标签:ceo next process reference dprint type 驱动 load object
一、论:#include "HideThreadHeader.h"
VOID UnLoad(PDRIVER_OBJECT pDriverObj)
{
UNICODE_STRING DeleteSymbolicLinkName;
RtlInitUnicodeString(&DeleteSymbolicLinkName, L"\\DosDevices\\SymbolicLinkName");
IoDeleteSymbolicLink(&DeleteSymbolicLinkName);
IoDeleteDevice(pDriverObj->DeviceObject);
KdPrint(("UnLoad Sucess"));
}
NTSTATUS DefaultFun(DEVICE_OBJECT* pDeviceObj, IRP* irp)
{
UNREFERENCED_PARAMETER(pDeviceObj);
irp->IoStatus.Information = 0;
irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS onCreate(DEVICE_OBJECT* pDeviceObj, IRP* irp)
{
UNREFERENCED_PARAMETER(pDeviceObj);
irp->IoStatus.Information = 0;
irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
NTSTATUS onClose(DEVICE_OBJECT* pDeviceObj, IRP* irp)
{
UNREFERENCED_PARAMETER(pDeviceObj);
irp->IoStatus.Information = 0;
irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(irp, IO_NO_INCREMENT);
return STATUS_SUCCESS;
}
// 遍历属于某个进程所有线程 通过断链实现隐藏线程
VOID HideThreadListLink()
{
CLIENT_ID* ThreadId = NULL;
PEPROCESS pkProcess = NULL;
PKTHREAD pkThread = NULL;
PETHREAD pEthread = NULL;
LIST_ENTRY* pEthreadNext = NULL;
LIST_ENTRY* pEthreadCurrent = NULL;
pkProcess = PsGetCurrentProcess();
// 获取_KPROCESS->ThreadListHead(_LIST_ENTRY)
pEthreadCurrent = (LIST_ENTRY *)((ULONG_PTR)pkProcess + 0x02c);
/* 注:
1. _KPROCESS.ThreadListHead->Flink指向的是一个_KTHREAD.ThreadListEntry
2. _KTHREAD.ThreadListEntry - 偏移ThreadListEntry获取到KTHREAD地址,其实也就是ETHREAD地址.
*/
KdPrint(("ThreadListHead.Flink = %p\n", pEthreadCurrent->Flink));
KdPrint(("ThreadListHead.blink = %p\n", pEthreadCurrent->Blink));
// 这个 (PETHREAD)(PEPROCESS + 0x2c)
pEthreadNext = pEthreadCurrent->Flink;
DbgBreakPoint();
while (pEthreadCurrent != pEthreadNext)
{
pkThread = (PKTHREAD)((ULONG_PTR)pEthreadNext - 0x1e0);
// pKthread->Teb 偏移 0x88
// KdPrint(("pKThread->Teb = %p , %s \n", (ULONG_PTR)pkThread + 0x88, (((ULONG_PTR)pKThread + 0x88) == NULL || pkThread->Teb > 0x80000000 ? "System Thread" : "Non System Thread")));
// 转换成EPROCESS
pEthread = (PETHREAD)pkThread;
DbgBreakPoint();
// pEthread->Cid 偏移0x22c
ThreadId = (CLIENT_ID *)((ULONG_PTR)pEthread + 0x22c);
KdPrint(("ThreadId = %d, ProcessId = %d\n\n", ThreadId->UniqueThread, ThreadId->UniqueProcess));
// 这个地方也可以使用断链 伪代码
if (ThreadId->UniqueThread == "隐藏的线程id")
{
// 与进程隐藏断链方式一样
}
pEthreadNext = pEthreadNext->Flink;
}
}
// 驱动对象入口点
NTSTATUS DriverEntry(DRIVER_OBJECT* pDriverObj, IRP* irp)
{
UNREFERENCED_PARAMETER(irp);
DbgBreakPoint();
for (int i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i) {
pDriverObj->MajorFunction[i] = DefaultFun;
}
pDriverObj->DriverUnload = UnLoad;
pDriverObj->MajorFunction[IRP_MJ_CREATE] = onCreate;
pDriverObj->MajorFunction[IRP_MJ_CLOSE] = onClose;
UNICODE_STRING DeviceName;
UNICODE_STRING SymbolicLinkName;
DEVICE_OBJECT* DeviceObj;
NTSTATUS nStatus = STATUS_SUCCESS;
RtlInitUnicodeString(&DeviceName, L"\\Device\\DeviceName");
RtlInitUnicodeString(&SymbolicLinkName, L"\\DosDevices\\SymbolicLinkName");
nStatus = IoCreateDevice(pDriverObj, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, 0, &DeviceObj);
if (!NT_SUCCESS(nStatus))
return nStatus;
nStatus = IoCreateSymbolicLink(&SymbolicLinkName, &DeviceName);
if (!NT_SUCCESS(nStatus))
return nStatus;
DbgBreakPoint();
// 没有使用控制码等处理 伪代码进行测试
HideThreadListLink();
return STATUS_SUCCESS;
}
标签:ceo next process reference dprint type 驱动 load object
原文地址:http://blog.51cto.com/13352079/2340036