经验总结

  1. 首页 > 生活 > >

驱动开发：内核运用LoadImage屏蔽驱动( 二 )

生活百科

lyshark.sys则你会发现驱动被拦截了 。

驱动开发：内核运用LoadImage屏蔽驱动

文章插图
我们看下驱动加载器，提示的信息是拒绝访问，因为这个驱动其实是加载了的，只是入口处被填充了返回而已 。
驱动开发：内核运用LoadImage屏蔽驱动

文章插图
除了使用Ret强制返回的方法意外，屏蔽驱动加载还可以使用另一种方式实现禁用模块加载，例如当驱动被加载首先回调函数内可以接收到，当接收到以后直接调用MmUnmapViewOfSection函数强制卸载掉即可，如果使用这种方法实现则这段代码需要改进成如下样子 。
// 署名权// right to sign one's name on a piece of work// PowerBy: LyShark// Email: me@lyshark.com#include <ntifs.h>#include <ntimage.h>#include <intrin.h>NTSTATUS MmUnmapViewOfSection(PEPROCESS Process, PVOID BaseAddress);NTSTATUS SetNotifyRoutine();NTSTATUS RemoveNotifyRoutine();VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);NTSTATUS U2C(PUNICODE_STRING pustrSrc, PCHAR pszDest, ULONG ulDestLength);VOID ThreadProc(_In_ PVOID StartContext);// 拒绝加载驱动NTSTATUS DenyLoadDriver(PVOID pImageBase);// 拒绝加载DLL模块NTSTATUS DenyLoadDll(HANDLE ProcessId, PVOID pImageBase);typedef struct _MY_DATA{ HANDLE ProcessId; PVOID pImageBase;}MY_DATA, *PMY_DATA;// 设置消息回调NTSTATUS SetNotifyRoutine(){ NTSTATUS status = STATUS_SUCCESS; status = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine); return status;}// 关闭消息回调NTSTATUS RemoveNotifyRoutine(){ NTSTATUS status = STATUS_SUCCESS; status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine); return status;}VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo){ DbgPrint("PID: %d --> 完整路径: %wZ --> 大小: %d --> 基地址: 0x%p \n", ProcessId, FullImageName, ImageInfo->ImageSize, ImageInfo->ImageBase); HANDLE hThread = NULL; CHAR szTemp[1024] = { 0 }; U2C(FullImageName, szTemp, 1024); if (NULL != strstr(szTemp, "lyshark.sys")) {// EXE或者DLLif (0 != ProcessId){// 创建多线程 延时1秒钟后再卸载模块PMY_DATA pMyData = https://www.huyubaike.com/biancheng/ExAllocatePool(NonPagedPool, sizeof(MY_DATA));pMyData->ProcessId = ProcessId;pMyData->pImageBase = ImageInfo->ImageBase;PsCreateSystemThread(&hThread, 0, NULL, NtCurrentProcess(), NULL, ThreadProc, pMyData);DbgPrint("[LyShark] 禁止加载DLL文件 \n");}// 驱动else{DenyLoadDriver(ImageInfo->ImageBase);DbgPrint("[LyShark] 禁止加载SYS驱动文件 \n");} }}// 拒绝加载驱动NTSTATUS DenyLoadDriver(PVOID pImageBase){ NTSTATUS status = STATUS_SUCCESS; PMDL pMdl = NULL; PVOID pVoid = NULL; ULONG ulShellcodeLength = 16; UCHAR pShellcode[16] = { 0xB8, 0x22, 0x00, 0x00, 0xC0, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 }; PIMAGE_DOS_HEADER pDosHeader = pImageBase; PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((PUCHAR)pDosHeader + pDosHeader->e_lfanew); PVOID pDriverEntry = (PVOID)((PUCHAR)pDosHeader + pNtHeaders->OptionalHeader.AddressOfEntryPoint); pMdl = MmCreateMdl(NULL, pDriverEntry, ulShellcodeLength); MmBuildMdlForNonPagedPool(pMdl); pVoid = MmMapLockedPages(pMdl, KernelMode); RtlCopyMemory(pVoid, pShellcode, ulShellcodeLength); MmUnmapLockedPages(pVoid, pMdl); IoFreeMdl(pMdl); return status;}// 调用 MmUnmapViewOfSection 函数来卸载已经加载的 DLL 模块NTSTATUS DenyLoadDll(HANDLE ProcessId, PVOID pImageBase){ NTSTATUS status = STATUS_SUCCESS; PEPROCESS pEProcess = NULL; status = PsLookupProcessByProcessId(ProcessId, &pEProcess); if (!NT_SUCCESS(status)) {return status; } // 卸载模块 status = MmUnmapViewOfSection(pEProcess, pImageBase); if (!NT_SUCCESS(status)) {return status; } return status;}VOID ThreadProc(_In_ PVOID StartContext){ PMY_DATA pMyData = https://www.huyubaike.com/biancheng/(PMY_DATA)StartContext; LARGE_INTEGER liTime = { 0 }; // 延时 1 秒 负值表示相对时间 liTime.QuadPart = -10 * 1000 * 1000; KeDelayExecutionThread(KernelMode, FALSE, &liTime); // 卸载 DenyLoadDll(pMyData->ProcessId, pMyData->pImageBase); ExFreePool(pMyData);}NTSTATUS U2C(PUNICODE_STRING pustrSrc, PCHAR pszDest, ULONG ulDestLength){ NTSTATUS status = STATUS_SUCCESS; ANSI_STRING strTemp; RtlZeroMemory(pszDest, ulDestLength); RtlUnicodeStringToAnsiString(&strTemp, pustrSrc, TRUE); if (ulDestLength > strTemp.Length) {RtlCopyMemory(pszDest, strTemp.Buffer, strTemp.Length); } RtlFreeAnsiString(&strTemp); return status;}VOID UnDriver(PDRIVER_OBJECT driver){ PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)RemoveNotifyRoutine); DbgPrint("驱动卸载完成...");}NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath){ DbgPrint("hello lyshark.ocm \n"); PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)SetNotifyRoutine); DbgPrint("驱动加载完成..."); Driver->DriverUnload = UnDriver; return STATUS_SUCCESS;}

经验总结扩展阅读


上一篇：和游戏cp终止感情的经典语录 表示感情到此为止的说说

下一篇：2023年2月2日是香炉安放吉日吗 2023年2月2日香炉安放行吗