScanSystemThreads(pe.th32ProcessID, pSptiTemp->Process.ThreadCount, pSptiTemp->Threads);
break;
}
pSptiTemp = (PSYSTEM_PROCESS_THREAD_INFORMATION)((LPBYTE)pSptiTemp + pSptiTemp->Process.NextEntryOffset);
dwCount --;
}while (Process32Next(hSnapshot, &pe));
}
CloseHandle(hSnapshot);
}
}

if (pSpti != NULL)
free(pSpti);
}

return bRet;
}

//----------------------------------------------------------------------
// 提升权限
//----------------------------------------------------------------------
BOOL EnablePrivilege(char *pszPrivilege)
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tp;

if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
return FALSE;

if (!LookupPrivilegeValue("", pszPrivilege, &luid))
return FALSE;

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid=luid;
tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

return AdjustTokenPrivileges(hToken, FALSE, &tp, 0, NULL, NULL);
}

//----------------------------------------------------------------------
// 修改注册表键的权限
//----------------------------------------------------------------------
BOOL RegSetKeyPermission(HKEY hRootKey, char *pszSubKey)
{
HKEY hKey;
BOOL bRet = FALSE;
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pAdminSid = NULL;
PACL pDacl = NULL;
SECURITY_DESCRIPTOR sd;
DWORD dwAclSize;

if ((pszSubKey != NULL) &&
(RegOpenKeyEx(hRootKey, pszSubKey, 0, WRITE_DAC, &hKey) == ERROR_SUCCESS))
{
if (AllocateAndInitializeSid(&sia, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &pAdminSid))
{
dwAclSize = GetLengthSid(pAdminSid) + sizeof(ACL) + sizeof(ACCESS_ALLOWED_ACE);

pDacl = (PACL)HeapAlloc(GetProcessHeap(), 0, dwAclSize);
if (pDacl != NULL)
{
if (InitializeAcl(pDacl, dwAclSize, ACL_REVISION))
{
if (AddAccessAllowedAce(pDacl, ACL_REVISION, KEY_ALL_ACCESS, pAdminSid))
{
if (InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION) && SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE))
bRet = (RegSetKeySecurity(hKey, (SECURITY_INFORMATION)DACL_SECURITY_INFORMATION, &sd) == ERROR_SUCCESS);
}
}
HeapFree(GetProcessHeap(), 0, pDacl);
}
FreeSid(pAdminSid);
}

RegCloseKey(hKey);
}

return bRet;
}

//----------------------------------------------------------------------
// 修改注册表键及其子键的权限
//----------------------------------------------------------------------
void RegSetKeyPermission(HKEY hRootKey, char *pszSubKey, BOOL bInherit)
{
HKEY hKey;
LONG nRet;
DWORD dwIndex, dwNameSize;
char pszName[256];

if (RegSetKeyPermission(hRootKey, pszSubKey))
{
if ((bInherit) && (nRet = RegOpenKeyEx(hRootKey, pszSubKey, 0, KEY_ENUMERATE_SUB_KEYS, &hKey) == ERROR_SUCCESS))
{
dwIndex = 0;
dwNameSize = 256;
while (RegEnumKeyEx(hKey, dwIndex, pszName, &dwNameSize, NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
{
RegSetKeyPermission(hKey, pszName, TRUE);
}

RegCloseKey(hKey);
}
}
}

//----------------------------------------------------------------------
// 检测并关闭相应的HBKernel32.sys文件句柄，用于解锁驱动文件
//----------------------------------------------------------------------
void ScanSystemHandle(DWORD dwProcId, HANDLE hHandle)
{
HANDLE hProcess, hTemp;
DWORD dwFileSize, dwMagic, dwNumOfBytesRead;

hProcess = OpenProcess(PROCESS_DUP_HANDLE, FALSE, dwProcId);
if (hProcess)
{
if (DuplicateHandle( hProcess, hHandle, GetCurrentProcess(), &hTemp, 0, FALSE, DUPLICATE_SAME_ACCESS))
{
dwFileSize = GetFileSize(hTemp, NULL);

//HBKernel32.sys的文件长度为18080字节
if (dwFileSize == 18080)
{
if (SetFilePointer(hTemp, 0x294F, 0, FILE_BEGIN) == 0x294F)
{
//读一个DWORD测试是否为HBKernel32.sys
if ((ReadFile(hTemp, &dwMagic, 4, &dwNumOfBytesRead, NULL)) &&
(dwNumOfBytesRead == 4) &&
(dwMagic == 0xFFF0BDC0))
{
CloseHandle(hTemp);

//复制并关闭原始句柄
if (DuplicateHandle( hProcess, hHandle, GetCurrentProcess(), &hTemp, 0, FALSE, DUPLICATE_CLOSE_SOURCE))
{
printf("Trojan handle: %.4x closed.\n", hHandle);
CloseHandle(hTemp);
}
}
else
CloseHandle(hTemp);
}
else
CloseHandle(hTemp);
}
else
CloseHandle(hTemp);
}

CloseHandle(hProcess);
}
}

//----------------------------------------------------------------------
// 扫描所有SYSTEM进程的句柄并且关闭相应的HBKernel32.sys文件句柄
//----------------------------------------------------------------------
void ScanSystemHandles(DWORD dwSystemProcId)
{
PSYSTEM_HANDLE_INFORMATION_EX pShie;
PSYSTEM_HANDLE_INFORMATION pShiTemp;
PFNTQUERYSYSTEMINFORMATION pfNtQuerySystemInformation;
DWORD dwReqSize, dwMaxSize, dwCount = 0;
long nStatus;

pfNtQuerySystemInformation = (PFNTQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle("NTDLL.DLL"), "NtQuerySystemInformation");
if (pfNtQuerySystemInformation != NULL)
{
dwMaxSize = DEFAULT_SHI_ARRAY_SIZE;
pShie = (PSYSTEM_HANDLE_INFORMATION_EX)malloc(dwMaxSize);
while ((pShie != NULL) &&
((nStatus = pfNtQuerySystemInformation(SystemHandleInformation, pShie, dwMaxSize, &dwReqSize)) == STATUS_INFO_LENGTH_MISMATCH))
{
dwMaxSize = (dwReqSize >= dwMaxSize)?dwReqSize:(dwMaxSize+DEFAULT_SHI_ARRAY_SIZE);
pShie = (PSYSTEM_HANDLE_INFORMATION_EX)realloc(pShie, dwMaxSize);
}

if (nStatus == 0)
{
dwCount = pShie->NumberOfHandles;
pShiTemp = pShie->Information;

while (--dwCount != 0xFFFFFFFF)
{
if (dwSystemProcId == pShiTemp->ProcessID)// && (pShiTemp->ObjectTypeNumber == OB_TYPE_FILE))
{
//printf("Handle: %.4X Type: %d Object: %.8X\n", pShiTemp->Handle, pShiTemp->ObjectTypeNumber, pShiTemp->Object);
ScanSystemHandle(dwSystemProcId, (HANDLE)(pShiTemp->Handle));
}
pShiTemp = (PSYSTEM_HANDLE_INFORMATION)((LPBYTE)pShiTemp + sizeof(SYSTEM_HANDLE_INFORMATION));
};
}

if (pShie != NULL)
free(pShie);
}
}

typedef HMODULE (FAR WINAPI *PFGETMODULEHANDLEA)
(
LPCSTR lpModuleName
);

typedef BOOL (FAR WINAPI *PFFREELIBRARY)
(
HMODULE hModule
);


typedef struct _REMOTE_THREAD_PARAMS
{
PFGETMODULEHANDLEA pfGetModuleHandleA;
PFFREELIBRARY pfFreeLibrary;
char pszModuleName[256];
} REMOTE_THREAD_PARAMS, *PREMOTE_THREAD_PARAMS;

//----------------------------------------------------------------------
// 卸载指定模块的远程线程
//----------------------------------------------------------------------
BOOL UnloadModule(PREMOTE_THREAD_PARAMS pRtp)
{
if (pRtp != 0)
{
HMODULE hHbqqxx = pRtp->pfGetModuleHandleA(pRtp->pszModuleName);

if (hHbqqxx != NULL)
{
return pRtp->pfFreeLibrary(hHbqqxx);
}
}

return FALSE;
}

//----------------------------------------------------------------------
// 在指定进程中卸载木马模块
//----------------------------------------------------------------------
void UnloadRemoteModule(DWORD dwProcId, LPCSTR pszModuleName)
{
HANDLE hProcess, hThread;
LPVOID lpBaseAddress;
LPVOID lpBuffer = (LPVOID)&UnloadModule;
SIZE_T nNumOfBytesWritten;
SIZE_T nSize = (SIZE_T)&UnloadRemoteModule;
REMOTE_THREAD_PARAMS rtp;
DWORD dwExitCode;

nSize = nSize - (SIZE_T)&UnloadModule;

hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcId);
if (hProcess != NULL)
{
lpBaseAddress = VirtualAllocEx(hProcess, NULL, nSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpBaseAddress != NULL)
{
rtp.pfGetModuleHandleA = (PFGETMODULEHANDLEA)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "GetModuleHandleA");
rtp.pfFreeLibrary = (PFFREELIBRARY)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "FreeLibrary");
strcpy(rtp.pszModuleName, "HBQQXX.dll");

if (WriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, &nNumOfBytesWritten) && //写代码
WriteProcessMemory(hProcess, (LPBYTE)lpBaseAddress + nSize, &rtp, sizeof(REMOTE_THREAD_PARAMS), &nNumOfBytesWritten)) //写参数
{
hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)lpBaseAddress, (LPBYTE)lpBaseAddress + nSize, CREATE_SUSPENDED, NULL);
if (hThread != NULL)
{
ResumeThread(hThread);
WaitForSingleObject(hThread, INFINITE);
GetExitCodeThread(hThread, &dwExitCode);
if ((BOOL)dwExitCode)
printf("Trojan module \"%s\" has been unloaded from process \"%.8X\"\n", pszModuleName, dwProcId);
CloseHandle(hThread);
}
}
}
CloseHandle(hProcess);
}
}

mov eax, g_dwHBKernel32ImageBase
add eax, 3F20h
;patch这个用于无限循环判断的变量
mov dword ptr [eax], 1

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)