RING0级暴力搜索内存检测系统隐藏进程(或ROOTKIT)(实测可运行)

青旅半醒 2022-01-20 14:11 356阅读 0赞

最近期末答辩不知道写什么好，就写一个安全软件吧。软件使用驱动和C++编写，大概多数安全软件都是这样吧。  
时间关系，就不说那么多了，直接入正题吧。  
在此先感谢“伊丽\_杀\_白”、“堕落天才”、“antirootkit”等提供的优秀文章，我只是在他们基础之上修改了一下。  
  
伊丽\_杀\_白 暴力搜索内存空间检测隐藏进程： [http://bbs.xdnice.com/thread-377796-1-1.html][http_bbs.xdnice.com_thread-377796-1-1.html]  
  
堕落天才 ring0检测隐藏进程： [http://bbs.pediy.com/showthread.php?t=44243][http_bbs.pediy.com_showthread.php_t_44243]  
  
antirootkit 枚举隐藏进程for ring0(搜索内存大法)： [http://hi.baidu.com/antirootkit/blog/item/d2314b5c94772040fbf2c00b.html][http_hi.baidu.com_antirootkit_blog_item_d2314b5c94772040fbf2c00b.html]   
  
原理：  
大概流程图如下，当然我修改了部分。  
  
  
![ring0SearchMemory.png][]  
  
下面看代码吧，没时间了，等下十点还要上课，有不明白的可以留言。我会解答的。  
  
不过这种方法还是很容易躲过，详细就不公布出来了，看来还是要找另外一种方法了。

\#include < ntddk.h >   
  
  
 // EPROCESS结构大小，我的系统是XP SP3，所以0x260，不过经过测试，这里设置成比实际EPROCESS小也是没问题的   
 \#define  EPROCESS\_SIZE 0x260    
 \#define  PEB\_OFFSET 0x1B0  // PEB偏移，下面就不注释了   
 \#define  FILE\_NAME\_OFFSET 0x174   
 \#define  PROCESS\_LINK\_OFFSET 0x088   
 \#define  PROCESS\_ID\_OFFSET 0x084   
 \#define  EXIT\_TIME\_OFFSET 0x078   
  
 \#define  OBJECT\_HEADER\_SIZE 0x018   
 \#define  OBJECT\_TYPE\_OFFSET 0x008   
  
  
ULONG ulPebAddress;  // PEB地址的前半部分   
 ULONG ulStartAddress, ulEndAddress;  // 起始，结束地址   
 ULONG ulObjectType;  // 进程对象类型   
   
BOOLEAN IsaRealProcess(ULONG pEprocess);  // 该函数判断是否真的是进程   
 VOID WorkThread(IN PVOID pContext);  // 新开线程防止系统顿卡   
 VOID UpdateEndStartPebAddress();  // 更新首尾地址和PEB地址   
 VOID EnumProcess();  // 枚举进程   
 VOID ShowProcess(ULONG pEProcess);  // 显示进程信息   
   
VOID OnUnload(IN PDRIVER\_OBJECT DriverObject)  
\{  
\}  
  
NTSTATUS DriverEntry(IN PDRIVER\_OBJECT DriverObject,IN PUNICODE\_STRING RegistryPath)  
\{  
HANDLE hThread;  
  
DriverObject  \->  DriverUnload  =  OnUnload;  
UpdateEndStartPebAddress();  
  
ulObjectType  =  \* (PULONG)((ULONG)ulEndAddress  \-  OBJECT\_HEADER\_SIZE  \+  OBJECT\_TYPE\_OFFSET);  
PsCreateSystemThread( & hThread,  
(ACCESS\_MASK) 0 ,  
NULL,  
(HANDLE) 0 ,  
NULL,  
WorkThread,  
NULL );  
  
 return  STATUS\_SUCCESS;  
\}  
 / /   
 VOID WorkThread(IN PVOID pContext)  
\{  
EnumProcess();  
PsTerminateSystemThread(STATUS\_SUCCESS);  
\}  
 // //   
 VOID UpdateEndStartPebAddress()  
\{  
ULONG ulEProcessAddress  =  (ULONG)IoGetCurrentProcess();  
ULONG pEProcess;  
 // IoGetCurrentProcess返回的是System进程EPROCESS结构地址，此处已经是搜索结束处。   
  ulStartAddress  =  ulEndAddress  =  ulEProcessAddress;  
  
ulEProcessAddress  =  (ULONG)(((PLIST\_ENTRY)(ulEProcessAddress  \+  PROCESS\_LINK\_OFFSET)) \-> Flink)  \-  PROCESS\_LINK\_OFFSET;  
ulPebAddress  =  \* (PULONG)(ulEProcessAddress  \+  PEB\_OFFSET)  &  0xFFFF0000 ;  
  
 while  (ulEProcessAddress  !=  ulEndAddress)  
\{  // 遍历EPROCESS结构，找到最小地址处   
  ulEProcessAddress  =  (ULONG)(((PLIST\_ENTRY)(ulEProcessAddress  \+  PROCESS\_LINK\_OFFSET)) \-> Flink)  \-  PROCESS\_LINK\_OFFSET;  
 if  (ulStartAddress  >  ulEProcessAddress)  
ulStartAddress  =  ulEProcessAddress;  
\}  
\}  
 // /   
 VOID EnumProcess()  
\{  
  
ULONG i;  
ULONG nCount  =  2 ;  
ULONG Address;  
ULONG ret;  
  
KdPrint(( " \-------------------------------------------\\r\\n " ));  
KdPrint(( " EProcess PID ImageFileName\\r\\n " ));  
KdPrint(( " \-------------------------------------------\\r\\n " ));  
 // 系统空闲进程的检测方法有点特殊，只作参考   
  ShowProcess( \* (PULONG)(ulStartAddress  \+  PROCESS\_ID\_OFFSET));  
 // system的PEB总是零 上面的方法是枚举不到的 不过我们用PsGetCurrentProcess就能得到了   
  ShowProcess(ulEndAddress);  
  
 for (i  =  ulStartAddress; i  <  ulEndAddress; i  \+=  4 ) \{  // system进程的EPROCESS地址就是最大值了   
  if  (MmIsAddressValid((PVOID)i)) \{  
Address  =  \* (PULONG)i;  
 if  (( Address  &  0xFFFF0000 )  ==  ulPebAddress)\{  // 每个进程的PEB地址都是在差不多的地方，地址前半部分是相同的    
  if  (IsaRealProcess(i)) \{  
ShowProcess(i  \-  PEB\_OFFSET);  
i  \-=  4 ;  
i  \+=  EPROCESS\_SIZE;  
nCount  \++ ;  
\}  
\}  
\}  else  \{  
i  \-=  4 ;  
i  \+=  0x5000000 ; // 5M   
  \}  
\}  
KdPrint(( " \-------------------------------------------\\r\\n " ));  
KdPrint(( " ===== Total Processes count:%3d =======\\r\\n " , nCount));  
KdPrint(( " \-------------------------------------------\\r\\n " ));  
\}  
 /  
 VOID ShowProcess(ULONG pEProcess)  
\{  
PLARGE\_INTEGER ExitTime;  
ULONG PID;  
PUCHAR pFileName;  
  
ExitTime  =  (PLARGE\_INTEGER)(pEProcess  \+  EXIT\_TIME\_OFFSET);  
 if (ExitTime \-> QuadPart  !=  0 )  // 已经结束的进程的ExitTime为非零   
  return  ;  
  
PID  =  \* (PULONG)(pEProcess  \+  PROCESS\_ID\_OFFSET);  
pFileName  =  (PUCHAR)(pEProcess  \+  FILE\_NAME\_OFFSET);  
  
KdPrint(( " 0x%08X %04d %s\\r\\n " ,pEProcess,PID,pFileName));  
\}  
 /// /   
 BOOLEAN IsaRealProcess(ULONG pEprocess)  
\{  
NTSTATUS STATUS;  
PUNICODE\_STRING pUnicode;  
UNICODE\_STRING Process;  
ULONG pObjectType;  
ULONG ObjectTypeAddress;  
  
 if  ( ! MmIsAddressValid((PVOID)(pEprocess  \-  PEB\_OFFSET)))  
 return  FALSE;  
  
ObjectTypeAddress  =  pEprocess  \-  PEB\_OFFSET  \-  OBJECT\_HEADER\_SIZE  \+  OBJECT\_TYPE\_OFFSET ;  
  
 if  (MmIsAddressValid((PVOID)ObjectTypeAddress)) \{  
pObjectType  =  \* (PULONG)ObjectTypeAddress;  
\}  else  \{  
 return  FALSE;  
\}  
  
 if (ulObjectType  ==  pObjectType) \{  // 确定ObjectType是Process类型   
  return  TRUE;  
\}  
 return  FALSE;  
\}

[http_bbs.xdnice.com_thread-377796-1-1.html]: http://bbs.xdnice.com/thread-377796-1-1.html
[http_bbs.pediy.com_showthread.php_t_44243]: http://bbs.pediy.com/showthread.php?t=44243
[http_hi.baidu.com_antirootkit_blog_item_d2314b5c94772040fbf2c00b.html]: http://hi.baidu.com/antirootkit/blog/item/d2314b5c94772040fbf2c00b.html
[ring0SearchMemory.png]: /images/20220120/7e9e527f70184b18867bf8960d7749f9.png