03 特征码搜索PspTerminateProcess函数、隐藏驱动模块

柠檬的泪是酸的@

已于 2023-05-06 17:07:36 修改

阅读量369

点赞数

分类专栏：驱动开发文章标签：驱动开发 windows

于 2023-04-28 14:38:48 首次发布

本文链接：https://blog.csdn.net/qq_50242229/article/details/130422157

版权

驱动开发专栏收录该内容

6 篇文章 1 订阅

订阅专栏

文章描述了一种方法来动态查找并调用系统函数PspTerminateProcess，通过遍历驱动段寻找ntoskrnl.exe基地址，然后使用特征码匹配找到函数入口。此外，还提到了隐藏驱动模块的技巧，以及在异常处理中执行的代码流程。

摘要由CSDN通过智能技术生成

导出函数 PspTerminateProcess 杀掉进程

模块基址 + 函数偏移

不能直接写函数地址，因为有可能dll占不到位置，会进行重定位
函数地址
在这里插入图片描述

// 函数声明
typedef NTSTATUS(__stdcall *_PspTerminateProcess)(PEPROCESS pEprocess, NTSTATUS ExitCode);
_PspTerminateProcess pspTerminateProcess;

VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	DbgPrint("over\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
	UINT32 base = NULL;
	LIST_ENTRY* list = (LIST_ENTRY*)pDriver->DriverSection;
	LIST_ENTRY* current_entry = list;
	UNICODE_STRING ntName;
	RtlInitUnicodeString(&ntName, L"ntoskrnl.exe");
	while (1)
	{
		PUNICODE_STRING name = (PUNICODE_STRING)((UINT32)current_entry + 0x2c);
		if (RtlCompareUnicodeString(name,&ntName,FALSE) == 0)
		{
			base = *(UINT32*)((UINT32)current_entry + 0x18);
			break;
		}
		current_entry = current_entry->Blink;
	}
	DbgPrint("dllbase : %08x\n", base);
	DbgPrint("dllbaseName : %wZ\n", &ntName);
	if (base)
	{
		pspTerminateProcess = (_PspTerminateProcess)(base + 0x157050);//dll基址 - 函数地址
		pspTerminateProcess(0x894f4548,0); //这个需要在winDbg（! process 0 0）中查看你进程的process后面的值
	}
	pDriver->DriverUnload = DriverUnload;	
	return STATUS_SUCCESS;
}

特征码搜索

找到该函数的特征码
前面的0x6个字节是通用的，不具备特殊性，就排除，选取下面一部分的就可以了
在这里插入图片描述

#include <ntddk.h>

// 函数声明
typedef NTSTATUS(__stdcall *_PspTerminateProcess)(PEPROCESS pEprocess, NTSTATUS ExitCode);
_PspTerminateProcess pspTerminateProcess = NULL;


VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	DbgPrint("over\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{
	try {

		UINT32 shellcode[] = {
			0x0124a164,0x758b0000,0x44703b08,0x0db80775,
			0xebc00000,0xbe8d575a,0x00000248,0x200147f6,
			0x868d1274,0x00000174,0xca685650,0xe88062f0
		};

		UINT32 shellcodeLength = sizeof(shellcode);

		UINT32 base = NULL;
		UINT32 baseSize = NULL;
		UNICODE_STRING baseName;

		LIST_ENTRY* current_entry = (LIST_ENTRY*)pDriver->DriverSection;

		UNICODE_STRING ntName;
		RtlInitUnicodeString(&ntName, L"ntoskrnl.exe");

		while (1)
		{
			base = *(UINT32*)((UINT32)current_entry + 0x18);
			baseSize = *(UINT32*)((UINT32)current_entry + 0x20);
			baseName =*(PUNICODE_STRING)((UINT32)current_entry + 0x2c);
			if (RtlCompareUnicodeString(&ntName,&baseName,TRUE) == 0)
			{
				for (int i = base; i < base + baseSize - shellcodeLength; i++)
				{
					if (RtlCompareMemory(shellcode,i, shellcodeLength) == shellcodeLength)
					{
						pspTerminateProcess = (_PspTerminateProcess)(i - 0x6);
						break;
					}
				}
				break;
			}
			current_entry = current_entry->Blink;
		}

		DbgPrint("dllbase : %08x\n", base);
		DbgPrint("dllbaseName : %wZ\n", ntName);
		DbgPrint("_PspTerminateProcess address is  : %08x\n", pspTerminateProcess);

		if (pspTerminateProcess)
		{
			pspTerminateProcess(0x89a2a3c0, 0);//这个需要在winDbg（! process 0 0）中查看你进程的process后面的值
		}

	}__except (EXCEPTION_EXECUTE_HANDLER) {
		DbgPrint("run error\n");
	}
	pDriver->DriverUnload = DriverUnload;	
	return STATUS_SUCCESS;
}

断链 - 隐藏驱动模块

PCHunter还是可以检测到的哦

#include <ntddk.h>

LIST_ENTRY* cur_entry = NULL;
LIST_ENTRY* pre_entry = NULL;
LIST_ENTRY* next_entry = NULL;



VOID DriverUnload(PDRIVER_OBJECT pDriver)
{
	pre_entry->Blink = cur_entry;
	next_entry->Flink = cur_entry;
	DbgPrint("over\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{

	pDriver->DriverUnload = DriverUnload;

	cur_entry = (LIST_ENTRY*)pDriver->DriverSection;
	pre_entry = cur_entry->Flink;
	next_entry = cur_entry->Blink;

	//前后entry断开
	pre_entry->Blink = next_entry;
	next_entry->Flink = pre_entry;

	cur_entry->Blink = NULL;
	cur_entry->Flink = NULL;


	DbgPrint("加载并隐藏成功！！！\n");
	
	return STATUS_SUCCESS;
}