mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
@@ -0,0 +1,477 @@
|
||||
Project Path: arc_ExpLife0011_HideDriver_wnpipc1u
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_ExpLife0011_HideDriver_wnpipc1u
|
||||
├── HideDriver
|
||||
│ ├── MyDriver1
|
||||
│ │ ├── MyDriver1.vcxproj
|
||||
│ │ ├── MyDriver1.vcxproj.filters
|
||||
│ │ ├── m.h
|
||||
│ │ └── x.c
|
||||
│ └── MyDriver1.sln
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`HideDriver/MyDriver1.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio 2013
|
||||
VisualStudioVersion = 12.0.40629.0
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MyDriver1", "MyDriver1\MyDriver1.vcxproj", "{0B2022AF-0368-41C8-AA08-3C109807CADB}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|ARM.Deploy.0 = Debug|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|ARM64.ActiveCfg = Debug|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x64.Build.0 = Debug|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x86.Build.0 = Debug|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Debug|x86.Deploy.0 = Debug|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|ARM.Build.0 = Release|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|ARM.Deploy.0 = Release|ARM
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|ARM64.ActiveCfg = Release|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x64.ActiveCfg = Release|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x64.Build.0 = Release|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x64.Deploy.0 = Release|x64
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x86.ActiveCfg = Release|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x86.Build.0 = Release|Win32
|
||||
{0B2022AF-0368-41C8-AA08-3C109807CADB}.Release|x86.Deploy.0 = Release|Win32
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`HideDriver/MyDriver1/MyDriver1.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{0B2022AF-0368-41C8-AA08-3C109807CADB}</ProjectGuid>
|
||||
<TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>MyDriver1</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows7</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>WDM</DriverType>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="x.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="m.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`HideDriver/MyDriver1/MyDriver1.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="x.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="m.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`HideDriver/MyDriver1/m.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
|
||||
#include <ntddk.h>
|
||||
|
||||
#define SystemModuleInformation 11
|
||||
|
||||
typedef NTSTATUS(__fastcall *MiProcessLoaderEntry)(PVOID pDriverSection, int bLoad);
|
||||
|
||||
typedef NTSTATUS(*NTQUERYSYSTEMINFORMATION)(
|
||||
IN ULONG SystemInformationClass,
|
||||
OUT PVOID SystemInformation,
|
||||
IN ULONG_PTR SystemInformationLength,
|
||||
OUT PULONG_PTR ReturnLength OPTIONAL);
|
||||
|
||||
typedef struct _SYSTEM_MODULE_INFORMATION{
|
||||
HANDLE Section;
|
||||
PVOID MappedBase;
|
||||
PVOID Base;
|
||||
ULONG Size;
|
||||
ULONG Flags;
|
||||
USHORT LoadOrderIndex;
|
||||
USHORT InitOrderIndex;
|
||||
USHORT LoadCount;
|
||||
USHORT PathLength;
|
||||
CHAR ImageName[256];
|
||||
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegString);
|
||||
VOID Unload(PDRIVER_OBJECT DriverObject);
|
||||
ULONG_PTR Get_MiProcessLoaderEntry();
|
||||
VOID _fastcall HideDriver(PVOID x);
|
||||
ULONG JudgeLoadDriver();
|
||||
```
|
||||
|
||||
`HideDriver/MyDriver1/x.c`:
|
||||
|
||||
```c
|
||||
#include "m.h"
|
||||
|
||||
ULONG_PTR Get_MiProcessLoaderEntry()
|
||||
{
|
||||
UNICODE_STRING EtwWriteStringName;
|
||||
ULONG_PTR EtwWriteStringAddress;
|
||||
PHYSICAL_ADDRESS pAddress;
|
||||
ULONG_PTR EndAddress;
|
||||
UCHAR *p;
|
||||
ULONG i;
|
||||
|
||||
RtlInitUnicodeString(&EtwWriteStringName, L"EtwWriteString");
|
||||
EtwWriteStringAddress = (ULONG_PTR)MmGetSystemRoutineAddress(&EtwWriteStringName);
|
||||
DbgBreakPoint();
|
||||
EndAddress = EtwWriteStringAddress - 0x6000;
|
||||
char temp_code[] = "\x48\x89\x5C\x24\x08\x48\x89\x6C\x24\x18"
|
||||
"\x48\x89\x74\x24\x20\x57\x41\x54\x41\x55"
|
||||
"\x41\x56\x41\x57";
|
||||
for (auto i = 0; i < 0x6000; i++)
|
||||
{
|
||||
if (memcmp((char*)EndAddress + i, temp_code, 24) == 0)
|
||||
{
|
||||
return EndAddress + i;
|
||||
}
|
||||
}
|
||||
KdPrint(("not found\n"));
|
||||
return 0;
|
||||
}
|
||||
|
||||
//判断当前Driver是否加载成功
|
||||
ULONG JudgeLoadDriver()
|
||||
{
|
||||
NTQUERYSYSTEMINFORMATION m_NtQuerySystemInformation = NULL;
|
||||
UNICODE_STRING NtQuerySystemInformation_Name;
|
||||
PSYSTEM_MODULE_INFORMATION ModuleEntry;
|
||||
ULONG_PTR RetLength,BaseAddr,EndAddr;
|
||||
ULONG ModuleNumbers, Index;
|
||||
NTSTATUS Status;
|
||||
PVOID Buffer;
|
||||
|
||||
RtlInitUnicodeString(&NtQuerySystemInformation_Name, L"NtQuerySystemInformation");
|
||||
m_NtQuerySystemInformation = (NTQUERYSYSTEMINFORMATION)MmGetSystemRoutineAddress(&NtQuerySystemInformation_Name);
|
||||
if (m_NtQuerySystemInformation == NULL)
|
||||
{
|
||||
KdPrint(("获取NtQuerySystemInformation函数失败！\n"));
|
||||
return 1;
|
||||
}
|
||||
|
||||
RetLength = 0;
|
||||
Status = m_NtQuerySystemInformation(SystemModuleInformation, NULL, 0, &RetLength);
|
||||
if (Status < 0 && Status != STATUS_INFO_LENGTH_MISMATCH)
|
||||
{
|
||||
KdPrint(("NtQuerySystemInformation调用失败！错误码是：%x\n", Status));
|
||||
return 1;
|
||||
}
|
||||
|
||||
Buffer = ExAllocatePoolWithTag(NonPagedPool, RetLength, 'ytz');
|
||||
if (Buffer == NULL)
|
||||
{
|
||||
KdPrint(("分配内存失败！\n"));
|
||||
return 1;
|
||||
}
|
||||
|
||||
Status = m_NtQuerySystemInformation(SystemModuleInformation, Buffer, RetLength, &RetLength);
|
||||
if (Status < 0)
|
||||
{
|
||||
KdPrint(("NtQuerySystemInformation调用失败！错误码是：%x\n", Status));
|
||||
return 1;
|
||||
}
|
||||
|
||||
ModuleNumbers = *(ULONG*)Buffer;
|
||||
ModuleEntry = (PSYSTEM_MODULE_INFORMATION)((ULONG_PTR)Buffer + 8);
|
||||
for (Index = 0; Index < ModuleNumbers; ++Index)
|
||||
{
|
||||
BaseAddr = (ULONG_PTR)ModuleEntry->Base;
|
||||
EndAddr = BaseAddr + ModuleEntry->Size;
|
||||
if (BaseAddr <= (ULONG_PTR)JudgeLoadDriver && (ULONG_PTR)JudgeLoadDriver <= EndAddr)
|
||||
{
|
||||
KdPrint(("模块名称是：%s\n", ModuleEntry->ImageName));
|
||||
return 2;
|
||||
}
|
||||
++ModuleEntry;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
VOID Unload(PDRIVER_OBJECT DriverObject)
|
||||
{
|
||||
KdPrint(("Unload Success!\n"));
|
||||
}
|
||||
|
||||
VOID _fastcall HideDriver(PVOID x)
|
||||
{
|
||||
MiProcessLoaderEntry m_MiProcessLoaderEntry = NULL;
|
||||
PDRIVER_OBJECT DriverObject;
|
||||
LARGE_INTEGER SleepTime;
|
||||
ULONG RetValue;
|
||||
|
||||
m_MiProcessLoaderEntry = (MiProcessLoaderEntry)Get_MiProcessLoaderEntry();
|
||||
if (m_MiProcessLoaderEntry == NULL)
|
||||
{
|
||||
PsTerminateSystemThread(STATUS_SUCCESS);
|
||||
return;
|
||||
}
|
||||
|
||||
SleepTime.QuadPart = -100 * 1000 * 1000 * 10; //找不到则休眠10毫秒
|
||||
|
||||
//如果是1说明内部调用函数出错，现在只可能是0没找到，2找到了
|
||||
while (TRUE)
|
||||
{
|
||||
RetValue = JudgeLoadDriver();
|
||||
if (RetValue == 1)
|
||||
{
|
||||
PsTerminateSystemThread(STATUS_SUCCESS);
|
||||
return;
|
||||
}
|
||||
else if (RetValue == 2)
|
||||
break;
|
||||
else
|
||||
KeDelayExecutionThread(KernelMode, 0, &SleepTime);
|
||||
}
|
||||
|
||||
DriverObject = (PDRIVER_OBJECT)x;
|
||||
|
||||
m_MiProcessLoaderEntry(DriverObject->DriverSection, 0);
|
||||
DriverObject->DriverSection = NULL;
|
||||
DriverObject->DriverStart = NULL;
|
||||
DriverObject->DriverSize = NULL;
|
||||
DriverObject->DriverUnload = NULL;
|
||||
DriverObject->DriverInit = NULL;
|
||||
DriverObject->DeviceObject = NULL;
|
||||
|
||||
JudgeLoadDriver();
|
||||
|
||||
//PsTerminateSystemThread(STATUS_SUCCESS);
|
||||
}
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegString)
|
||||
{
|
||||
HANDLE hThread;
|
||||
|
||||
PsCreateSystemThread(&hThread, 0, NULL, NULL, NULL, HideDriver, (PVOID)DriverObject);
|
||||
ZwClose(hThread);
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# HideDriver
|
||||
Hide Driver，win7*64
|
||||
- 先通过EtwWriteString找MiProcessLoaderEntry函数
|
||||
(first using EtwWriteString find for MiProcessLoaderEntry funciton)
|
||||
- 用MiProcessLoaderEntry移除DriverObject->DriverSection（直接断链会遭遇PG）
|
||||
(use MiProcessLoaderEntry remove DriverObject->DriverSection dont straight set DriverObject->DriverSection. u got be BSOD 109)
|
||||
- 然后抹去Driver特征，有个问题，不能在DriverEntry中抹除驱动特征，所以开了个线程，当发现驱动加载完毕的时候就去抹除特征。
|
||||
(remove driver information)
|
||||
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,845 @@
|
||||
Project Path: arc_Sentient111_ClearDriverTraces_tcguaml8
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_Sentient111_ClearDriverTraces_tcguaml8
|
||||
├── ClearDriverTraces
|
||||
│ ├── Cleaning.h
|
||||
│ ├── Main.cpp
|
||||
│ ├── Mapper.inf
|
||||
│ ├── Mapper.sln
|
||||
│ ├── Mapper.vcxproj
|
||||
│ ├── Mapper.vcxproj.filters
|
||||
│ └── Misc.h
|
||||
└── README.md
|
||||
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Cleaning.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
#include "Misc.h"
|
||||
|
||||
//21h1, you can get these from ida
|
||||
ULONG PiDDBCacheTableOffset = 0xD2F000;
|
||||
ULONG PiDDBLockOffset = 0xC44940;
|
||||
|
||||
ULONG g_KernelHashBucketListOffset = 0xBC080;
|
||||
ULONG g_HashCacheLockOffset = 0x37F20;
|
||||
|
||||
ULONG g_CiEaCacheLookasideListOffset = 0x38400;
|
||||
|
||||
#pragma region MmUnloadedDrivers
|
||||
|
||||
typedef struct _KLDR_DATA_TABLE_ENTRY {
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
PVOID ExceptionTable;
|
||||
ULONG ExceptionTableSize;
|
||||
PVOID GpValue;
|
||||
PVOID NonPagedDebugInfo;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
USHORT LoadCount;
|
||||
USHORT __Unused;
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
PVOID LoadedImports;
|
||||
PVOID PatchInformation;
|
||||
} KLDR_DATA_TABLE_ENTRY, * PKLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
void RemoveMmUnloadedDrivers(PDRIVER_OBJECT driverObject)
|
||||
{
|
||||
reinterpret_cast<PKLDR_DATA_TABLE_ENTRY>(driverObject->DriverSection)->BaseDllName.Length = 0; // mm unloaded drivers entry is not created if base dll name is 0
|
||||
}
|
||||
|
||||
#pragma endregion
|
||||
|
||||
#pragma region PiDDBCacheTable
|
||||
|
||||
typedef struct PiDDBCacheEntry
|
||||
{
|
||||
LIST_ENTRY list;
|
||||
UNICODE_STRING driverName;
|
||||
ULONG driverStamp;
|
||||
NTSTATUS loadStatus;
|
||||
};
|
||||
|
||||
NTSTATUS RemovePiDDBCacheTableEntry(PDRIVER_OBJECT driverObject)
|
||||
{
|
||||
//get table and lock addresses
|
||||
ULONG64 kernelBase = (ULONG64)GetKernelBase(NULL);
|
||||
PRTL_AVL_TABLE PiDDBCacheTable = PRTL_AVL_TABLE(kernelBase + PiDDBCacheTableOffset);
|
||||
PERESOURCE PiDDBLock = PERESOURCE(kernelBase + PiDDBLockOffset);
|
||||
|
||||
//create lookup entry
|
||||
PiDDBCacheEntry lookupEntry;
|
||||
RtlInitUnicodeString(&lookupEntry.driverName, PKLDR_DATA_TABLE_ENTRY(driverObject->DriverSection)->BaseDllName.Buffer);
|
||||
|
||||
//get spinlock
|
||||
if (!ExAcquireResourceExclusiveLite(PiDDBLock, true))
|
||||
{
|
||||
Print("could not aquire PiDDB spinlock\n");
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
//look for entry
|
||||
PiDDBCacheEntry* foundEntry = (PiDDBCacheEntry*)(RtlLookupElementGenericTableAvl(PiDDBCacheTable, &lookupEntry));
|
||||
|
||||
|
||||
if (!foundEntry)
|
||||
{
|
||||
Print("could not find PiDDB entry\n");
|
||||
ExReleaseResourceLite(PiDDBLock);
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
//get prev and next list entries to remove our entry from list
|
||||
PLIST_ENTRY nextEntry = foundEntry->list.Flink;
|
||||
PLIST_ENTRY prevEntry = foundEntry->list.Blink;
|
||||
|
||||
if (!nextEntry || !prevEntry)
|
||||
{
|
||||
Print("could not find PiDDB list links\n");
|
||||
ExReleaseResourceLite(PiDDBLock);
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
//replace links
|
||||
prevEntry->Flink = foundEntry->list.Flink;
|
||||
nextEntry->Blink = foundEntry->list.Blink;
|
||||
|
||||
foundEntry->list.Blink = prevEntry;
|
||||
foundEntry->list.Flink = nextEntry;
|
||||
|
||||
|
||||
//clean entry
|
||||
WriteRandom((ULONG64)foundEntry->driverName.Buffer, foundEntry->driverName.Length);
|
||||
foundEntry->driverStamp = RandomNumber() % sizeof(ULONG);
|
||||
WriteRandom((ULONG64)&foundEntry->list, sizeof(LIST_ENTRY));
|
||||
foundEntry->loadStatus = RandomNumber() % sizeof(NTSTATUS);
|
||||
RtlDeleteElementGenericTableAvl(PiDDBCacheTable, foundEntry);
|
||||
|
||||
//check if entry can still be found
|
||||
foundEntry = (PiDDBCacheEntry*)(RtlLookupElementGenericTableAvl(PiDDBCacheTable, &lookupEntry));
|
||||
|
||||
if (foundEntry)
|
||||
{
|
||||
Print("could not delete PiDDB entry\n");
|
||||
ExReleaseResourceLite(PiDDBLock);
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
Print("cleaned PiDDB entry\n");
|
||||
ExReleaseResourceLite(PiDDBLock);
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
#pragma endregion
|
||||
|
||||
#pragma region HashBucketList
|
||||
|
||||
typedef struct _HashBucketEntry
|
||||
{
|
||||
struct _HashBucketEntry* Next;
|
||||
UNICODE_STRING DriverName;
|
||||
ULONG CertHash[5];
|
||||
} HashBucketEntry;
|
||||
|
||||
NTSTATUS RemoveKernelHashBucketListEntry(PDRIVER_OBJECT driverObject)
|
||||
{
|
||||
UINT64 cidllBase = GetKernelModuleBase("CI.dll");
|
||||
if (!cidllBase)
|
||||
{
|
||||
Print("failed to get ci base\n");
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
PSINGLE_LIST_ENTRY g_KernelHashBucketList = PSINGLE_LIST_ENTRY(cidllBase + g_KernelHashBucketListOffset);
|
||||
PERESOURCE g_HashCacheLock = PERESOURCE(cidllBase + g_HashCacheLockOffset);
|
||||
|
||||
UNICODE_STRING driverName;
|
||||
RtlInitUnicodeString(&driverName, PKLDR_DATA_TABLE_ENTRY(driverObject->DriverSection)->FullDllName.Buffer + 6); //remove \??\C:
|
||||
|
||||
if (!ExAcquireResourceExclusiveLite(g_HashCacheLock, true))
|
||||
{
|
||||
Print("could not get hash bucket list spinlock\n");
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
HashBucketEntry* currEntry = (HashBucketEntry*)g_KernelHashBucketList->Next;
|
||||
HashBucketEntry* prevEntry = (HashBucketEntry*)g_KernelHashBucketList;
|
||||
|
||||
while (currEntry)
|
||||
{
|
||||
if (!RtlCompareUnicodeString(&driverName, &currEntry->DriverName, true))
|
||||
{
|
||||
//unlink
|
||||
prevEntry->Next = currEntry->Next;
|
||||
|
||||
//overwrite
|
||||
currEntry->Next = (HashBucketEntry*)(RandomNumber() % sizeof(PVOID));
|
||||
WriteRandom((UINT64)&currEntry->CertHash, sizeof(currEntry->CertHash));
|
||||
WriteRandom((ULONG64)currEntry->DriverName.Buffer, currEntry->DriverName.Length);
|
||||
|
||||
//free
|
||||
ExFreePoolWithTag(currEntry, 0);
|
||||
break;
|
||||
}
|
||||
|
||||
prevEntry = currEntry;
|
||||
currEntry = currEntry->Next;
|
||||
}
|
||||
|
||||
currEntry = (HashBucketEntry*)g_KernelHashBucketList->Next;
|
||||
while (currEntry)
|
||||
{
|
||||
if (!RtlCompareUnicodeString(&driverName, &currEntry->DriverName, true))
|
||||
{
|
||||
Print("failed to clear hasbucketList\n");
|
||||
ExReleaseResourceLite(g_HashCacheLock);
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
currEntry = currEntry->Next;
|
||||
}
|
||||
|
||||
Print("cleared hashbucketList\n");
|
||||
ExReleaseResourceLite(g_HashCacheLock);
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
#pragma endregion
|
||||
|
||||
#pragma region LookasideList
|
||||
|
||||
NTSTATUS DeleteCiEaCacheLookasideList()
|
||||
{
|
||||
UINT64 cidllBase = GetKernelModuleBase("CI.dll");
|
||||
if (!cidllBase)
|
||||
{
|
||||
Print("failed to get ci base\n");
|
||||
return STATUS_UNSUCCESSFUL;
|
||||
}
|
||||
|
||||
|
||||
PLOOKASIDE_LIST_EX g_CiEaCacheLookasideList = (PLOOKASIDE_LIST_EX)(cidllBase + g_CiEaCacheLookasideListOffset);
|
||||
ULONG size = g_CiEaCacheLookasideList->L.Size;
|
||||
ExDeleteLookasideListEx(g_CiEaCacheLookasideList);
|
||||
ExInitializeLookasideListEx(g_CiEaCacheLookasideList, NULL, NULL, PagedPool, 0, size, 'csIC', 0);
|
||||
}
|
||||
|
||||
#pragma endregion
|
||||
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Main.cpp`:
|
||||
|
||||
```cpp
|
||||
#include "Cleaning.h"
|
||||
|
||||
void MyUnload(PDRIVER_OBJECT driverObject)
|
||||
{
|
||||
Print("[s11] unloading mapper\n");
|
||||
}
|
||||
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT driverObject, PUNICODE_STRING RegistryPath)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(RegistryPath);
|
||||
driverObject->DriverUnload = MyUnload;
|
||||
|
||||
NTSTATUS status = STATUS_SUCCESS;
|
||||
RemoveMmUnloadedDrivers(driverObject);
|
||||
|
||||
status = RemovePiDDBCacheTableEntry(driverObject);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
Print("failed to clear piddb cache %x\n", status);
|
||||
return status;
|
||||
}
|
||||
|
||||
status = RemoveKernelHashBucketListEntry(driverObject);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
Print("failed to clear hashbucket list cache %x\n", status);
|
||||
return status;
|
||||
}
|
||||
|
||||
status = DeleteCiEaCacheLookasideList();
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
Print("failed to delete lookaside list %x\n", status);
|
||||
return status;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Mapper.inf`:
|
||||
|
||||
```inf
|
||||
;
|
||||
; Mapper.inf
|
||||
;
|
||||
|
||||
[Version]
|
||||
Signature="$WINDOWS NT$"
|
||||
Class=Sample ; TODO: edit Class
|
||||
ClassGuid={78A1C341-4539-11d3-B88D-00C04FAD5171} ; TODO: edit ClassGuid
|
||||
Provider=%ManufacturerName%
|
||||
CatalogFile=Mapper.cat
|
||||
DriverVer= ; TODO: set DriverVer in stampinf property pages
|
||||
PnpLockDown=1
|
||||
|
||||
[DestinationDirs]
|
||||
DefaultDestDir = 12
|
||||
Mapper_Device_CoInstaller_CopyFiles = 11
|
||||
|
||||
; ================= Class section =====================
|
||||
|
||||
[ClassInstall32]
|
||||
Addreg=SampleClassReg
|
||||
|
||||
[SampleClassReg]
|
||||
HKR,,,0,%ClassName%
|
||||
HKR,,Icon,,-5
|
||||
|
||||
[SourceDisksNames]
|
||||
1 = %DiskName%,,,""
|
||||
|
||||
[SourceDisksFiles]
|
||||
Mapper.sys = 1,,
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames
|
||||
|
||||
;*****************************************
|
||||
; Install Section
|
||||
;*****************************************
|
||||
|
||||
[Manufacturer]
|
||||
%ManufacturerName%=Standard,NT$ARCH$
|
||||
|
||||
[Standard.NT$ARCH$]
|
||||
%Mapper.DeviceDesc%=Mapper_Device, Root\Mapper ; TODO: edit hw-id
|
||||
|
||||
[Mapper_Device.NT]
|
||||
CopyFiles=Drivers_Dir
|
||||
|
||||
[Drivers_Dir]
|
||||
Mapper.sys
|
||||
|
||||
;-------------- Service installation
|
||||
[Mapper_Device.NT.Services]
|
||||
AddService = Mapper,%SPSVCINST_ASSOCSERVICE%, Mapper_Service_Inst
|
||||
|
||||
; -------------- Mapper driver install sections
|
||||
[Mapper_Service_Inst]
|
||||
DisplayName = %Mapper.SVCDESC%
|
||||
ServiceType = 1 ; SERVICE_KERNEL_DRIVER
|
||||
StartType = 3 ; SERVICE_DEMAND_START
|
||||
ErrorControl = 1 ; SERVICE_ERROR_NORMAL
|
||||
ServiceBinary = %12%\Mapper.sys
|
||||
|
||||
;
|
||||
;--- Mapper_Device Coinstaller installation ------
|
||||
;
|
||||
|
||||
[Mapper_Device.NT.CoInstallers]
|
||||
AddReg=Mapper_Device_CoInstaller_AddReg
|
||||
CopyFiles=Mapper_Device_CoInstaller_CopyFiles
|
||||
|
||||
[Mapper_Device_CoInstaller_AddReg]
|
||||
HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller"
|
||||
|
||||
[Mapper_Device_CoInstaller_CopyFiles]
|
||||
WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll
|
||||
|
||||
[Mapper_Device.NT.Wdf]
|
||||
KmdfService = Mapper, Mapper_wdfsect
|
||||
[Mapper_wdfsect]
|
||||
KmdfLibraryVersion = $KMDFVERSION$
|
||||
|
||||
[Strings]
|
||||
SPSVCINST_ASSOCSERVICE= 0x00000002
|
||||
ManufacturerName="<Your manufacturer name>" ;TODO: Replace with your manufacturer name
|
||||
ClassName="Samples" ; TODO: edit ClassName
|
||||
DiskName = "Mapper Installation Disk"
|
||||
Mapper.DeviceDesc = "Mapper Device"
|
||||
Mapper.SVCDESC = "Mapper Service"
|
||||
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Mapper.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 16
|
||||
VisualStudioVersion = 16.0.31624.102
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Mapper", "Mapper.vcxproj", "{EB6C9087-A8AA-4160-9E90-8A8864CC8806}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM = Debug|ARM
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Debug|x86 = Debug|x86
|
||||
Release|ARM = Release|ARM
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
Release|x86 = Release|x86
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM.ActiveCfg = Debug|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM.Build.0 = Debug|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM.Deploy.0 = Debug|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x64.Build.0 = Debug|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x86.ActiveCfg = Debug|Win32
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x86.Build.0 = Debug|Win32
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Debug|x86.Deploy.0 = Debug|Win32
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM.ActiveCfg = Release|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM.Build.0 = Release|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM.Deploy.0 = Release|ARM
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x64.ActiveCfg = Release|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x64.Build.0 = Release|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x64.Deploy.0 = Release|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x86.ActiveCfg = Release|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x86.Build.0 = Release|x64
|
||||
{EB6C9087-A8AA-4160-9E90-8A8864CC8806}.Release|x86.Deploy.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {F7A011C2-B9ED-4AD4-8D29-BFF8831D6A76}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Mapper.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|Win32">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|Win32">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>Win32</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{EB6C9087-A8AA-4160-9E90-8A8864CC8806}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
|
||||
<RootNamespace>Mapper</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<ALLOW_DATE_TIME>1</ALLOW_DATE_TIME>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<ALLOW_DATE_TIME>1</ALLOW_DATE_TIME>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
<EnableInf2cat>false</EnableInf2cat>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
<LanguageStandard>stdcpp20</LanguageStandard>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
<ClCompile>
|
||||
<TreatWarningAsError>false</TreatWarningAsError>
|
||||
<LanguageStandard>stdcpp20</LanguageStandard>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
|
||||
<ClCompile>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
|
||||
<ClCompile>
|
||||
<LanguageStandard>stdcpp17</LanguageStandard>
|
||||
</ClCompile>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="Mapper.inf" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Main.cpp" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Cleaning.h" />
|
||||
<ClInclude Include="Misc.h" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Mapper.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Inf Include="Mapper.inf">
|
||||
<Filter>Driver Files</Filter>
|
||||
</Inf>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="Main.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="Misc.h">
|
||||
<Filter>Driver Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="Cleaning.h">
|
||||
<Filter>Driver Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`ClearDriverTraces/Misc.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
#include <Ntifs.h>
|
||||
#include <ntimage.h>
|
||||
|
||||
#define Print(fmt, ...) DbgPrint("[s11]: " fmt, ##__VA_ARGS__)
|
||||
|
||||
PVOID GetKernelBase(ULONG* Size)
|
||||
{
|
||||
typedef unsigned char uint8_t;
|
||||
auto Idt_base = reinterpret_cast<uintptr_t>(KeGetPcr()->IdtBase);
|
||||
auto align_page = *reinterpret_cast<uintptr_t*>(Idt_base + 4) >> 0xc << 0xc;
|
||||
|
||||
for (; align_page; align_page -= PAGE_SIZE)
|
||||
{
|
||||
for (int index = 0; index < PAGE_SIZE - 0x7; index++)
|
||||
{
|
||||
auto current_address = static_cast<intptr_t>(align_page) + index;
|
||||
|
||||
if (*reinterpret_cast<uint8_t*>(current_address) == 0x48
|
||||
&& *reinterpret_cast<uint8_t*>(current_address + 1) == 0x8D
|
||||
&& *reinterpret_cast<uint8_t*>(current_address + 2) == 0x1D
|
||||
&& *reinterpret_cast<uint8_t*>(current_address + 6) == 0xFF) //48 8d 1D ?? ?? ?? FF
|
||||
{
|
||||
auto nto_base_offset = *reinterpret_cast<int*>(current_address + 3);
|
||||
auto nto_base_ = (current_address + nto_base_offset + 7);
|
||||
if (!(nto_base_ & 0xfff))
|
||||
{
|
||||
if (Size)
|
||||
*Size = reinterpret_cast<IMAGE_NT_HEADERS64*>(nto_base_ + reinterpret_cast<IMAGE_DOS_HEADER*>(nto_base_)->e_lfanew)->OptionalHeader.SizeOfImage;
|
||||
|
||||
return (PVOID)nto_base_;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
inline ULONG RandomNumber()
|
||||
{
|
||||
ULONG64 tickCount;
|
||||
KeQueryTickCount(&tickCount);
|
||||
return RtlRandomEx((PULONG)&tickCount);
|
||||
}
|
||||
|
||||
void WriteRandom(ULONG64 addr, ULONG size)
|
||||
{
|
||||
for (size_t i = 0; i < size; i++)
|
||||
{
|
||||
*(char*)(addr + i) = RandomNumber() % 255;
|
||||
}
|
||||
}
|
||||
|
||||
//zwquerysysteminformation
|
||||
typedef enum _SYSTEM_INFORMATION_CLASS
|
||||
{
|
||||
SystemBasicInformation,
|
||||
SystemProcessorInformation,
|
||||
SystemPerformanceInformation,
|
||||
SystemTimeOfDayInformation,
|
||||
SystemPathInformation,
|
||||
SystemProcessInformation,
|
||||
SystemCallCountInformation,
|
||||
SystemDeviceInformation,
|
||||
SystemProcessorPerformanceInformation,
|
||||
SystemFlagsInformation,
|
||||
SystemCallTimeInformation,
|
||||
SystemModuleInformation,
|
||||
} SYSTEM_INFORMATION_CLASS, * PSYSTEM_INFORMATION_CLASS;
|
||||
|
||||
|
||||
extern "C" NTSTATUS NTAPI ZwQuerySystemInformation(ULONG SystemInformationClass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
|
||||
|
||||
PVOID QuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInfoClass, ULONG* size)
|
||||
{
|
||||
|
||||
int currAttempt = 0;
|
||||
int maxAttempt = 20;
|
||||
|
||||
|
||||
QueryTry:
|
||||
if (currAttempt >= maxAttempt)
|
||||
return 0;
|
||||
|
||||
currAttempt++;
|
||||
ULONG neededSize = 0;
|
||||
ZwQuerySystemInformation(SystemInfoClass, NULL, neededSize, &neededSize);
|
||||
if (!neededSize)
|
||||
goto QueryTry;
|
||||
|
||||
ULONG allocationSize = neededSize;
|
||||
PVOID informationBuffer = ExAllocatePool(NonPagedPool, allocationSize);
|
||||
if (!informationBuffer)
|
||||
goto QueryTry;
|
||||
|
||||
NTSTATUS status = ZwQuerySystemInformation(SystemInfoClass, informationBuffer, neededSize, &neededSize);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
ExFreePoolWithTag(informationBuffer, 0);
|
||||
goto QueryTry;
|
||||
}
|
||||
|
||||
*size = allocationSize;
|
||||
return informationBuffer;
|
||||
}
|
||||
|
||||
|
||||
typedef struct _SYSTEM_MODULE_ENTRY {
|
||||
HANDLE Section;
|
||||
PVOID MappedBase;
|
||||
PVOID ImageBase;
|
||||
ULONG ImageSize;
|
||||
ULONG Flags;
|
||||
USHORT LoadOrderIndex;
|
||||
USHORT InitOrderIndex;
|
||||
USHORT LoadCount;
|
||||
USHORT OffsetToFileName;
|
||||
UCHAR FullPathName[256];
|
||||
} SYSTEM_MODULE_ENTRY, * PSYSTEM_MODULE_ENTRY;
|
||||
|
||||
typedef struct _SYSTEM_MODULE_INFORMATION {
|
||||
ULONG Count;
|
||||
SYSTEM_MODULE_ENTRY Module[1];
|
||||
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
|
||||
|
||||
UINT64 GetKernelModuleBase(const char* name)
|
||||
{
|
||||
|
||||
ULONG size = 0;
|
||||
PSYSTEM_MODULE_INFORMATION moduleInformation = (PSYSTEM_MODULE_INFORMATION)QuerySystemInformation(SystemModuleInformation, &size);
|
||||
|
||||
if (!moduleInformation || !size)
|
||||
return 0;
|
||||
|
||||
for (size_t i = 0; i < moduleInformation->Count; i++)
|
||||
{
|
||||
char* fileName = (char*)moduleInformation->Module[i].FullPathName + moduleInformation->Module[i].OffsetToFileName;
|
||||
if (!strcmp(fileName, name))
|
||||
{
|
||||
UINT64 imageBase = (UINT64)moduleInformation->Module[i].ImageBase;
|
||||
ExFreePoolWithTag(moduleInformation, 0);
|
||||
return imageBase;
|
||||
}
|
||||
}
|
||||
|
||||
ExFreePoolWithTag(moduleInformation, 0);
|
||||
}
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# ClearDriverTraces
|
||||
clearing traces of a loaded driver
|
||||
|
||||
## DESCRIPTION
|
||||
This project gets rid of some entries left behind by loading a signed kernel driver which can lead to the certificate getting blacklisted.
|
||||
|
||||
## NOTES
|
||||
I have only provided the right offsets for my windows version (21h1). You can get the correct offsets from ida. Open the module they are loaded in, search for them in the name search window, rebase the program to 0, and then copy their location.
|
||||
|
||||
## USAGE
|
||||
Compile in x64 release and sign it. Load it like any other signed driver.
|
||||
|
||||
```
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,133 @@
|
||||
Project Path: arc_nbqofficial_HideDriver_1tartuq8
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_nbqofficial_HideDriver_1tartuq8
|
||||
├── Driver.c
|
||||
├── README.md
|
||||
└── ldr_data_table.h
|
||||
|
||||
```
|
||||
|
||||
`Driver.c`:
|
||||
|
||||
```c
|
||||
#include <ntddk.h>
|
||||
#include "ldr_data_table.h" // header containing data table entry structure which is crucial for this project
|
||||
|
||||
/*
|
||||
|
||||
KERNEL MODE DRIVER ABLE TO HIDE ITSELF BY USING DIRECT KERNEL OBJECT MANIPULATION.
|
||||
|
||||
MADE BY NBQ
|
||||
|
||||
*/
|
||||
|
||||
PDEVICE_OBJECT pDeviceObject;
|
||||
UNICODE_STRING rDevices, rDosDevices;
|
||||
|
||||
VOID HideDriver(PDRIVER_OBJECT pDriverObject)
|
||||
{
|
||||
KIRQL irql = KeRaiseIrqlToDpcLevel(); // raises IRQL to DISPATCH level
|
||||
PLDR_DATA_TABLE_ENTRY prevEntry, nextEntry, modEntry;
|
||||
modEntry = (PLDR_DATA_TABLE_ENTRY)pDriverObject->DriverSection;
|
||||
prevEntry = (PLDR_DATA_TABLE_ENTRY)modEntry->InLoadOrderLinks.Blink;
|
||||
nextEntry = (PLDR_DATA_TABLE_ENTRY)modEntry->InLoadOrderLinks.Flink;
|
||||
// changing pointers of previous and next process in the list to point around our Driver process
|
||||
// this means our Driver process will be skipped when a different program tries enumerating the list
|
||||
prevEntry->InLoadOrderLinks.Flink = modEntry->InLoadOrderLinks.Flink;
|
||||
nextEntry->InLoadOrderLinks.Blink = modEntry->InLoadOrderLinks.Blink;
|
||||
// changing our flink and blink pointers to point to our Driver process
|
||||
// this is done just to not have any loose ends and accidentally blue screen
|
||||
modEntry->InLoadOrderLinks.Flink = (PLIST_ENTRY)modEntry;
|
||||
modEntry->InLoadOrderLinks.Blink = (PLIST_ENTRY)modEntry;
|
||||
// once everything is done we lower the IRQL level back to normal
|
||||
KeLowerIrql(irql);
|
||||
}
|
||||
|
||||
NTSTATUS UnloadDriver(PDRIVER_OBJECT pDriverObject) // simple unload routine
|
||||
{
|
||||
DbgPrintEx(0, 0, "Unloading HideDriver!\n");
|
||||
IoDeleteSymbolicLink(&rDosDevices);
|
||||
}
|
||||
|
||||
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath) // DriverEntry() - its like main() for drivers
|
||||
{
|
||||
HideDriver(pDriverObject); // simply call the HideDriver() function and pass it DriverObject
|
||||
|
||||
DbgPrintEx(0, 0, "HideDriver Loaded!\n");
|
||||
|
||||
// registering the driver, not necessary for HideDriver() function to work
|
||||
RtlInitUnicodeString(&rDevices, L"\\Device\\HideDriver");
|
||||
RtlInitUnicodeString(&rDosDevices, L"\\DosDevices\\HideDriver");
|
||||
|
||||
IoCreateSymbolicLink(&rDosDevices, &rDevices);
|
||||
|
||||
// registering an unload function to be able to unload the driver at will
|
||||
pDriverObject->DriverUnload = UnloadDriver;
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# HideDriver ( Direct kernel object manipulation )
|
||||
Using DKOM to hide kernel mode drivers.
|
||||
|
||||
HideDriver() function changes flink and blink pointers of previous
|
||||
and next process in the process list to point around our Driver process.
|
||||
This makes our Driver vanish in programs like DriverView because those
|
||||
programs enumerate process list in which our Driver process has been snipped out.
|
||||
|
||||
This could be incredibly useful for someone trying to bypass certain anticheat software
|
||||
to circumvent security when programming a rootkit-like software.
|
||||
|
||||
Everything you need is provided in the project. For driver development you need
|
||||
Visual Studio 2015 Professional with WDK and SDK installed.
|
||||
|
||||
|
||||
|
||||
```
|
||||
|
||||
`ldr_data_table.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY
|
||||
{
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
LIST_ENTRY InInitializationOrderLinks;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
USHORT LoadCount;
|
||||
USHORT TlsIndex;
|
||||
union
|
||||
{
|
||||
LIST_ENTRY HashLinks;
|
||||
struct
|
||||
{
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
};
|
||||
};
|
||||
union
|
||||
{
|
||||
ULONG TimeDateStamp;
|
||||
PVOID LoadedImports;
|
||||
};
|
||||
struct _ACTIVATION_CONTEXT * EntryPointActivationContext;
|
||||
PVOID PatchInformation;
|
||||
LIST_ENTRY ForwarderLinks;
|
||||
LIST_ENTRY ServiceTagLinks;
|
||||
LIST_ENTRY StaticLinks;
|
||||
} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;
|
||||
```
|
||||
Reference in New Issue
Block a user