03 使用DebugPort 清零实现反调试

驱动代码

#include <ntifs.h>
#include <wdm.h>
#include <ntddk.h>


//操作码：0x0-0x7FF 被保留，0x800-0xFFF 可用
#define HIDE CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define SHOW CTL_CODE(FILE_DEVICE_UNKNOWN,0x801,METHOD_BUFFERED,FILE_ANY_ACCESS)


//设备对象
PDEVICE_OBJECT devObj;
//符号链接
UNICODE_STRING symbolLink;

NTSTATUS DEVICE_CONTROL_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS DEVICE_CREATE_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp);
NTSTATUS DEVICE_CLOSE_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp);

//进程调试端口地址
PULONG DebugPort = NULL;
HANDLE hThread;
BOOLEAN flag = 1;


VOID DriverUnload(PDRIVER_OBJECT pDriver)
{

	//删除符号链接
	IoDeleteSymbolicLink(&symbolLink);
	//删除设备
	IoDeleteDevice(devObj);
	DbgPrint("卸载成功！！！\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriver, PUNICODE_STRING pRegPath)
{

	try {
		//unload
		pDriver->DriverUnload = DriverUnload;

	
		//创建设备和3环通信
		UNICODE_STRING deviceName;
		RtlInitUnicodeString(&deviceName,L"\\Device\\firstDevice");
		NTSTATUS status = IoCreateDevice(
			pDriver,
			0,
			&deviceName,
			FILE_DEVICE_UNKNOWN,
			FILE_DEVICE_SECURE_OPEN,
			FALSE,
			&devObj
		);

		DbgPrint("创建设备 ： %d~~\n", status);
		

		//创建符号链接 （3环需要这个符号链接才可以找到）
		RtlInitUnicodeString(&symbolLink,L"\\??\\MYKILLTOOL");
		IoCreateSymbolicLink(&symbolLink,&deviceName);

		//设置通信方式
		pDriver->Flags |= DO_BUFFERED_IO;

		//设置派遣函数
		pDriver->MajorFunction[IRP_MJ_CREATE] = DEVICE_CREATE_Dispatch;
		pDriver->MajorFunction[IRP_MJ_CLOSE] = DEVICE_CLOSE_Dispatch;
		pDriver->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DEVICE_CONTROL_Dispatch;


	} __except(EXCEPTION_EXECUTE_HANDLER) {
		DbgPrint("run error~~\n");
		return STATUS_SUCCESS;
	}
	return STATUS_SUCCESS;
}

VOID HideThread(_In_ PVOID StartContext)
{
	while (flag)
	{
		//不断将端口改为0
		*DebugPort = 0;
	}
}

NTSTATUS DEVICE_CONTROL_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	//从3环获取的PROCESS ID
	UINT32 DATA;
	NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
	//获取PIRP的数据
	PIO_STACK_LOCATION psLocation = IoGetCurrentIrpStackLocation(pIrp);
	//获取控制码
	ULONG code = psLocation->Parameters.DeviceIoControl.IoControlCode;
	//获取缓冲区地址（输入和输出都是同一个）
	PVOID bufferAddress = pIrp->AssociatedIrp.SystemBuffer;
	//3环发送的数据字节数
	ULONG threeLength = psLocation->Parameters.DeviceIoControl.InputBufferLength;
	//0环发送的数据字节数
	ULONG zeroLength = psLocation->Parameters.DeviceIoControl.OutputBufferLength;
	//PEPROCESS
	PETHREAD peprocess;

	switch (code) 
	{
	case HIDE:
		RtlMoveMemory(&DATA, bufferAddress,4);
		if (PsLookupProcessByProcessId((HANDLE)DATA,&peprocess) == STATUS_SUCCESS) //通过PID获取EPROCESS的地址
		{
			DbgPrint("PID : %d ，目前 EPROCESS 地址为：%08x\n", DATA, peprocess);

			DebugPort = (ULONG*)((ULONG)peprocess + 0xbc);

			//创建线程
			PsCreateSystemThread(&hThread, GENERIC_ALL, NULL, NULL, NULL, HideThread, NULL);
	
			DbgPrint("执行成功！！！");
			break;
		}
		else
		{
			status = STATUS_INVALID_HANDLE;
		}
		break;
	case SHOW:
		flag = 0;
		break;
	default:
		break;
	}


	DbgPrint("3环发送的数据长度 %d~~\n", threeLength);
	DbgPrint("0环发送的数据长度 %d~~\n", zeroLength);

	//设置返回状态,默认是失败的哦
	pIrp->IoStatus.Status = status;
	//返回给3环多少字节数据，没有填0
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;

}


NTSTATUS DEVICE_CREATE_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("CREATE  SUCCESS~~\n");

	//设置返回状态
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	//返回给3环多少字节数据，没有填0
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp,IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}


NTSTATUS DEVICE_CLOSE_Dispatch(PDEVICE_OBJECT pDevObj, PIRP pIrp)
{
	DbgPrint("CLOSE  SUCCESS~~\n");

	//设置返回状态
	pIrp->IoStatus.Status = STATUS_SUCCESS;
	//返回给3环多少字节数据，没有填0
	pIrp->IoStatus.Information = 0;
	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
	return STATUS_SUCCESS;
}

3环代码

#include "stdafx.h"
#include <windows.h>
#include <winioctl.h>
#include <stdlib.h>

#define HIDE CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define SHOW CTL_CODE(FILE_DEVICE_UNKNOWN,0x801,METHOD_BUFFERED,FILE_ANY_ACCESS)
#define SYMBOL_LINK_NAME L"\\\\.\\MYKILLTOOL"

int main(int argc, char* argv[])
{
	//创建设备
	//create device link
	HANDLE h_device = CreateFileW(
		SYMBOL_LINK_NAME,//创建或打开的文件或设备的名称
		GENERIC_READ | GENERIC_WRITE,//请求对文件或设备的访问权限
		0,//文件或设备请求的共享模式,参数为零且 CreateFile 成功，则文件或设备无法共享，并且无法在文件或设备的句柄关闭之前再次打开
		0,//确定返回的句柄是否可以由子进程继承
		OPEN_EXISTING,//仅当文件或设备存在时，才打开该文件或设备
		FILE_ATTRIBUTE_NORMAL,
		NULL);

	if (h_device == INVALID_HANDLE_VALUE)
	{
		printf("访问驱动符号链接失败！\n");
		system("pause");
		return 0;
	}

	DWORD pid;
	DWORD outBuffer;
	DWORD lbret = 0;

	printf("请输入需要反调试的进程的PID ： \n");
	scanf("%d",&pid);

	if (DeviceIoControl(h_device,HIDE,&pid,sizeof(DWORD),&outBuffer,sizeof(outBuffer),&lbret,NULL))
	{
		printf("hide process %08x success , please test......\n",pid);
	}

	system("pause");

	if (DeviceIoControl(h_device,SHOW,&pid,sizeof(DWORD),&outBuffer,sizeof(outBuffer),&lbret,NULL))
	{
		printf("show process %08x success , please test......\n",pid);
	}

	system("pause");
	CloseHandle(h_device);
	return 0;
}