注册
登录
| 关键词： nbsp return PVOID ULONG ATTRIBUTES GetData fprintf pKiWaitOutListHe pethread pMapPhysicalMemo |
来源：http://blog.csdn.net/sunwear/ /*有些ROOTKIT通过更改PsActiveProcess链表或相关Native API来隐藏进程.下面这个程序通过直接读取KiWaitInListHead和KiWaitOutListHead(windows的dispatcher所使用的内核链表),来列出隐藏的进程.技术细节请参照Jan K. Rutkowski的原文http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-rutkowski/rutkowski-antirootkit.zip. 原文的示范代码使用驱动来实现,这里使用了\Device\PhysicalMemory.代码很乱,勉强可以工作.这里感谢pjf的代码.如果有错误的地方请斧正，如果你有更好的idea，与我分享？谢谢！*//* code token from Jan K. Rutkowski(jkrutkowski<a>elka.pw.edu.pl) *//* and pjf ([email protected])'s article *//* compile under cygwin> gcc -o kps kps.c -I/usr/include/w32api/ddk -lntdll -lntoskrnl *//* see Jan K. Rutkowski's article for more info. *//* This tool will list all the procs include those hiden by some rootkit. 2003/10, fantas1a*/#include <stdio.h>#include <stdlib.h>#include <windows.h>#include <ntddk.h>typedef struct _KLISTER_PROCINFO { int pid; char name [18];} KLISTER_PROCINFO, *PKLISTER_PROCINFO;PLIST_ENTRY pKiWaitInListHead ;PLIST_ENTRY pKiWaitOutListHead ;PLIST_ENTRY pKiDispatcherReadyListHead ;#define WAITLIST_OFFSET 0x5c // in _KTHREADPVOID g_pMapPhysicalMemory = NULL;HANDLE g_hMPM = NULL;#define MAX_PROCS 1000KLISTER_PROCINFO procs[MAX_PROCS];int nprocs = 0;PVOID LinearToPhys(PULONG BaseAddress,PVOID addr){ ULONG VAddr=(ULONG)addr,PGDE,PTE,PAddr; PGDE=BaseAddress[VAddr>>22]; if ((PGDE&1)!=0) { ULONG tmp=PGDE&0x00000080; if (tmp!=0) { PAddr=(PGDE&0xFFC00000)+(VAddr&0x003FFFFF); } else { PGDE=(ULONG)MapViewOfFile(g_hMPM, 4, 0, PGDE & 0xfffff000, 0x1000); PTE=((PULONG)PGDE)[(VAddr&0x003FF000)>>12]; if ((PTE&1)!=0) { PAddr=(PTE&0xFFFFF000)+(VAddr&0x00000FFF); UnmapViewOfFile((PVOID)PGDE); } else { //fprintf(stderr, "LinearToPhys return 0, page not in\r\n"); return 0; } } } else { //fprintf(stderr, "LinearToPhys return 0, page table not in\r\n"); return 0; } //fprintf(stderr, "LinearToPhys return %08x\r\n", PAddr); return (PVOID)PAddr;}ULONG GetData(PVOID addr){ ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)addr); if(phys==0) return 0; PULONG tmp=(PULONG)MapViewOfFile(g_hMPM, 4, 0, phys & 0xfffff000, 0x1000); if (tmp==0) { exit(-1); } ULONG ret=tmp[(phys & 0xFFF)>>2]; UnmapViewOfFile(tmp); return ret;}HANDLE OpenPhysicalMemory(){ NTSTATUS status; UNICODE_STRING physmemString; OBJECT_ATTRIBUTES attributes; RtlInitUnicodeString( &physmemString, L"\\Device\\PhysicalMemory" ); attributes.Length = sizeof(OBJECT_ATTRIBUTES); attributes.RootDirectory = NULL; attributes.ObjectName = &physmemString; attributes.Attributes = 0; attributes.SecurityDescriptor = NULL; attributes.SecurityQualityOfService = NULL; status = ZwOpenSection(&g_hMPM,SECTION_MAP_READ,&attributes); if( !NT_SUCCESS( status )) { return NULL; } g_pMapPhysicalMemory = MapViewOfFile( g_hMPM, 4, 0, 0x30000, 0x1000); if( g_pMapPhysicalMemory == NULL ) { return NULL; } return g_hMPM;}void insertProc (int pid, char* name) { int i; for (i = 0; i < nprocs; i++) if (procs[i].pid == pid) return; procs [nprocs].pid = pid; strncpy (procs [nprocs].name, name, 16); //fprintf(stderr, "%d %s\r\n", pid, name); nprocs++; }PEPROCESS processObject (PETHREAD ethread) { ULONG p; p = (ULONG) ethread; //(PEPROCESS)(ethread->Tcb.ApcState.Process); p = GetData((PVOID)(p+0x0+0x34+0x10)); return (PEPROCESS)(p);}char* processName (PEPROCESS eprocess, char *buf) { //&eprocess->ImageFileName[0] ULONG phys=(ULONG)LinearToPhys((PULONG)g_pMapPhysicalMemory,(PVOID)((ULONG)eprocess+0x01fc)); if(phys==0) return 0; PUCHAR tmp=(PUCHAR)MapViewOfFile(g_hMPM, 4, 0, phys & 0xfffff000, 0x1000); if (tmp==0) { return 0; } strncpy(buf, &tmp[(phys & 0xFFF)], 16); UnmapViewOfFile(tmp); return buf; }void listProc(){ int i; printf("---- %d process ----\r\n", nprocs); for(i=0; i<nprocs; i++) { printf("[+]% 4d %s\r\n", procs[i].pid, procs[i].name); }}void createProcList () { int i, j; char buf1[18]; PVOID obj, p, q, tmp; PETHREAD pethread=NULL; ULONG pid; char *pn; //fprintf(stderr, "pKiWaitInListHead\r\n"); for (obj = (PVOID)GetData(pKiWaitInListHead); obj && (obj != pKiWaitInListHead); obj = (PVOID)GetData(obj)) { pethread = (PETHREAD) (GetData((PVOID)obj) - WAITLIST_OFFSET); p = processObject(pethread); pid = GetData((PVOID)((ULONG)pethread + 0x01e0)); //pethread->Cid.UniqueProcess if(pid==0) { //fprintf(stderr, "pid is 0\r\n"); break; } pn = processName(p, buf1); if(pn==0) break; insertProc( pid, pn ); } //fprintf(stderr, "pKiWaitOutListHead\r\n"); for (obj = (PVOID)GetData(pKiWaitOutListHead); obj && (obj != pKiWaitOutListHead); obj = (PVOID)GetData(obj)) { pethread = (PETHREAD) (GetData((PVOID)obj) - WAITLIST_OFFSET); p = processObject(pethread); pid = GetData((PVOID)((ULONG)pethread + 0x01e0)); if(pid==0) { //fprintf(stderr, "pid is 0\r\n"); break; } pn = processName(p, buf1); if(pn==0) break; insertProc( pid, pn ); }/* fprintf(stderr, "pKiDispatcherReadyListHead\r\n"); for (i = 0; i < 32; i++) for (obj = (PVOID)GetData((PVOID)(&pKiDispatcherReadyListHead[i])); obj && (obj != &pKiDispatcherReadyListHead[i]); obj = (PVOID)GetData(obj)) { pethread = (PETHREAD) (GetData((PVOID)obj) - WAITLIST_OFFSET); p = processObject(pethread); pid = GetData((PVOID)((ULONG)pethread + 0x01e0)); if(pid==0) { fprintf(stderr, "pid is 0\r\n"); break; } pn = processName(p, buf1); if(pn==0) break; insertProc( pid, pn ); }*/}int main(int argc, char **argv) { if (OpenPhysicalMemory()==0) { printf("OpenPhysicalMemory failed\r\n"); return -1; } pKiWaitInListHead = (PLIST_ENTRY) 0x80482258; //under win2k + sp4en pKiWaitOutListHead = (PLIST_ENTRY) 0x80482808; pKiDispatcherReadyListHead = (PLIST_ENTRY) 0x804822e0; //fprintf(stderr, "0x%08x, 0x%08x\r\n", (ULONG)pKiWaitInListHead, (ULONG)pKiWaitOutListHead); createProcList(); listProc(); UnmapViewOfFile(g_pMapPhysicalMemory); CloseHandle(g_hMPM); return(0);} |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
