[分享][求助]一程序里的杀进程驱动-软件逆向-看雪-安全社区|安全招聘|kanxue.com

最新回复 (13)
dodou 雪币： 443 活跃值： (59) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 120 粉丝 0 关注私信	dodou 2 楼病毒里的？？ 2009-5-6 11:50 0
fixfix 雪币： 419 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 671 粉丝 0 关注私信	fixfix 3 楼 .text:0001077F push offset eprocess .text:00010784 push eax .text:00010785 mov dword_109DC, eax .text:0001078A call PsLookupProcessByProcessId .text:0001078A .text:00010790 push eprocess .text:00010796 call sub_1053E .text:0001053E push 8 .text:00010540 push offset stru_102F0 .text:00010545 call __SEH_prolog .text:00010545 .text:0001054A and [ebp+ms_exc.disabled], 0 .text:0001054E push offset dword_10534 ; char * .text:00010553 call sub_103EC .text:00010553 .text:00010558 mov dword_109E0, eax .text:0001055D pusha .text:0001055E cmc .text:0001055F xor eax, eax .text:00010561 push eax .text:00010562 xor ebx, ebx .text:00010564 pop eax .text:00010565 cmc .text:00010566 xor edx, edx .text:00010568 push ebx .text:00010569 xor eax, eax .text:0001056B pop ebx .text:0001056C nop .text:0001056D xor ebx, ebx .text:0001056F push ecx .text:00010570 xor edx, edx .text:00010572 pop ecx .text:00010573 cmc .text:00010574 xor eax, eax .text:00010576 push edx .text:00010577 xor ebx, ebx .text:00010579 pop edx .text:0001057A popa .text:0001057B push dword_109E0 .text:00010581 push [ebp+arg_0] .text:00010584 call MmUnmapViewOfSection .text:00010584 .text:00010589 pusha .text:0001058A cmc .text:0001058B xor eax, eax .text:0001058D push eax .text:0001058E xor ebx, ebx .text:00010590 pop eax .text:00010591 cmc .text:00010592 xor edx, edx .text:00010594 push ebx .text:00010595 xor eax, eax .text:00010597 pop ebx .text:00010598 nop .text:00010599 xor ebx, ebx .text:0001059B push ecx .text:0001059C xor edx, edx .text:0001059E pop ecx .text:0001059F cmc .text:000105A0 xor eax, eax .text:000105A2 push edx .text:000105A3 xor ebx, ebx .text:000105A5 pop edx .text:000105A6 popa .text:000105A7 push [ebp+arg_0] .text:000105AA call KeAttachProcess .text:000105AA .text:000105B0 pusha .text:000105B1 cmc .text:000105B2 xor eax, eax .text:000105B4 push eax .text:000105B5 xor ebx, ebx .text:000105B7 pop eax .text:000105B8 cmc .text:000105B9 xor edx, edx .text:000105BB push ebx .text:000105BC xor eax, eax .text:000105BE pop ebx .text:000105BF nop .text:000105C0 xor ebx, ebx .text:000105C2 push ecx .text:000105C3 xor edx, edx .text:000105C5 pop ecx .text:000105C6 cmc .text:000105C7 xor eax, eax .text:000105C9 push edx .text:000105CA xor ebx, ebx .text:000105CC pop edx .text:000105CD popa .text:000105CE push 0 ; ExitStatus .text:000105D0 push 0 ; ProcessHandle .text:000105D2 call ZwTerminateProcess .text:000105D2 .text:000105D8 pusha .text:000105D9 cmc .text:000105DA xor eax, eax .text:000105DC push eax .text:000105DD xor ebx, ebx .text:000105DF pop eax .text:000105E0 cmc .text:000105E1 xor edx, edx .text:000105E3 push ebx .text:000105E4 xor eax, eax .text:000105E6 pop ebx .text:000105E7 nop .text:000105E8 xor ebx, ebx .text:000105EA push ecx .text:000105EB xor edx, edx .text:000105ED pop ecx .text:000105EE cmc .text:000105EF xor eax, eax .text:000105F1 push edx .text:000105F2 xor ebx, ebx .text:000105F4 pop edx .text:000105F5 popa .text:000105F6 call KeDetachProcess .text:000105F6 .text:000105FC pusha .text:000105FD cmc .text:000105FE xor eax, eax .text:00010600 push eax .text:00010601 xor ebx, ebx .text:00010603 pop eax .text:00010604 cmc .text:00010605 xor edx, edx .text:00010607 push ebx .text:00010608 xor eax, eax .text:0001060A pop ebx .text:0001060B nop .text:0001060C xor ebx, ebx .text:0001060E push ecx .text:0001060F xor edx, edx .text:00010611 pop ecx .text:00010612 cmc .text:00010613 xor eax, eax .text:00010615 push edx .text:00010616 xor ebx, ebx .text:00010618 pop edx .text:00010619 popa .text:0001061A push offset ProcessHandle .text:0001061F xor eax, eax .text:00010621 push eax .text:00010622 push eax .text:00010623 push eax .text:00010624 push eax .text:00010625 push eax .text:00010626 push [ebp+arg_0] .text:00010629 call ObOpenObjectByPointer .text:00010629 .text:0001062F pusha .text:00010630 cmc .text:00010631 xor eax, eax .text:00010633 push eax .text:00010634 xor ebx, ebx .text:00010636 pop eax .text:00010637 cmc .text:00010638 xor edx, edx .text:0001063A push ebx .text:0001063B xor eax, eax .text:0001063D pop ebx .text:0001063E nop .text:0001063F xor ebx, ebx .text:00010641 push ecx .text:00010642 xor edx, edx .text:00010644 pop ecx .text:00010645 cmc .text:00010646 xor eax, eax .text:00010648 push edx .text:00010649 xor ebx, ebx .text:0001064B pop edx .text:0001064C popa .text:0001064D push 0 ; ExitStatus .text:0001064F push ProcessHandle ; ProcessHandle .text:00010655 call ZwTerminateProcess .text:00010655 .text:0001065B pusha .text:0001065C cmc .text:0001065D xor eax, eax .text:0001065F push eax .text:00010660 xor ebx, ebx .text:00010662 pop eax .text:00010663 cmc .text:00010664 xor edx, edx .text:00010666 push ebx .text:00010667 xor eax, eax .text:00010669 pop ebx .text:0001066A nop .text:0001066B xor ebx, ebx .text:0001066D push ecx .text:0001066E xor edx, edx .text:00010670 pop ecx .text:00010671 cmc .text:00010672 xor eax, eax .text:00010674 push edx .text:00010675 xor ebx, ebx .text:00010677 pop edx .text:00010678 popa .text:00010679 push ProcessHandle ; Handle .text:0001067F call ZwClose .text:0001067F .text:00010685 jmp short loc_1068E .text:00010685 .text:00010687 ; --------------------------------------------------------------------------- .text:00010687 .text:00010687 loc_10687: ; DATA XREF: .text:stru_102F0o .text:00010687 xor eax, eax .text:00010689 inc eax .text:0001068A retn .text:0001068A .text:0001068B ; --------------------------------------------------------------------------- .text:0001068B .text:0001068B loc_1068B: ; DATA XREF: .text:stru_102F0o .text:0001068B mov esp, [ebp+ms_exc.old_esp] .text:0001068B .text:0001068E .text:0001068E loc_1068E: ; CODE XREF: sub_1053E+147j .text:0001068E or [ebp+ms_exc.disabled], 0FFFFFFFFh .text:00010692 call __SEH_epilog .text:00010692 .text:00010697 retn 4 .text:00010697 .text:00010697 sub_1053E endp 2009-5-6 12:37 0
dayang 雪币： 220 活跃值： (786) 能力值： ( LV2，RANK：10 ) 在线值：发帖 38 回帖 938 粉丝 1 关注私信	dayang 4 楼是一病毒里的 2009-5-6 14:15 0
riijj 雪币： 2319 活跃值： (565) 能力值： (RANK：300 ) 在线值：发帖 150 回帖 1307 粉丝 10 关注私信	riijj 7 5 楼辛勤的从 KeAttachProcess 走进去, 就是为了ZwTerminateProcess 如果 ZwTerminateProcess 被 hook 便没有分别, 跟 exe 叫 TerminateProcess 没两样更保险的方法估计是从 PsActiveProcessHead 慢慢找, 再杀掉 2009-5-6 14:32 0
轩辕小聪雪币： 722 活跃值： (123) 能力值： ( LV12，RANK：300 ) 在线值：发帖 10 回帖 547 粉丝 5 关注私信	轩辕小聪 7 6 楼 .text:0001054E push offset dword_10534 ; 'ntdll.dll' 上面这个注释一补充，加上3楼贴的结果，就啥都清楚了。驱动接收由用户层传来的目标进程PID，调用PsLookupProcessByProcessId得到EPROCESS指针，之后主要用三种手法： 1.MmUnmapViewOfSection强行使该进程卸载ntdll.dll； 2.KeAttachProcess切换到该进程上下文，调用ZwTerminateProcess； 3.ObOpenObjectByPointer得到进程句柄，调用ZwTerminateProcess结束进程。同意楼上的，ZwTerminateProcess被HOOK的话后两个方法就没啥作用了（只是不知道卡巴的HOOK有没有判断ZwTerminateProcess的第一个参数为0的情况）这些都是大家都知道的手法了。 2009-5-6 14:37 0
riijj 雪币： 2319 活跃值： (565) 能力值： (RANK：300 ) 在线值：发帖 150 回帖 1307 粉丝 10 关注私信	riijj 7 7 楼暴力的版本把目标进程的内存都用 0xCC 填满让它自己死掉 2009-5-6 14:51 0
dayang 雪币： 220 活跃值： (786) 能力值： ( LV2，RANK：10 ) 在线值：发帖 38 回帖 938 粉丝 1 关注私信	dayang 8 楼 NTSTATUS __stdcall sub_1053E(int a1) { CPPEH_RECORD ms_exc; // [sp+Ch] [bp-18h]@1 ms_exc.disabled = 0; dword_109E0 = (int)sub_103EC(dword_10534); MmUnmapViewOfSection(a1, dword_109E0); KeAttachProcess(a1); ZwTerminateProcess(0, 0); KeDetachProcess(); ObOpenObjectByPointer(a1, 0, 0, 0, 0, 0, &ProcessHandle); ZwTerminateProcess(ProcessHandle, 0); return ZwClose(ProcessHandle); } f5得到的，呵呵 ntdll.dll的基址是怎么得到的呢？有人能逆出完整点的代码不？ 2009-5-6 14:53 0
fixfix 雪币： 419 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 21 回帖 671 粉丝 0 关注私信	fixfix 9 楼 NTDLL.DLL 是这里 .text:000103EC ; int __stdcall sub_103EC(char ) .text:000103EC sub_103EC proc near ; CODE XREF: sub_1053E+15p .text:000103EC .text:000103EC var_18 = dword ptr -18h .text:000103EC var_14 = dword ptr -14h .text:000103EC var_10 = dword ptr -10h .text:000103EC var_C = dword ptr -0Ch .text:000103EC ReturnLength = dword ptr -8 .text:000103EC P = dword ptr -4 .text:000103EC arg_0 = dword ptr 8 .text:000103EC .text:000103EC push ebp .text:000103ED mov ebp, esp .text:000103EF sub esp, 18h .text:000103F2 and [ebp+var_18], 0 .text:000103F6 and [ebp+ReturnLength], 0 .text:000103FA push ebx .text:000103FB push esi .text:000103FC lea eax, [ebp+P] .text:000103FF push edi .text:00010400 mov [ebp+P], eax .text:00010403 pusha .text:00010404 cmc .text:00010405 xor eax, eax .text:00010407 push eax .text:00010408 xor ebx, ebx .text:0001040A pop eax .text:0001040B cmc .text:0001040C xor edx, edx .text:0001040E push ebx .text:0001040F xor eax, eax .text:00010411 pop ebx .text:00010412 nop .text:00010413 xor ebx, ebx .text:00010415 push ecx .text:00010416 xor edx, edx .text:00010418 pop ecx .text:00010419 cmc .text:0001041A xor eax, eax .text:0001041C push edx .text:0001041D xor ebx, ebx .text:0001041F pop edx .text:00010420 popa .text:00010421 mov esi, ZwQuerySystemInformation .text:00010427 lea eax, [ebp+ReturnLength] .text:0001042A push eax ; ReturnLength .text:0001042B push 0 ; SystemInformationLength .text:0001042D push [ebp+P] ; SystemInformation .text:00010430 push 0Bh ; SystemInformationClass .text:00010432 call esi ; ZwQuerySystemInformation .text:00010432 .text:00010434 push 206B6444h ; Tag .text:00010439 push [ebp+ReturnLength] ; NumberOfBytes .text:0001043C push 0 ; PoolType .text:0001043E call ExAllocatePoolWithTag .text:0001043E .text:00010444 test eax, eax .text:00010446 mov [ebp+P], eax .text:00010449 jz loc_1052C .text:00010449 .text:0001044F lea ecx, [ebp+ReturnLength] .text:00010452 push ecx ; ReturnLength .text:00010453 push [ebp+ReturnLength] ; SystemInformationLength .text:00010456 push eax ; SystemInformation .text:00010457 push 0Bh ; SystemInformationClass .text:00010459 call esi ; ZwQuerySystemInformation .text:00010459 .text:0001045B test eax, eax .text:0001045D jge short loc_10466 .text:0001045D .text:0001045F xor esi, esi .text:00010461 jmp loc_1051F .text:00010461 .text:00010466 ; --------------------------------------------------------------------------- .text:00010466 .text:00010466 loc_10466: ; CODE XREF: sub_103EC+71j .text:00010466 pusha .text:00010467 cmc .text:00010468 xor eax, eax .text:0001046A push eax .text:0001046B xor ebx, ebx .text:0001046D pop eax .text:0001046E cmc .text:0001046F xor edx, edx .text:00010471 push ebx .text:00010472 xor eax, eax .text:00010474 pop ebx .text:00010475 nop .text:00010476 xor ebx, ebx .text:00010478 push ecx .text:00010479 xor edx, edx .text:0001047B pop ecx .text:0001047C cmc .text:0001047D xor eax, eax .text:0001047F push edx .text:00010480 xor ebx, ebx .text:00010482 pop edx .text:00010483 popa .text:00010484 mov eax, [ebp+P] .text:00010487 and [ebp+var_10], 0 .text:0001048B cmp dword ptr [eax], 0 .text:0001048E lea ecx, [eax+4] .text:00010491 mov [ebp+var_14], ecx .text:00010494 jbe loc_1051C .text:00010494 .text:0001049A add ecx, 1Ch .text:0001049D mov [ebp+var_C], ecx .text:000104A0 mov edi, 11Ch .text:000104A0 .text:000104A5 .text:000104A5 loc_104A5: ; CODE XREF: sub_103EC+123j .text:000104A5 mov eax, [ebp+var_C] .text:000104A8 lea edx, [eax+1] .text:000104A8 .text:000104AB .text:000104AB loc_104AB: ; CODE XREF: sub_103EC+C4j .text:000104AB mov cl, [eax] .text:000104AD inc eax .text:000104AE test cl, cl .text:000104B0 jnz short loc_104AB .text:000104B0 .text:000104B2 mov ecx, [ebp+arg_0] .text:000104B5 sub eax, edx .text:000104B7 lea edx, [ecx+1] .text:000104B7 .text:000104BA .text:000104BA loc_104BA: ; CODE XREF: sub_103EC+D3j .text:000104BA mov bl, [ecx] .text:000104BC inc ecx .text:000104BD test bl, bl .text:000104BF jnz short loc_104BA .text:000104BF .text:000104C1 sub ecx, edx .text:000104C3 cmp eax, ecx .text:000104C5 jb short loc_104FE .text:000104C5 .text:000104C7 mov eax, [ebp+var_C] .text:000104CA lea edx, [eax+1] .text:000104CA .text:000104CD .text:000104CD loc_104CD: ; CODE XREF: sub_103EC+E6j .text:000104CD mov cl, [eax] .text:000104CF inc eax .text:000104D0 test cl, cl .text:000104D2 jnz short loc_104CD .text:000104D2 .text:000104D4 sub eax, edx .text:000104D6 mov esi, eax .text:000104D8 mov eax, [ebp+arg_0] .text:000104DB lea ecx, [eax+1] .text:000104DB .text:000104DE .text:000104DE loc_104DE: ; CODE XREF: sub_103EC+F7j .text:000104DE mov dl, [eax] .text:000104E0 inc eax .text:000104E1 test dl, dl .text:000104E3 jnz short loc_104DE .text:000104E3 .text:000104E5 push [ebp+arg_0] ; char .text:000104E8 sub eax, ecx .text:000104EA mov ecx, [ebp+var_C] .text:000104ED sub ecx, eax .text:000104EF add ecx, esi .text:000104F1 push ecx ; char * .text:000104F2 call _stricmp .text:000104F2 .text:000104F8 test eax, eax .text:000104FA pop ecx .text:000104FB pop ecx .text:000104FC jz short loc_10513 .text:000104FC .text:000104FE .text:000104FE loc_104FE: ; CODE XREF: sub_103EC+D9j .text:000104FE inc [ebp+var_10] .text:00010501 mov eax, [ebp+P] .text:00010504 mov ecx, [ebp+var_10] .text:00010507 add [ebp+var_14], edi .text:0001050A add [ebp+var_C], edi .text:0001050D cmp ecx, [eax] .text:0001050F jb short loc_104A5 .text:0001050F .text:00010511 jmp short loc_1051C .text:00010511 .text:00010513 ; --------------------------------------------------------------------------- .text:00010513 .text:00010513 loc_10513: ; CODE XREF: sub_103EC+110j .text:00010513 mov eax, [ebp+var_14] .text:00010516 mov eax, [eax+8] .text:00010519 mov [ebp+var_18], eax .text:00010519 .text:0001051C .text:0001051C loc_1051C: ; CODE XREF: sub_103EC+A8j .text:0001051C ; sub_103EC+125j .text:0001051C mov esi, [ebp+var_18] .text:0001051C .text:0001051F .text:0001051F loc_1051F: ; CODE XREF: sub_103EC+75j .text:0001051F push 0 ; Tag .text:00010521 push [ebp+P] ; P .text:00010524 call ExFreePoolWithTag .text:00010524 .text:0001052A mov eax, esi .text:0001052A .text:0001052C .text:0001052C loc_1052C: ; CODE XREF: sub_103EC+5Dj .text:0001052C pop edi .text:0001052D pop esi .text:0001052E pop ebx .text:0001052F leave .text:00010530 retn 4 .text:00010530 .text:00010530 sub_103EC endp 2009-5-6 15:37 0
frozenrain 雪币： 107 活跃值： (1758) 能力值： ( LV6，RANK：80 ) 在线值：发帖 26 回帖 509 粉丝 1 关注私信	frozenrain 10 楼如果MmUnmapViewOfSection 也被HOOK掉了呢 2009-5-6 16:04 0
dayang 雪币： 220 活跃值： (786) 能力值： ( LV2，RANK：10 ) 在线值：发帖 38 回帖 938 粉丝 1 关注私信	dayang 11 楼兄弟有C的吗？ASM看不懂，呵呵 2009-5-6 19:05 0
垃圾一个雪币： 91 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 70 粉丝 0 关注私信	垃圾一个 12 楼不好玩，什么时候的东西。 2009-5-6 19:06 0
垃圾一个雪币： 91 活跃值： (10) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 70 粉丝 0 关注私信	垃圾一个 13 楼我什么都没有说 2009-5-6 19:15 0
dayang 雪币： 220 活跃值： (786) 能力值： ( LV2，RANK：10 ) 在线值：发帖 38 回帖 938 粉丝 1 关注私信	dayang 14 楼 // Data declarations extern const WCHAR SourceString[]; // idb extern char dword_10534[]; // idb extern HANDLE ProcessHandle; // idb extern int dword_109DC; // weak extern int dword_109E0; // weak extern int dword_109E4; // weak //------------------------------------------------------------------------- // Function declarations // void __stdcall IoDeleteDevice(PDEVICE_OBJECT DeviceObject); idb // NTSTATUS __stdcall IoDeleteSymbolicLink(PUNICODE_STRING SymbolicLinkName); idb // void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString); idb // void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost); idb // void __stdcall ExFreePoolWithTag(PVOID P, ULONG Tag); idb // int __cdecl stricmp(const char , const char ); idb // PVOID __stdcall ExAllocatePoolWithTag(POOL_TYPE PoolType, SIZE_T NumberOfBytes, ULONG Tag); idb // NTSTATUS __stdcall ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); idb // NTSTATUS __stdcall ZwClose(HANDLE Handle); idb // int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak // int KeDetachProcess(void); weak // NTSTATUS __stdcall ZwTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus); idb // int __stdcall KeAttachProcess(_DWORD); weak // int __stdcall PsLookupProcessByProcessId(_DWORD, _DWORD); weak void __stdcall sub_1035A(int a1); int __stdcall sub_103AC(int a1, int a2); PVOID __stdcall sub_103EC(char a1); // idb NTSTATUS __stdcall sub_1053E(int a1); signed int __stdcall sub_1069A(int a1, signed int a2); int __stdcall start(PDRIVER_OBJECT DriverObject, int); // idb // int __stdcall MmUnmapViewOfSection(_DWORD, _DWORD); weak //----- (0001035A) -------------------------------------------------------- void __stdcall sub_1035A(int a1) { UNICODE_STRING DestinationString; // [sp+Ch] [bp-8h]@1 RtlInitUnicodeString(&DestinationString, L"\\??\\KILLPS_Drv"); IoDeleteSymbolicLink(&DestinationString); IoDeleteDevice((PDEVICE_OBJECT )(a1 + 4)); } //----- (000103AC) -------------------------------------------------------- int __stdcall sub_103AC(int a1, int a2) { (_DWORD )(a2 + 24) = 0; (_DWORD )(a2 + 28) = 0; IofCompleteRequest((PIRP)a2, 0); return 0; } //----- (000103EC) -------------------------------------------------------- PVOID __stdcall sub_103EC(char a1) { PVOID result; // eax@1 void v2; // esi@3 char v3; // zf@4 void v4; // [sp+Ch] [bp-18h]@1 ULONG ReturnLength; // [sp+1Ch] [bp-8h]@1 PVOID P; // [sp+20h] [bp-4h]@1 unsigned int v7; // [sp+14h] [bp-10h]@4 char v8; // [sp+10h] [bp-14h]@4 const char v9; // [sp+18h] [bp-Ch]@5 v4 = 0; ReturnLength = 0; P = &P; ZwQuerySystemInformation(SystemModuleInformation, &P, 0, &ReturnLength); result = ExAllocatePoolWithTag(0, ReturnLength, 0x206B6444u); P = result; if ( result ) { if ( ZwQuerySystemInformation(SystemModuleInformation, result, ReturnLength, &ReturnLength) >= 0 ) { v7 = 0; v3 = (_DWORD )P == 0; v8 = (char )P + 4; if ( !v3 ) { v9 = (char )P + 32; while ( strlen(v9) < strlen(a1) \|\| stricmp(v9, a1) ) { ++v7; v8 += 284; v9 += 284; if ( v7 >= (_DWORD )P ) goto LABEL_11; } v4 = (void )((_DWORD )v8 + 2); } LABEL_11: v2 = v4; } else { v2 = 0; } ExFreePoolWithTag(P, 0); result = v2; } return result; } //----- (0001053E) -------------------------------------------------------- NTSTATUS __stdcall sub_1053E(int a1) { CPPEH_RECORD ms_exc; // [sp+Ch] [bp-18h]@1 ms_exc.disabled = 0; dword_109E0 = (int)sub_103EC(dword_10534); MmUnmapViewOfSection(a1, dword_109E0); KeAttachProcess(a1); ZwTerminateProcess(0, 0); KeDetachProcess(); ObOpenObjectByPointer(a1, 0, 0, 0, 0, 0, &ProcessHandle); ZwTerminateProcess(ProcessHandle, 0); return ZwClose(ProcessHandle); } //----- (0001069A) -------------------------------------------------------- signed int __stdcall sub_1069A(int a1, signed int a2) { signed int v2; // ebp@1 int v4; // eax@1 signed int v5; // ecx@1 int v6; // eax@1 int v7; // ST1C_4@2 signed int v8; // [sp+10h] [bp-Ch]@1 int v9; // [sp+14h] [bp-8h]@1 int v10; // [sp+18h] [bp-4h]@1 v8 = -1073741808; v2 = a2; v4 = (_DWORD )(a2 + 96); v5 = (_DWORD )(v4 + 12); v6 = (_DWORD )(v4 + 4); a2 = v5; v9 = (int )(v2 + 12); v10 = v6; if ( v5 == 2236420 ) { v7 = v9; dword_109DC = v9; PsLookupProcessByProcessId(v7, &dword_109E4); sub_1053E(dword_109E4); v8 = 0; (_DWORD )(v2 + 28) = v10; } else { (_DWORD )(v2 + 28) = 0; } (_DWORD *)(v2 + 24) = v8; IofCompleteRequest((PIRP)v2, 0); return v8; } F5 2009-5-6 21:45 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

dodou

雪币： 443

活跃值： (59)

能力值：

( LV2，RANK：10 )

在线值：

发帖

5

回帖

120

粉丝

0

关注

私信

dodou: 2 楼

病毒里的？？

2009-5-6 11:50

0

fixfix

雪币： 419

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

21

回帖

671

粉丝

0

关注

私信

fixfix: 3 楼

.text:0001077F                push offset eprocess
.text:00010784                push eax
.text:00010785                mov    dword_109DC, eax
.text:0001078A                call PsLookupProcessByProcessId
.text:0001078A
.text:00010790                push eprocess
.text:00010796                call sub_1053E

.text:0001053E                push 8
.text:00010540                push offset stru_102F0
.text:00010545                call __SEH_prolog
.text:00010545
.text:0001054A                and    [ebp+ms_exc.disabled], 0
.text:0001054E                push offset dword_10534 ; char *
.text:00010553                call sub_103EC
.text:00010553
.text:00010558                mov    dword_109E0, eax
.text:0001055D                pusha
.text:0001055E                cmc
.text:0001055F                xor    eax, eax
.text:00010561                push eax
.text:00010562                xor    ebx, ebx
.text:00010564                pop    eax
.text:00010565                cmc
.text:00010566                xor    edx, edx
.text:00010568                push ebx
.text:00010569                xor    eax, eax
.text:0001056B                pop    ebx
.text:0001056C                nop
.text:0001056D                xor    ebx, ebx
.text:0001056F                push ecx
.text:00010570                xor    edx, edx
.text:00010572                pop    ecx
.text:00010573                cmc
.text:00010574                xor    eax, eax
.text:00010576                push edx
.text:00010577                xor    ebx, ebx
.text:00010579                pop    edx
.text:0001057A                popa
.text:0001057B                push dword_109E0
.text:00010581                push [ebp+arg_0]
.text:00010584                call MmUnmapViewOfSection
.text:00010584
.text:00010589                pusha
.text:0001058A                cmc
.text:0001058B                xor    eax, eax
.text:0001058D                push eax
.text:0001058E                xor    ebx, ebx
.text:00010590                pop    eax
.text:00010591                cmc
.text:00010592                xor    edx, edx
.text:00010594                push ebx
.text:00010595                xor    eax, eax
.text:00010597                pop    ebx
.text:00010598                nop
.text:00010599                xor    ebx, ebx
.text:0001059B                push ecx
.text:0001059C                xor    edx, edx
.text:0001059E                pop    ecx
.text:0001059F                cmc
.text:000105A0                xor    eax, eax
.text:000105A2                push edx
.text:000105A3                xor    ebx, ebx
.text:000105A5                pop    edx
.text:000105A6                popa
.text:000105A7                push [ebp+arg_0]
.text:000105AA                call KeAttachProcess
.text:000105AA
.text:000105B0                pusha
.text:000105B1                cmc
.text:000105B2                xor    eax, eax
.text:000105B4                push eax
.text:000105B5                xor    ebx, ebx
.text:000105B7                pop    eax
.text:000105B8                cmc
.text:000105B9                xor    edx, edx
.text:000105BB                push ebx
.text:000105BC                xor    eax, eax
.text:000105BE                pop    ebx
.text:000105BF                nop
.text:000105C0                xor    ebx, ebx
.text:000105C2                push ecx
.text:000105C3                xor    edx, edx
.text:000105C5                pop    ecx
.text:000105C6                cmc
.text:000105C7                xor    eax, eax
.text:000105C9                push edx
.text:000105CA                xor    ebx, ebx
.text:000105CC                pop    edx
.text:000105CD                popa
.text:000105CE                push 0             ; ExitStatus
.text:000105D0                push 0             ; ProcessHandle
.text:000105D2                call ZwTerminateProcess
.text:000105D2
.text:000105D8                pusha
.text:000105D9                cmc
.text:000105DA                xor    eax, eax
.text:000105DC                push eax
.text:000105DD                xor    ebx, ebx
.text:000105DF                pop    eax
.text:000105E0                cmc
.text:000105E1                xor    edx, edx
.text:000105E3                push ebx
.text:000105E4                xor    eax, eax
.text:000105E6                pop    ebx
.text:000105E7                nop
.text:000105E8                xor    ebx, ebx
.text:000105EA                push ecx
.text:000105EB                xor    edx, edx
.text:000105ED                pop    ecx
.text:000105EE                cmc
.text:000105EF                xor    eax, eax
.text:000105F1                push edx
.text:000105F2                xor    ebx, ebx
.text:000105F4                pop    edx
.text:000105F5                popa
.text:000105F6                call KeDetachProcess
.text:000105F6
.text:000105FC                pusha
.text:000105FD                cmc
.text:000105FE                xor    eax, eax
.text:00010600                push eax
.text:00010601                xor    ebx, ebx
.text:00010603                pop    eax
.text:00010604                cmc
.text:00010605                xor    edx, edx
.text:00010607                push ebx
.text:00010608                xor    eax, eax
.text:0001060A                pop    ebx
.text:0001060B                nop
.text:0001060C                xor    ebx, ebx
.text:0001060E                push ecx
.text:0001060F                xor    edx, edx
.text:00010611                pop    ecx
.text:00010612                cmc
.text:00010613                xor    eax, eax
.text:00010615                push edx
.text:00010616                xor    ebx, ebx
.text:00010618                pop    edx
.text:00010619                popa
.text:0001061A                push offset ProcessHandle
.text:0001061F                xor    eax, eax
.text:00010621                push eax
.text:00010622                push eax
.text:00010623                push eax
.text:00010624                push eax
.text:00010625                push eax
.text:00010626                push [ebp+arg_0]
.text:00010629                call ObOpenObjectByPointer
.text:00010629
.text:0001062F                pusha
.text:00010630                cmc
.text:00010631                xor    eax, eax
.text:00010633                push eax
.text:00010634                xor    ebx, ebx
.text:00010636                pop    eax
.text:00010637                cmc
.text:00010638                xor    edx, edx
.text:0001063A                push ebx
.text:0001063B                xor    eax, eax
.text:0001063D                pop    ebx
.text:0001063E                nop
.text:0001063F                xor    ebx, ebx
.text:00010641                push ecx
.text:00010642                xor    edx, edx
.text:00010644                pop    ecx
.text:00010645                cmc
.text:00010646                xor    eax, eax
.text:00010648                push edx
.text:00010649                xor    ebx, ebx
.text:0001064B                pop    edx
.text:0001064C                popa
.text:0001064D                push 0             ; ExitStatus
.text:0001064F                push ProcessHandle ; ProcessHandle
.text:00010655                call ZwTerminateProcess
.text:00010655
.text:0001065B                pusha
.text:0001065C                cmc
.text:0001065D                xor    eax, eax
.text:0001065F                push eax
.text:00010660                xor    ebx, ebx
.text:00010662                pop    eax
.text:00010663                cmc
.text:00010664                xor    edx, edx
.text:00010666                push ebx
.text:00010667                xor    eax, eax
.text:00010669                pop    ebx
.text:0001066A                nop
.text:0001066B                xor    ebx, ebx
.text:0001066D                push ecx
.text:0001066E                xor    edx, edx
.text:00010670                pop    ecx
.text:00010671                cmc
.text:00010672                xor    eax, eax
.text:00010674                push edx
.text:00010675                xor    ebx, ebx
.text:00010677                pop    edx
.text:00010678                popa
.text:00010679                push ProcessHandle ; Handle
.text:0001067F                call ZwClose
.text:0001067F
.text:00010685                jmp    short loc_1068E
.text:00010685
.text:00010687 ; ---------------------------------------------------------------------------
.text:00010687
.text:00010687 loc_10687:                            ; DATA XREF: .text:stru_102F0o
.text:00010687                xor    eax, eax
.text:00010689                inc    eax
.text:0001068A                retn
.text:0001068A
.text:0001068B ; ---------------------------------------------------------------------------
.text:0001068B
.text:0001068B loc_1068B:                            ; DATA XREF: .text:stru_102F0o
.text:0001068B                mov    esp, [ebp+ms_exc.old_esp]
.text:0001068B
.text:0001068E
.text:0001068E loc_1068E:                            ; CODE XREF: sub_1053E+147j
.text:0001068E                or    [ebp+ms_exc.disabled], 0FFFFFFFFh
.text:00010692                call __SEH_epilog
.text:00010692
.text:00010697                retn 4
.text:00010697
.text:00010697 sub_1053E    endp

2009-5-6 12:37

0

dayang

雪币： 220

活跃值： (786)

能力值：

( LV2，RANK：10 )

在线值：

发帖

38

回帖

938

粉丝

1

关注

私信

dayang: 4 楼

是一病毒里的

2009-5-6 14:15

0

riijj

雪币： 2319

活跃值： (565)

能力值： (RANK：300 )

在线值：

发帖

150

回帖

1307

粉丝

10

关注

私信

riijj 7: 5 楼

辛勤的从 KeAttachProcess 走进去, 就是为了ZwTerminateProcess

如果 ZwTerminateProcess 被 hook 便没有分别, 跟 exe 叫 TerminateProcess 没两样

更保险的方法估计是从 PsActiveProcessHead 慢慢找, 再杀掉

2009-5-6 14:32

0

轩辕小聪

雪币： 722

活跃值： (123)

能力值：

( LV12，RANK：300 )

在线值：

发帖

10

回帖

547

粉丝

5

关注

私信

轩辕小聪 7: 6 楼

.text:0001054E push offset dword_10534 ; 'ntdll.dll'

上面这个注释一补充，加上3楼贴的结果，就啥都清楚了。驱动接收由用户层传来的目标进程PID，调用PsLookupProcessByProcessId得到EPROCESS指针，之后主要用三种手法：
1.MmUnmapViewOfSection强行使该进程卸载ntdll.dll；
2.KeAttachProcess切换到该进程上下文，调用ZwTerminateProcess；
3.ObOpenObjectByPointer得到进程句柄，调用ZwTerminateProcess结束进程。

同意楼上的，ZwTerminateProcess被HOOK的话后两个方法就没啥作用了（只是不知道卡巴的HOOK有没有判断ZwTerminateProcess的第一个参数为0的情况）

这些都是大家都知道的手法了。

2009-5-6 14:37

0

riijj

雪币： 2319

活跃值： (565)

能力值： (RANK：300 )

在线值：

发帖

150

回帖

1307

粉丝

10

关注

私信

riijj 7: 7 楼

暴力的版本

把目标进程的内存都用 0xCC 填满

让它自己死掉

2009-5-6 14:51

0

dayang

雪币： 220

活跃值： (786)

能力值：

( LV2，RANK：10 )

在线值：

发帖

38

回帖

938

粉丝

1

关注

私信

dayang: 8 楼

NTSTATUS __stdcall sub_1053E(int a1)
{
  CPPEH_RECORD ms_exc; // [sp+Ch] [bp-18h]@1

  ms_exc.disabled = 0;
  dword_109E0 = (int)sub_103EC(dword_10534);
  MmUnmapViewOfSection(a1, dword_109E0);
  KeAttachProcess(a1);
  ZwTerminateProcess(0, 0);
  KeDetachProcess();
  ObOpenObjectByPointer(a1, 0, 0, 0, 0, 0, &ProcessHandle);
  ZwTerminateProcess(ProcessHandle, 0);
  return ZwClose(ProcessHandle);
}
f5得到的，呵呵
ntdll.dll的基址是怎么得到的呢？有人能逆出完整点的代码不？

2009-5-6 14:53

0

fixfix

雪币： 419

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

21

回帖

671

粉丝

0

关注

私信

fixfix: 9 楼

NTDLL.DLL 是这里

.text:000103EC ; int __stdcall sub_103EC(char *)
.text:000103EC sub_103EC    proc near             ; CODE XREF: sub_1053E+15p
.text:000103EC
.text:000103EC var_18       = dword ptr -18h
.text:000103EC var_14       = dword ptr -14h
.text:000103EC var_10       = dword ptr -10h
.text:000103EC var_C          = dword ptr -0Ch
.text:000103EC ReturnLength = dword ptr -8
.text:000103EC P             = dword ptr -4
.text:000103EC arg_0          = dword ptr  8
.text:000103EC
.text:000103EC                push ebp
.text:000103ED                mov    ebp, esp
.text:000103EF                sub    esp, 18h
.text:000103F2                and    [ebp+var_18], 0
.text:000103F6                and    [ebp+ReturnLength], 0
.text:000103FA                push ebx
.text:000103FB                push esi
.text:000103FC                lea    eax, [ebp+P]
.text:000103FF                push edi
.text:00010400                mov    [ebp+P], eax
.text:00010403                pusha
.text:00010404                cmc
.text:00010405                xor    eax, eax
.text:00010407                push eax
.text:00010408                xor    ebx, ebx
.text:0001040A                pop    eax
.text:0001040B                cmc
.text:0001040C                xor    edx, edx
.text:0001040E                push ebx
.text:0001040F                xor    eax, eax
.text:00010411                pop    ebx
.text:00010412                nop
.text:00010413                xor    ebx, ebx
.text:00010415                push ecx
.text:00010416                xor    edx, edx
.text:00010418                pop    ecx
.text:00010419                cmc
.text:0001041A                xor    eax, eax
.text:0001041C                push edx
.text:0001041D                xor    ebx, ebx
.text:0001041F                pop    edx
.text:00010420                popa
.text:00010421                mov    esi, ZwQuerySystemInformation
.text:00010427                lea    eax, [ebp+ReturnLength]
.text:0001042A                push eax          ; ReturnLength
.text:0001042B                push 0             ; SystemInformationLength
.text:0001042D                push [ebp+P]       ; SystemInformation
.text:00010430                push 0Bh          ; SystemInformationClass
.text:00010432                call esi ; ZwQuerySystemInformation
.text:00010432
.text:00010434                push 206B6444h    ; Tag
.text:00010439                push [ebp+ReturnLength] ; NumberOfBytes
.text:0001043C                push 0             ; PoolType
.text:0001043E                call ExAllocatePoolWithTag
.text:0001043E
.text:00010444                test eax, eax
.text:00010446                mov    [ebp+P], eax
.text:00010449                jz    loc_1052C
.text:00010449
.text:0001044F                lea    ecx, [ebp+ReturnLength]
.text:00010452                push ecx          ; ReturnLength
.text:00010453                push [ebp+ReturnLength] ; SystemInformationLength
.text:00010456                push eax          ; SystemInformation
.text:00010457                push 0Bh          ; SystemInformationClass
.text:00010459                call esi ; ZwQuerySystemInformation
.text:00010459
.text:0001045B                test eax, eax
.text:0001045D                jge    short loc_10466
.text:0001045D
.text:0001045F                xor    esi, esi
.text:00010461                jmp    loc_1051F
.text:00010461
.text:00010466 ; ---------------------------------------------------------------------------
.text:00010466
.text:00010466 loc_10466:                            ; CODE XREF: sub_103EC+71j
.text:00010466                pusha
.text:00010467                cmc
.text:00010468                xor    eax, eax
.text:0001046A                push eax
.text:0001046B                xor    ebx, ebx
.text:0001046D                pop    eax
.text:0001046E                cmc
.text:0001046F                xor    edx, edx
.text:00010471                push ebx
.text:00010472                xor    eax, eax
.text:00010474                pop    ebx
.text:00010475                nop
.text:00010476                xor    ebx, ebx
.text:00010478                push ecx
.text:00010479                xor    edx, edx
.text:0001047B                pop    ecx
.text:0001047C                cmc
.text:0001047D                xor    eax, eax
.text:0001047F                push edx
.text:00010480                xor    ebx, ebx
.text:00010482                pop    edx
.text:00010483                popa
.text:00010484                mov    eax, [ebp+P]
.text:00010487                and    [ebp+var_10], 0
.text:0001048B                cmp    dword ptr [eax], 0
.text:0001048E                lea    ecx, [eax+4]
.text:00010491                mov    [ebp+var_14], ecx
.text:00010494                jbe    loc_1051C
.text:00010494
.text:0001049A                add    ecx, 1Ch
.text:0001049D                mov    [ebp+var_C], ecx
.text:000104A0                mov    edi, 11Ch
.text:000104A0
.text:000104A5
.text:000104A5 loc_104A5:                            ; CODE XREF: sub_103EC+123j
.text:000104A5                mov    eax, [ebp+var_C]
.text:000104A8                lea    edx, [eax+1]
.text:000104A8
.text:000104AB
.text:000104AB loc_104AB:                            ; CODE XREF: sub_103EC+C4j
.text:000104AB                mov    cl, [eax]
.text:000104AD                inc    eax
.text:000104AE                test cl, cl
.text:000104B0                jnz    short loc_104AB
.text:000104B0
.text:000104B2                mov    ecx, [ebp+arg_0]
.text:000104B5                sub    eax, edx
.text:000104B7                lea    edx, [ecx+1]
.text:000104B7
.text:000104BA
.text:000104BA loc_104BA:                            ; CODE XREF: sub_103EC+D3j
.text:000104BA                mov    bl, [ecx]
.text:000104BC                inc    ecx
.text:000104BD                test bl, bl
.text:000104BF                jnz    short loc_104BA
.text:000104BF
.text:000104C1                sub    ecx, edx
.text:000104C3                cmp    eax, ecx
.text:000104C5                jb    short loc_104FE
.text:000104C5
.text:000104C7                mov    eax, [ebp+var_C]
.text:000104CA                lea    edx, [eax+1]
.text:000104CA
.text:000104CD
.text:000104CD loc_104CD:                            ; CODE XREF: sub_103EC+E6j
.text:000104CD                mov    cl, [eax]
.text:000104CF                inc    eax
.text:000104D0                test cl, cl
.text:000104D2                jnz    short loc_104CD
.text:000104D2
.text:000104D4                sub    eax, edx
.text:000104D6                mov    esi, eax
.text:000104D8                mov    eax, [ebp+arg_0]
.text:000104DB                lea    ecx, [eax+1]
.text:000104DB
.text:000104DE
.text:000104DE loc_104DE:                            ; CODE XREF: sub_103EC+F7j
.text:000104DE                mov    dl, [eax]
.text:000104E0                inc    eax
.text:000104E1                test dl, dl
.text:000104E3                jnz    short loc_104DE
.text:000104E3
.text:000104E5                push [ebp+arg_0]    ; char *
.text:000104E8                sub    eax, ecx
.text:000104EA                mov    ecx, [ebp+var_C]
.text:000104ED                sub    ecx, eax
.text:000104EF                add    ecx, esi
.text:000104F1                push ecx          ; char *
.text:000104F2                call _stricmp
.text:000104F2
.text:000104F8                test eax, eax
.text:000104FA                pop    ecx
.text:000104FB                pop    ecx
.text:000104FC                jz    short loc_10513
.text:000104FC
.text:000104FE
.text:000104FE loc_104FE:                            ; CODE XREF: sub_103EC+D9j
.text:000104FE                inc    [ebp+var_10]
.text:00010501                mov    eax, [ebp+P]
.text:00010504                mov    ecx, [ebp+var_10]
.text:00010507                add    [ebp+var_14], edi
.text:0001050A                add    [ebp+var_C], edi
.text:0001050D                cmp    ecx, [eax]
.text:0001050F                jb    short loc_104A5
.text:0001050F
.text:00010511                jmp    short loc_1051C
.text:00010511
.text:00010513 ; ---------------------------------------------------------------------------
.text:00010513
.text:00010513 loc_10513:                            ; CODE XREF: sub_103EC+110j
.text:00010513                mov    eax, [ebp+var_14]
.text:00010516                mov    eax, [eax+8]
.text:00010519                mov    [ebp+var_18], eax
.text:00010519
.text:0001051C
.text:0001051C loc_1051C:                            ; CODE XREF: sub_103EC+A8j
.text:0001051C                                        ; sub_103EC+125j
.text:0001051C                mov    esi, [ebp+var_18]
.text:0001051C
.text:0001051F
.text:0001051F loc_1051F:                            ; CODE XREF: sub_103EC+75j
.text:0001051F                push 0             ; Tag
.text:00010521                push [ebp+P]       ; P
.text:00010524                call ExFreePoolWithTag
.text:00010524
.text:0001052A                mov    eax, esi
.text:0001052A
.text:0001052C
.text:0001052C loc_1052C:                            ; CODE XREF: sub_103EC+5Dj
.text:0001052C                pop    edi
.text:0001052D                pop    esi
.text:0001052E                pop    ebx
.text:0001052F                leave
.text:00010530                retn 4
.text:00010530
.text:00010530 sub_103EC    endp

2009-5-6 15:37

0

frozenrain

雪币： 107

活跃值： (1758)

能力值：

( LV6，RANK：80 )

在线值：

发帖

26

回帖

509

粉丝

1

关注

私信

frozenrain: 10 楼

如果MmUnmapViewOfSection 也被HOOK掉了呢

2009-5-6 16:04

0

dayang

雪币： 220

活跃值： (786)

能力值：

( LV2，RANK：10 )

在线值：

发帖

38

回帖

938

粉丝

1

关注

私信

dayang: 11 楼

兄弟有C的吗？ASM看不懂，呵呵

2009-5-6 19:05

0

垃圾一个

雪币： 91

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

70

粉丝

0

关注

私信

垃圾一个: 12 楼

不好玩，什么时候的东西。

2009-5-6 19:06

0

垃圾一个

雪币： 91

活跃值： (10)

能力值：

( LV2，RANK：10 )

在线值：

发帖

0

回帖

70

粉丝

0

关注

私信

垃圾一个: 13 楼

我什么都没有说

2009-5-6 19:15

0

dayang

雪币： 220

活跃值： (786)

能力值：

( LV2，RANK：10 )

在线值：

发帖

38

回帖

938

粉丝

1

关注

私信

dayang: 14 楼

// Data declarations

extern const WCHAR SourceString[]; // idb
extern char dword_10534[]; // idb
extern HANDLE ProcessHandle; // idb
extern int dword_109DC; // weak
extern int dword_109E0; // weak
extern int dword_109E4; // weak

//-------------------------------------------------------------------------
// Function declarations

// void __stdcall IoDeleteDevice(PDEVICE_OBJECT DeviceObject); idb
// NTSTATUS __stdcall IoDeleteSymbolicLink(PUNICODE_STRING SymbolicLinkName); idb
// void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString); idb
// void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost); idb
// void __stdcall ExFreePoolWithTag(PVOID P, ULONG Tag); idb
// int __cdecl stricmp(const char *, const char *); idb
// PVOID __stdcall ExAllocatePoolWithTag(POOL_TYPE PoolType, SIZE_T NumberOfBytes, ULONG Tag); idb
// NTSTATUS __stdcall ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength); idb
// NTSTATUS __stdcall ZwClose(HANDLE Handle); idb
// int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak
// int KeDetachProcess(void); weak
// NTSTATUS __stdcall ZwTerminateProcess(HANDLE ProcessHandle, NTSTATUS ExitStatus); idb
// int __stdcall KeAttachProcess(_DWORD); weak
// int __stdcall PsLookupProcessByProcessId(_DWORD, _DWORD); weak
void __stdcall sub_1035A(int a1);
int __stdcall sub_103AC(int a1, int a2);
PVOID __stdcall sub_103EC(char *a1); // idb
NTSTATUS __stdcall sub_1053E(int a1);
signed int __stdcall sub_1069A(int a1, signed int a2);
int __stdcall start(PDRIVER_OBJECT DriverObject, int); // idb
// int __stdcall MmUnmapViewOfSection(_DWORD, _DWORD); weak

//----- (0001035A) --------------------------------------------------------
void __stdcall sub_1035A(int a1)
{
  UNICODE_STRING DestinationString; // [sp+Ch] [bp-8h]@1

  RtlInitUnicodeString(&DestinationString, L"\\??\\KILLPS_Drv");
  IoDeleteSymbolicLink(&DestinationString);
  IoDeleteDevice(*(PDEVICE_OBJECT *)(a1 + 4));
}

//----- (000103AC) --------------------------------------------------------
int __stdcall sub_103AC(int a1, int a2)
{
  *(_DWORD *)(a2 + 24) = 0;
  *(_DWORD *)(a2 + 28) = 0;
  IofCompleteRequest((PIRP)a2, 0);
  return 0;
}

//----- (000103EC) --------------------------------------------------------
PVOID __stdcall sub_103EC(char *a1)
{
  PVOID result; // eax@1
  void *v2; // esi@3
  char v3; // zf@4
  void *v4; // [sp+Ch] [bp-18h]@1
  ULONG ReturnLength; // [sp+1Ch] [bp-8h]@1
  PVOID P; // [sp+20h] [bp-4h]@1
  unsigned int v7; // [sp+14h] [bp-10h]@4
  char *v8; // [sp+10h] [bp-14h]@4
  const char *v9; // [sp+18h] [bp-Ch]@5

  v4 = 0;
  ReturnLength = 0;
  P = &P;
  ZwQuerySystemInformation(SystemModuleInformation, &P, 0, &ReturnLength);
  result = ExAllocatePoolWithTag(0, ReturnLength, 0x206B6444u);
  P = result;
  if ( result )
  {
if ( ZwQuerySystemInformation(SystemModuleInformation, result, ReturnLength, &ReturnLength) >= 0 )
{
   v7 = 0;
   v3 = *(_DWORD *)P == 0;
   v8 = (char *)P + 4;
   if ( !v3 )
   {
      v9 = (char *)P + 32;
      while ( strlen(v9) < strlen(a1) || stricmp(v9, a1) )
      {
      ++v7;
      v8 += 284;
      v9 += 284;
      if ( v7 >= *(_DWORD *)P )
         goto LABEL_11;
      }
      v4 = (void *)*((_DWORD *)v8 + 2);
   }
LABEL_11:
   v2 = v4;
}
else
{
   v2 = 0;
}
ExFreePoolWithTag(P, 0);
result = v2;
  }
  return result;
}

//----- (0001053E) --------------------------------------------------------
NTSTATUS __stdcall sub_1053E(int a1)
{
  CPPEH_RECORD ms_exc; // [sp+Ch] [bp-18h]@1

  ms_exc.disabled = 0;
  dword_109E0 = (int)sub_103EC(dword_10534);
  MmUnmapViewOfSection(a1, dword_109E0);
  KeAttachProcess(a1);
  ZwTerminateProcess(0, 0);
  KeDetachProcess();
  ObOpenObjectByPointer(a1, 0, 0, 0, 0, 0, &ProcessHandle);
  ZwTerminateProcess(ProcessHandle, 0);
  return ZwClose(ProcessHandle);
}

//----- (0001069A) --------------------------------------------------------
signed int __stdcall sub_1069A(int a1, signed int a2)
{
  signed int v2; // ebp@1
  int v4; // eax@1
  signed int v5; // ecx@1
  int v6; // eax@1
  int v7; // ST1C_4@2
  signed int v8; // [sp+10h] [bp-Ch]@1
  int *v9; // [sp+14h] [bp-8h]@1
  int v10; // [sp+18h] [bp-4h]@1

  v8 = -1073741808;
  v2 = a2;
  v4 = *(_DWORD *)(a2 + 96);
  v5 = *(_DWORD *)(v4 + 12);
  v6 = *(_DWORD *)(v4 + 4);
  a2 = v5;
  v9 = *(int **)(v2 + 12);
  v10 = v6;
  if ( v5 == 2236420 )
  {
v7 = *v9;
dword_109DC = *v9;
PsLookupProcessByProcessId(v7, &dword_109E4);
sub_1053E(dword_109E4);
v8 = 0;
*(_DWORD *)(v2 + 28) = v10;
  }
  else
  {
*(_DWORD *)(v2 + 28) = 0;
  }
  *(_DWORD *)(v2 + 24) = v8;
  IofCompleteRequest((PIRP)v2, 0);
  return v8;
}

F5

2009-5-6 21:45

0