内核监控模块

这里的话可能比较简单一些和上一张的检测进程差不多的

然后也是根据作者Tesla.Angela 所记的笔记

然后今天搞得是内核监控模块这里也是用的微软使用的函数而且据作者所说这个函数还很底层

那么这个可比 hook 函数好用多了然后的话

函数原型

增加

PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);

删除

PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LoadImageNotifyRoutine);

然后就是判断是dll 还是sys 这里我一开始的想法就是后缀名

但是这里有个更好的思路就是直接判断 ProcessId

，如果 PID 位非零，则表示加载 DLL 然后这里也是直接找到入口函数然后直接写入shellcode 拒绝访问的就行了

Mov eax,c0000022h B8 22 00 00 C0

Ret C3

这个意思就是直接在入口函数直接返回 0xC0000022的错误码

然后下面就是代码

#include <ntddk.h>
#include <ntimage.h>
VOID Unload(PDRIVER_OBJECT pDriverObj)
{
	KdPrint(("拜拜！\n"));
}
VOID UnicodeTOChar(PUNICODE_STRING unicode,char *str)
{
	ANSI_STRING string;
	RtlUnicodeStringToAnsiString(&string, unicode, TRUE);
	strcpy(str, string.Buffer);
	RtlFreeAnsiString(&string);
}
VOID xkCopyMemory(PVOID pDestination, PVOID pSourceAddress, SIZE_T SizeOfCopy)
{
	PMDL pMdl = NULL;
	PVOID pSafeAddress = NULL;
	pMdl = IoAllocateMdl(pSourceAddress, (ULONG)SizeOfCopy, FALSE, FALSE, NULL);
	if (!pMdl)
		return;
	__try
	{
		MmProbeAndLockPages(pMdl, KernelMode, IoReadAccess);
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		IoFreeMdl(pMdl);
		return;
	}
	pSafeAddress = MmGetSystemAddressForMdlSafe(pMdl, NormalPagePriority);
	if (!pSafeAddress) 
		return;
	RtlCopyMemory(pDestination, pSafeAddress, SizeOfCopy);
	MmUnlockPages(pMdl);
	IoFreeMdl(pMdl);

}
void DenyLoadDriver(PVOID DriverEntry)
{
	UCHAR shellcode[] = "\xB8\x22\x00\x00\xC0\xC3";
	xkCopyMemory(DriverEntry, shellcode, sizeof(shellcode));
}

PVOID GetDriveByImageBase(PVOID ImageBase)
{
	PIMAGE_DOS_HEADER Posdos;
	PIMAGE_NT_HEADERS64 pNtbase;
	Posdos = (PIMAGE_DOS_HEADER)ImageBase;
	pNtbase = (PIMAGE_NT_HEADERS64)((ULONG64)ImageBase + Posdos->e_lfanew);
	PVOID pEntryPoint = (PVOID)((ULONG64)ImageBase + pNtbase->OptionalHeader.AddressOfEntryPoint);
	return pEntryPoint;
}
VOID LookLoadImage(
	__in_opt PUNICODE_STRING  FullImageName,
	__in HANDLE  ProcessId,
	__in PIMAGE_INFO  ImageInfo
	)
{
	PVOID pDriver;
	char szFullName[256] = {0};
	if (FullImageName != NULL&&MmIsAddressValid(FullImageName))
	{  
		if (ProcessId == 0)
	  	{  
			KdPrint(("加载模块%wZ", FullImageName));
			pDriver = GetDriveByImageBase(ImageInfo->ImageBase);
			KdPrint(("DriverEntry 地址%x\n", pDriver));
			UnicodeTOChar(FullImageName, szFullName);
			if (strstr(_strlwr(szFullName), "win64ast.sys"))
			{
				KdPrint(("禁止加载win64ast.sys"));
				DenyLoadDriver(pDriver);
			}
		}

	}

}
NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryString)
{ 
	PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)LookLoadImage);
	pDriverObj->DriverUnload = Unload;

	return STATUS_SUCCESS;
}

内核 监控模块

猜你喜欢