#ifndef AntiRE_h__
#define AntiRE_h__
/*
Author: Joshua Jackson
Date: Nov 09, 2008
License: Give credit where credit is due.
*/
#include <Windows.h>
#include <TlHelp32.h>
#include <tchar.h>
#if defined( _MSC_VER ) && (_MSC_VER > 1200)
#pragma once
#endif
#pragma pack(1)
// Grabbed this definition of MSDN and modified one pointer
// http://msdn.microsoft.com/en-us/library/ms684280(VS.85).aspx
typedef struct _PROCESS_BASIC_INFORMATION {
PVOID Reserved1;
void* PebBaseAddress;
PVOID Reserved2[2];
ULONG_PTR UniqueProcessId;
ULONG_PTR ParentProcessId;
} PROCESS_BASIC_INFORMATION;
// Taken from: http://msdn.microsoft.com/en-us/library/
// aa380518(VS.85).aspx
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING, *PLSA_UNICODE_STRING,
UNICODE_STRING, *PUNICODE_STRING;
typedef struct _OBJECT_TYPE_INFORMATION {
UNICODE_STRING TypeName;
ULONG TotalNumberOfHandles;
ULONG TotalNumberOfObjects;
}OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
// Returned by the ObjectAllTypeInformation class
// passed to NtQueryObject
typedef struct _OBJECT_ALL_INFORMATION {
ULONG NumberOfObjects;
OBJECT_TYPE_INFORMATION ObjectTypeInformation[1];
}OBJECT_ALL_INFORMATION, *POBJECT_ALL_INFORMATION;
#pragma pack()
// CheckCloseHandle will call CloseHandle on an invalid
// DWORD aligned value and if a debugger is running an exception
// will occur and the function will return true otherwise it'll
// return false
inline bool CheckDbgPresentCloseHandle()
{
HANDLE Handle = (HANDLE)0x8000;
__try
{
CloseHandle(Handle);
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
return true;
}
return false;
}
// This function will erase the current images
// PE header from memory preventing a successful image
// if dumped
inline void ErasePEHeaderFromMemory()
{
DWORD OldProtect = 0;
// Get base address of module
char *pBaseAddr = (char*)GetModuleHandle(NULL);
// Change memory protection
VirtualProtect(pBaseAddr, 4096, // Assume x86 page size
PAGE_READWRITE, &OldProtect);
// Erase the header
ZeroMemory(pBaseAddr, 4096);
}
// This function uses the toolhelp32 api to enumerate all running processes
// on the computer and does a comparison of the process name against the
// ProcessName parameter. The function will return 0 on failure.
inline DWORD GetProcessIdFromName(LPCTSTR ProcessName)
{
PROCESSENTRY32 pe32;
HANDLE hSnapshot = NULL;
ZeroMemory(&pe32, sizeof(PROCESSENTRY32));
// We want a snapshot of processes
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
// Check for a valid handle, in this case we need to check for
// INVALID_HANDLE_VALUE instead of NULL
if(hSnapshot == INVALID_HANDLE_VALUE)
return 0;
// Now we can enumerate the running process, also
// we can't forget to set the PROCESSENTRY32.dwSize member
// otherwise the following functions will fail
pe32.dwSize = sizeof(PROCESSENTRY32);
if(Process32First(hSnapshot, &pe32) == FALSE)
{
// Cleanup the mess
CloseHandle(hSnapshot);
return 0;
}
// Do our first comparison
if(_tcsicmp(pe32.szExeFile, ProcessName) == FALSE)
{
// Cleanup the mess
CloseHandle(hSnapshot);
return pe32.th32ProcessID;
}
// Most likely it won't match on the first try so
// we loop through the rest of the entries until
// we find the matching entry or not one at all
while (Process32Next(hSnapshot, &pe32))
{
if(_tcsicmp(pe32.szExeFile, ProcessName) == 0)
{
// Cleanup the mess
CloseHandle(hSnapshot);
return pe32.th32ProcessID;
}
}
// If we made it this far there wasn't a match
// so we'll return 0
CloseHandle(hSnapshot);
return 0;
}
// This function will return the process id of csrss.exe
// and will do so in two different ways. If the OS is XP or
// greater NtDll has a CsrGetProcessId otherwise I'll use
// GetProcessIdFromName. Like other functions it will
// return 0 on failure.
inline DWORD GetCsrssProcessId()
{
// Don't forget to set dw.Size to the appropriate
// size (either OSVERSIONINFO or OSVERSIONINFOEX)
OSVERSIONINFO osinfo;
ZeroMemory(&osinfo, sizeof(OSVERSIONINFO));
osinfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
// Shouldn't fail
GetVersionEx(&osinfo);
// Visit http://msdn.microsoft.com/en-us/library/ms724833(VS.85).aspx
// for a full table of versions however what I have set will
// trigger on anything XP and newer including Server 2003
if (osinfo.dwMajorVersion >= 5 && osinfo.dwMinorVersion >= 1)
{
// Gotta love functions pointers
typedef DWORD (__stdcall *pCsrGetId)();
// Grab the export from NtDll
pCsrGetId CsrGetProcessId = (pCsrGetId)GetProcAddress(GetModuleHandle( TEXT("ntdll.dll") ), "CsrGetProcessId");
if(CsrGetProcessId)
return CsrGetProcessId();
else
return 0;
}
else
return GetProcessIdFromName(TEXT("csrss.exe"));
}
// This function will return the process id of Explorer.exe by using the
// GetShellWindow function and the GetWindowThreadProcessId function
inline DWORD GetExplorerPIDbyShellWindow()
{
DWORD PID = 0;
// Get the PID
GetWindowThreadProcessId(GetShellWindow(), &PID);
return PID;
}
// GetParentProcessId will use the NtQueryInformationProcess function
// exported by NtDll to retrieve the parent process id for the current
// process and if for some reason it doesn't work, it returns 0
DWORD GetParentProcessId()
{
// Much easier in ASM but C/C++ looks so much better
typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)
(HANDLE ,UINT ,PVOID ,ULONG , PULONG);
// Some locals
NTSTATUS Status = 0;
PROCESS_BASIC_INFORMATION pbi;
ZeroMemory(&pbi, sizeof(PROCESS_BASIC_INFORMATION));
// Get NtQueryInformationProcess
pNtQueryInformationProcess NtQIP = (pNtQueryInformationProcess)
GetProcAddress(
GetModuleHandle( TEXT("ntdll.dll") ),
"NtQueryInformationProcess" );
// Sanity check although there's no reason for it to have failed
if(NtQIP == 0)
return 0;
// Now we can call NtQueryInformationProcess, the second
// param 0 == ProcessBasicInformation
Status = NtQIP(GetCurrentProcess(), 0, (void*)&pbi,
sizeof(PROCESS_BASIC_INFORMATION), 0);
if(Status != 0x00000000)
return 0;
else
return pbi.ParentProcessId;
}
// The function will attempt to open csrss.exe with
// PROCESS_ALL_ACCESS rights if it fails we're
// not being debugged however, if its successful we probably are
inline bool CanOpenCsrss()
{
HANDLE Csrss = 0;
// If we're being debugged and the process has
// SeDebugPrivileges privileges then this call
// will be successful, note that this only works
// with PROCESS_ALL_ACCESS.
Csrss = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCsrssProcessId());
if (Csrss != NULL)
{
CloseHandle(Csrss);
return true;
}
else
return false;
}
// This function returns true if the parent process of
// the current running process is Explorer.exe
bool IsParentExplorerExe()
{
DWORD PPID = GetParentProcessId();
if(PPID == GetExplorerPIDbyShellWindow())
return true;
else
return false;
}
// Debug self is a function that uses CreateProcess
// to create an identical copy of the current process
// and debugs it
void DebugSelf()
{
HANDLE hProcess = NULL;
DEBUG_EVENT de;
PROCESS_INFORMATION pi;
STARTUPINFO si;
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
ZeroMemory(&si, sizeof(STARTUPINFO));
ZeroMemory(&de, sizeof(DEBUG_EVENT));
GetStartupInfo(&si);
// Create the copy of ourself
CreateProcess(NULL, GetCommandLine(), NULL, NULL, FALSE,
DEBUG_PROCESS, NULL, NULL, &si, &pi);
// Continue execution
ContinueDebugEvent(pi.dwProcessId, pi.dwThreadId, DBG_CONTINUE);
// Wait for an event
WaitForDebugEvent(&de, INFINITE);
}
// HideThread will attempt to use
// NtSetInformationThread to hide a thread
// from the debugger, this is essentially the same
// as HideThreadFromDebugger. Passing NULL for
// hThread will cause the function to hide the thread
// the function is running in. Also, the function returns
// false on failure and true on success
inline bool HideThread(HANDLE hThread)
{
typedef NTSTATUS (NTAPI *pNtSetInformationThread)
(HANDLE, UINT, PVOID, ULONG);
NTSTATUS Status;
// Get NtSetInformationThread
pNtSetInformationThread NtSIT = (pNtSetInformationThread)
GetProcAddress(GetModuleHandle( TEXT("ntdll.dll") ),
"NtSetInformationThread");
// Shouldn't fail
if (NtSIT == NULL)
return false;
// Set the thread info
if (hThread == NULL)
Status = NtSIT(GetCurrentThread(),
0x11, //ThreadHideFromDebugger
0, 0);
else
Status = NtSIT(hThread, 0x11, 0, 0);
if (Status != 0x00000000)
return false;
else
return true;
}
// This function uses NtQuerySystemInformation
// to try to retrieve a handle to the current
// process's debug object handle. If the function
// is successful it'll return true which means we're
// being debugged or it'll return false if it fails
// or the process isn't being debugged
inline bool DebugObjectCheck()
{
// Much easier in ASM but C/C++ looks so much better
typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)
(HANDLE ,UINT ,PVOID ,ULONG , PULONG);
HANDLE hDebugObject = NULL;
NTSTATUS Status;
// Get NtQueryInformationProcess
pNtQueryInformationProcess NtQIP = (pNtQueryInformationProcess)
GetProcAddress(
GetModuleHandle( TEXT("ntdll.dll") ),
"NtQueryInformationProcess" );
Status = NtQIP(GetCurrentProcess(),
0x1e, // ProcessDebugObjectHandle
&hDebugObject, 4, NULL);
if (Status != 0x00000000)
return false;
if(hDebugObject)
return true;
else
return false;
}
// CheckProcessDebugFlags will return true if
// the EPROCESS->NoDebugInherit is == FALSE,
// the reason we check for false is because
// the NtQueryProcessInformation function returns the
// inverse of EPROCESS->NoDebugInherit so (!TRUE == FALSE)
inline bool CheckProcessDebugFlags()
{
// Much easier in ASM but C/C++ looks so much better
typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)
(HANDLE ,UINT ,PVOID ,ULONG , PULONG);
DWORD NoDebugInherit = 0;
NTSTATUS Status;
// Get NtQueryInformationProcess
pNtQueryInformationProcess NtQIP = (pNtQueryInformationProcess)
GetProcAddress(
GetModuleHandle( TEXT("ntdll.dll") ),
"NtQueryInformationProcess" );
Status = NtQIP(GetCurrentProcess(),
0x1f, // ProcessDebugFlags
&NoDebugInherit, 4, NULL);
if (Status != 0x00000000)
return false;
if(NoDebugInherit == FALSE)
return true;
else
return false;
}
// CheckOutputDebugString checks whether or
// OutputDebugString causes an error to occur
// and if the error does occur then we know
// there's no debugger, otherwise if there IS
// a debugger no error will occur
inline bool CheckOutputDebugString(LPCTSTR String)
{
OutputDebugString(String);
if (GetLastError() == 0)
return true;
else
return false;
}
// The Int2DCheck function will check to see if a debugger
// is attached to the current process. It does this by setting up
// SEH and using the Int 2D instruction which will only cause an
// exception if there is no debugger. Also when used in OllyDBG
// it will skip a byte in the disassembly and will create
// some havoc.
inline bool Int2DCheck()
{
__try
{
__asm
{
int 0x2d
xor eax, eax
add eax, 2
}
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
return false;
}
return true;
}
// ObjectListCheck uses NtQueryObject to check the environments
// list of objects and more specifically for the number of
// debug objects. This function can cause an exception (although rarely)
// so either surround it in a try catch or __try __except block
// but that shouldn't happen unless one tinkers with the function
inline bool ObjectListCheck()
{
typedef NTSTATUS(NTAPI *pNtQueryObject)
(HANDLE, UINT, PVOID, ULONG, PULONG);
POBJECT_ALL_INFORMATION pObjectAllInfo = NULL;
void *pMemory = NULL;
NTSTATUS Status;
unsigned long Size = 0;
// Get NtQueryObject
pNtQueryObject NtQO = (pNtQueryObject)GetProcAddress(
GetModuleHandle( TEXT( "ntdll.dll" ) ),
"NtQueryObject" );
// Get the size of the list
Status = NtQO(NULL, 3, //ObjectAllTypesInformation
&Size, 4, &Size);
// Allocate room for the list
pMemory = VirtualAlloc(NULL, Size, MEM_RESERVE | MEM_COMMIT,
PAGE_READWRITE);
if(pMemory == NULL)
return false;
// Now we can actually retrieve the list
Status = NtQO((HANDLE)-1, 3, pMemory, Size, NULL);
// Status != STATUS_SUCCESS
if (Status != 0x00000000)
{
VirtualFree(pMemory, 0, MEM_RELEASE);
return false;
}
// We have the information we need
pObjectAllInfo = (POBJECT_ALL_INFORMATION)pMemory;
unsigned char *pObjInfoLocation =
(unsigned char*)pObjectAllInfo->ObjectTypeInformation;
ULONG NumObjects = pObjectAllInfo->NumberOfObjects;
for(UINT i = 0; i < NumObjects; i++)
{
POBJECT_TYPE_INFORMATION pObjectTypeInfo =
(POBJECT_TYPE_INFORMATION)pObjInfoLocation;
// The debug object will always be present
if (wcscmp(L"DebugObject", pObjectTypeInfo->TypeName.Buffer) == 0)
{
// Are there any objects?
if (pObjectTypeInfo->TotalNumberOfObjects > 0)
{
VirtualFree(pMemory, 0, MEM_RELEASE);
return true;
}
else
{
VirtualFree(pMemory, 0, MEM_RELEASE);
return false;
}
}
// Get the address of the current entries
// string so we can find the end
pObjInfoLocation =
(unsigned char*)pObjectTypeInfo->TypeName.Buffer;
// Add the size
pObjInfoLocation +=
pObjectTypeInfo->TypeName.Length;
// Skip the trailing null and alignment bytes
ULONG tmp = ((ULONG)pObjInfoLocation) & -4;
// Not pretty but it works
pObjInfoLocation = ((unsigned char*)tmp) +
sizeof(unsigned long);
}
VirtualFree(pMemory, 0, MEM_RELEASE);
return true;
}
// The IsDbgPresentPrefixCheck works in at least two debuggers
// OllyDBG and VS 2008, by utilizing the way the debuggers handle
// prefixes we can determine their presence. Specifically if this code
// is ran under a debugger it will simply be stepped over;
// however, if there is no debugger SEH will fire :D
inline bool IsDbgPresentPrefixCheck()
{
__try
{
__asm __emit 0xF3 // 0xF3 0x64 disassembles as PREFIX REP:
__asm __emit 0x64
__asm __emit 0xF1 // One byte INT 1
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
return false;
}
return true;
}
#endif // AntiRE_h__