传说瑞星主动的一段代码

最新推荐文章于 2021-09-08 08:47:04 发布
最新推荐文章于 2021-09-08 08:47:04 发布
阅读量704 收藏
点赞数
文章标签： attributes hook access integer string descriptor

www.diybl.com　时间：2008-03-24　作者:佚名 编辑:本站 点击：　568 [评论]
-
-
#include <ntddk.h>
#include <ntimage.h>
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
    unsigned int *ServiceTableBase;
    unsigned int *ServiceCounterTableBase; //Used only in checked build
    unsigned int NumberOfServices;
    unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()

__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
#define SDT    SYSTEMSERVICE
#define KSDT KeServiceDescriptorTable
#define FILE_DEVICE_UNKNOWN            0x00000022
#define IOCTL_UNKNOWN_BASE              FILE_DEVICE_UNKNOWN
#define IOCTL_INIT                      CTL_CODE(IOCTL_UNKNOWN_BASE, 0x0800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
//补充定义数据及结构
typedef struct _INITIAL_TEB {
PVOID                StackBase;
PVOID                StackLimit;
PVOID                StackCommit;
PVOID                StackCommitMax;
PVOID                StackReserved;
} INITIAL_TEB, *PINITIAL_TEB;
typedef enum _SYSTEM_INFORMATION_CLASS
{
    SystemBasicInformation,
    SystemProcessorInformation,
    SystemPerformanceInformation,
    SystemTimeOfDayInformation,
    SystemNotImplemented1,
    SystemProcessesAndThreadsInformation,
    SystemCallCounts,
    SystemConfigurationInformation,
    SystemProcessorTimes,
    SystemGlobalFlag,
    SystemNotImplemented2,
    SystemModuleInformation,
    SystemLockInformation,
    SystemNotImplemented3,
    SystemNotImplemented4,
    SystemNotImplemented5,
    SystemHandleInformation,
    SystemObjectInformation,
    SystemPagefileInformation,
    SystemInstructionEmulationCounts,
    SystemInvalidInfoClass1,
    SystemCacheInformation,
    SystemPoolTagInformation,
    SystemProcessorStatistics,
    SystemDpcInformation,
    SystemNotImplemented6,
    SystemLoadImage,
    SystemUnloadImage,
    SystemTimeAdjustment,
    SystemNotImplemented7,
    SystemNotImplemented8,
    SystemNotImplemented9,
    SystemCrashDumpInformation,
    SystemExceptionInformation,
    SystemCrashDumpStateInformation,
    SystemKernelDebuggerInformation,
    SystemContextSwitchInformation,
    SystemRegistryQuotaInformation,
    SystemLoadAndCallImage,
    SystemPrioritySeparation,
    SystemNotImplemented10,
    SystemNotImplemented11,
    SystemInvalidInfoClass2,
    SystemInvalidInfoClass3,
    SystemTimeZoneInformation,
    SystemLookasideInformation,
    SystemSetTimeSlipEvent,
    SystemCreateSession,
    SystemDeleteSession,
    SystemInvalidInfoClass4,
    SystemRangeStartInformation,
    SystemVerifierInformation,
    SystemAddVerifier,
    SystemSessionProcessesInformation
} SYSTEM_INFORMATION_CLASS;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
    ULONG            ProcessId;
    UCHAR            ObjectTypeNumber;
    UCHAR            Flags;
    USHORT          Handle;
    PVOID            Object;
    ACCESS_MASK      GrantedAccess;
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

//私有变量
typedef struct _DEVICE_EXTENSION
{
    PDEVICE_OBJECT DeviceObject;
    PKEVENT Event;

    BOOLEAN bPCreate;
} DEVICE_EXTENSION, *PDEVICE_EXTENSION;


//    全局设备对象
PDEVICE_OBJECT g_pDeviceObject;

UNICODE_STRING g_RegPath;

//补充定义函数
NTKERNELAPI NTSTATUS ObQueryNameString (
    IN PVOID                        Object,
    IN OUT PUNICODE_STRING            Name,
    IN ULONG                        MaximumLength,
    OUT PULONG                      ActualLength
);
NTKERNELAPI NTSTATUS ZwSetSecurityObject(
    IN HANDLE Handle,
    IN SECURITY_INFORMATION SecurityInformation,
    IN PSECURITY_DESCRIPTOR SecurityDescriptor
    );
NTKERNELAPI NTSTATUS ZwTerminateProcess(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );
NTKERNELAPI NTSTATUS ZwOpenProcess(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTKERNELAPI NTSTATUS ZwOpenThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTKERNELAPI NTSTATUS ZwLoadDriver(
IN PUNICODE_STRING DriverServiceName );
NTKERNELAPI NTSTATUS ZwSetSystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );
NTKERNELAPI NTSTATUS ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );


//函数声明
NTSTATUS DriverEntry(
IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath);
void UnloadDriver(PDRIVER_OBJECT DriverObject);
NTSTATUS DispatchCreate(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchClose(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
NTSTATUS DispatchIoCtrl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp);
void StartHook(void);
void RemoveHook(void);
NTSTATUS Hook_ZwWriteFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );
NTSTATUS Hook_ZwReadFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );
NTSTATUS Hook_ZwSetSystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );
NTSTATUS Hook_ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );
NTSTATUS Hook_ZwLoadDriver(
IN PUNICODE_STRING DriverServiceName );
NTSTATUS Hook_ZwSetSecurityObject(
IN HANDLE              ObjectHandle,
IN SECURITY_INFORMATION SecurityInformationClass,
IN PSECURITY_DESCRIPTOR DescriptorBuffer);
NTSTATUS Hook_ZwOpenKey(
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes);
NTSTATUS Hook_ZwCreateKey (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL);
NTSTATUS Hook_ZwSetValueKey(
    IN HANDLE KeyHandle,
    IN PUNICODE_STRING ValueName,
    IN ULONG TitleIndex OPTIONAL,
    IN ULONG Type,
    IN PVOID Data,
    IN ULONG DataSize);
NTSTATUS Hook_ZwDeleteKey(
IN HANDLE KeyHandle);
NTSTATUS Hook_ZwDeleteValueKey(
IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);
NTSTATUS Hook_ZwOpenSection(
OUT PHANDLE            SectionHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes );
NTSTATUS Hook_ZwCreateSection(
OUT PHANDLE            SectionHandle,
IN ULONG                DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER      MaximumSize OPTIONAL,
IN ULONG                PageAttributess,
IN ULONG                SectionAttributes,
IN HANDLE              FileHandle OPTIONAL );
NTSTATUS Hook_ZwCreateProcess(
OUT PHANDLE          ProcessHandle,
IN ACCESS_MASK        DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE            ParentProcess,
IN BOOLEAN            InheritObjectTable,
IN HANDLE            SectionHandle OPTIONAL,
IN HANDLE            DebugPort OPTIONAL,
IN HANDLE            ExceptionPort OPTIONAL );
NTSTATUS Hook_ZwCreateProcessEx(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE UnknownHandle );
NTSTATUS Hook_ZwTerminateProcess(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );
NTSTATUS Hook_ZwOpenProcess(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTSTATUS Hook_ZwCreateThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE              ProcessHandle,
OUT PCLIENT_ID          ClientId,
IN PCONTEXT            ThreadContext,
IN PINITIAL_TEB        InitialTeb,
IN BOOLEAN              CreateSuspended );
NTSTATUS Hook_ZwTerminateThread(
IN HANDLE              ThreadHandle,
IN NTSTATUS            ExitStatus );
NTSTATUS Hook_ZwOpenThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );
NTSTATUS Hook_ZwCreateFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PLARGE_INTEGER      AllocationSize OPTIONAL,
IN ULONG                FileAttributes,
IN ULONG                ShareAccess,
IN ULONG                CreateDisposition,
IN ULONG                CreateOptions,
IN PVOID                EaBuffer OPTIONAL,
IN ULONG                EaLength );
NTSTATUS Hook_ZwOpenFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN ULONG                ShareAccess,
IN ULONG                OpenOptions );


NTSTATUS Hook_ZwClose(
IN HANDLE ObjectHandle );
#ifdef ALLOC_PRAGMA
#pragma alloc_text(INIT, DriverEntry)
#pragma alloc_text(INIT, StartHook)
#pragma alloc_text(PAGE, DispatchCreate)
#pragma alloc_text(PAGE, DispatchClose)
#pragma alloc_text(PAGE, DispatchIoCtrl)
#pragma alloc_text(PAGE, RemoveHook)
#pragma alloc_text(PAGE, UnloadDriver)
#pragma alloc_text(PAGE, Hook_ZwOpenKey)
#pragma alloc_text(PAGE, Hook_ZwSetSecurityObject)
#pragma alloc_text(PAGE, Hook_ZwCreateKey)
#pragma alloc_text(PAGE, Hook_ZwSetValueKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteKey)
#pragma alloc_text(PAGE, Hook_ZwDeleteValueKey)
#pragma alloc_text(PAGE, Hook_ZwOpenSection)
#pragma alloc_text(PAGE, Hook_ZwCreateSection)
#pragma alloc_text(PAGE, Hook_ZwOpenProcess)
#pragma alloc_text(PAGE, Hook_ZwTerminateProcess)
#pragma alloc_text(PAGE, Hook_ZwOpenThread)
#pragma alloc_text(PAGE, Hook_ZwCreateFile)
#pragma alloc_text(PAGE, Hook_ZwOpenFile)
#pragma alloc_text(PAGE, Hook_ZwClose)
#pragma alloc_text(PAGE, Hook_ZwLoadDriver)
#pragma alloc_text(PAGE, Hook_ZwSetSystemInformation)
#pragma alloc_text(PAGE, Hook_ZwQuerySystemInformation)
#pragma alloc_text(PAGE, Hook_ZwReadFile)
#pragma alloc_text(PAGE, Hook_ZwWriteFile)
#endif

//函数原型定义
typedef NTSTATUS (*ZWLOADDRIVER)(
IN PUNICODE_STRING DriverServiceName );

typedef NTSTATUS (*ZWCREATEFILE)(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PLARGE_INTEGER      AllocationSize OPTIONAL,
IN ULONG                FileAttributes,
IN ULONG                ShareAccess,
IN ULONG                CreateDisposition,
IN ULONG                CreateOptions,
IN PVOID                EaBuffer OPTIONAL,
IN ULONG                EaLength );

typedef NTSTATUS (*ZWOPENFILE)(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN ULONG                ShareAccess,
IN ULONG                OpenOptions );

typedef NTSTATUS (*ZWCLOSE)(
IN HANDLE              ObjectHandle );

typedef NTSTATUS (*ZWWRITEFILE)(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWREADFILE)(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL );

typedef NTSTATUS (*ZWCREATEPROCESS)(
OUT PHANDLE          ProcessHandle,
IN ACCESS_MASK        DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE            ParentProcess,
IN BOOLEAN            InheritObjectTable,
IN HANDLE            SectionHandle OPTIONAL,
IN HANDLE            DebugPort OPTIONAL,
IN HANDLE            ExceptionPort OPTIONAL);

typedef NTSTATUS (*ZWCREATEPROCESSEX)(
    OUT PHANDLE ProcessHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
    IN HANDLE ParentProcess,
    IN BOOLEAN InheritObjectTable,
    IN HANDLE SectionHandle OPTIONAL,
    IN HANDLE DebugPort OPTIONAL,
    IN HANDLE ExceptionPort OPTIONAL,
    IN HANDLE Unknown );

typedef NTSTATUS (*ZWOPENPROCESS)(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWTERMINATEPROCESS)(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWCREATETHREAD)(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE              ProcessHandle,
OUT PCLIENT_ID          ClientId,
IN PCONTEXT            ThreadContext,
IN PINITIAL_TEB        InitialTeb,
IN BOOLEAN              CreateSuspended );

typedef NTSTATUS (*ZWTERMINATETHREAD)(
IN HANDLE              ThreadHandle,
IN NTSTATUS            ExitStatus );

typedef NTSTATUS (*ZWOPENTHREAD)(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId );

typedef NTSTATUS (*ZWCREATESECTION)(
OUT PHANDLE            SectionHandle,
IN ULONG                DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER      MaximumSize OPTIONAL,
IN ULONG                PageAttributess,
IN ULONG                SectionAttributes,
IN HANDLE              FileHandle OPTIONAL );

typedef NTSTATUS (*ZWOPENSECTION)(
OUT PHANDLE            SectionHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes );

//注册表

typedef NTSTATUS (*ZWCREATEKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL
);

typedef NTSTATUS (*ZWOPENKEY) (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes
);

typedef NTSTATUS (*ZWSETVALUEKEY)(
    IN HANDLE KeyHandle,
    IN PUNICODE_STRING ValueName,
    IN ULONG TitleIndex OPTIONAL,
    IN ULONG Type,
    IN PVOID Data,
    IN ULONG DataSize
);

typedef NTSTATUS (*ZWSETSECURITYOBJECT)(
IN HANDLE              ObjectHandle,
IN SECURITY_INFORMATION SecurityInformationClass,
IN PSECURITY_DESCRIPTOR DescriptorBuffer);


typedef NTSTATUS (*ZWDELETEKEY)(
    IN HANDLE KeyHandle);
typedef NTSTATUS (*ZWDELETEVALUEKEY)(
    IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName);


typedef NTSTATUS (*ZWSETSYSTEMINFORMATION)(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength );

typedef NTSTATUS (*ZWQUERYSYSTEMINFORMATION)(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL );
   
//      SDT 原函数地址
static ZWCREATEFILE                OldZwCreateFile;
static ZWOPENFILE                OldZwOpenFile;
static ZWCLOSE                    OldZwClose;
static ZWWRITEFILE                OldZwWriteFile;
static ZWREADFILE                OldZwReadFile;
static ZWTERMINATEPROCESS        OldZwTerminateProcess;
static ZWOPENPROCESS            OldZwOpenProcess;
static ZWOPENTHREAD                OldZwOpenThread;
static ZWCREATESECTION            OldZwCreateSection;
static ZWOPENSECTION            OldZwOpenSection;
static ZWCREATEKEY                OldZwCreateKey;
static ZWSETVALUEKEY            OldZwSetValueKey;
static ZWDELETEKEY                OldZwDeleteKey;
static ZWDELETEVALUEKEY            OldZwDeleteValueKey;
static ZWSETSECURITYOBJECT        OldZwSetSecurityObject;
static ZWOPENKEY                OldZwOpenKey;

static ZWLOADDRIVER                OldZwLoadDriver;

static ZWSETSYSTEMINFORMATION    OldZwSetSystemInformation;
static ZWQUERYSYSTEMINFORMATION    OldZwQuerySystemInformation;
//挂接函数执行体
NTSTATUS Hook_ZwWriteFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PVOID                Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwWriteFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}
NTSTATUS Hook_ZwReadFile(
IN HANDLE              FileHandle,
IN HANDLE              Event OPTIONAL,
IN PIO_APC_ROUTINE      ApcRoutine OPTIONAL,
IN PVOID                ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
OUT PVOID              Buffer,
IN ULONG                Length,
IN PLARGE_INTEGER      ByteOffset OPTIONAL,
IN PULONG              Key OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwReadFile(FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,Buffer,Length,ByteOffset,Key);
    return rc;
}

NTSTATUS Hook_ZwSetSystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
IN PVOID                SystemInformation,
IN ULONG                SystemInformationLength )
{
    NTSTATUS rc;
    rc = OldZwSetSystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength);
    return rc;
}

NTSTATUS Hook_ZwQuerySystemInformation(
IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
OUT PVOID              SystemInformation,
IN ULONG                SystemInformationLength,
OUT PULONG              ReturnLength OPTIONAL )
{
    NTSTATUS rc;
    rc = OldZwQuerySystemInformation(SystemInformationClass,SystemInformation,SystemInformationLength,ReturnLength);
    return rc;
}

NTSTATUS Hook_ZwLoadDriver(
IN PUNICODE_STRING DriverServiceName )
{
    NTSTATUS rc;

    rc = OldZwLoadDriver(DriverServiceName);
    return rc;
}

NTSTATUS Hook_ZwSetSecurityObject(
IN HANDLE              ObjectHandle,
IN SECURITY_INFORMATION SecurityInformationClass,
IN PSECURITY_DESCRIPTOR DescriptorBuffer)
{

    NTSTATUS rc;

    rc = OldZwSetSecurityObject(ObjectHandle,SecurityInformationClass,DescriptorBuffer);
   
    return rc;
}


NTSTATUS Hook_ZwOpenKey(
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes)
{
    NTSTATUS rc;

    rc = OldZwOpenKey(KeyHandle,DesiredAccess,ObjectAttributes);

    return rc;
}

NTSTATUS Hook_ZwCreateKey (
    OUT PHANDLE KeyHandle,
    IN ACCESS_MASK DesiredAccess,
    IN POBJECT_ATTRIBUTES ObjectAttributes,
    IN ULONG TitleIndex,
    IN PUNICODE_STRING Class OPTIONAL,
    IN ULONG CreateOptions,
    OUT PULONG Disposition OPTIONAL
)
{
    NTSTATUS rc;

    rc = OldZwCreateKey(KeyHandle, DesiredAccess, ObjectAttributes,
        TitleIndex, Class, CreateOptions, Disposition);

    return rc;
}

NTSTATUS Hook_ZwSetValueKey(
    IN HANDLE KeyHandle,IN PUNICODE_STRING ValueName,
    IN ULONG TitleIndex OPTIONAL,
    IN ULONG Type,
    IN PVOID Data,
    IN ULONG DataSize
    )
{
    NTSTATUS rc;


    rc = OldZwSetValueKey(KeyHandle,ValueName,TitleIndex,Type,Data,DataSize);
   
    return rc;
}


NTSTATUS Hook_ZwDeleteKey(IN HANDLE KeyHandle)
{
    NTSTATUS rc;

    rc = OldZwDeleteKey(KeyHandle);

    return rc;
}


NTSTATUS Hook_ZwDeleteValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName)
{
    NTSTATUS rc;

    rc = OldZwDeleteValueKey(KeyHandle,ValueName);

    return rc;
}

NTSTATUS Hook_ZwOpenSection(
OUT PHANDLE            SectionHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes )
{
    NTSTATUS rc;
//    DbgPrint("Hook_ZwOpenSection/n");
    rc = OldZwOpenSection(SectionHandle,DesiredAccess,ObjectAttributes);
    return rc;
}

NTSTATUS Hook_ZwCreateSection(
OUT PHANDLE            SectionHandle,
IN ULONG                DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN PLARGE_INTEGER      MaximumSize OPTIONAL,
IN ULONG                PageAttributess,
IN ULONG                SectionAttributes,
IN HANDLE              FileHandle OPTIONAL )
{
    NTSTATUS rc;
//    DbgPrint("Hook_ZwCreateSection");
    return OldZwCreateSection(SectionHandle,DesiredAccess,ObjectAttributes,
                                MaximumSize,PageAttributess,SectionAttributes,FileHandle);   
    return rc;
}


NTSTATUS Hook_ZwTerminateProcess(
IN HANDLE              ProcessHandle OPTIONAL,
IN NTSTATUS            ExitStatus )
{
    NTSTATUS rc;

    rc = OldZwTerminateProcess(ProcessHandle,ExitStatus);
    return rc;
}

NTSTATUS Hook_ZwOpenProcess(
OUT PHANDLE            ProcessHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId )

{
    NTSTATUS rc;

    rc = OldZwOpenProcess(ProcessHandle,AccessMask,ObjectAttributes,ClientId);
    return rc;
}


NTSTATUS Hook_ZwOpenThread(
OUT PHANDLE            ThreadHandle,
IN ACCESS_MASK          AccessMask,
IN POBJECT_ATTRIBUTES ObjectAttributes,
IN PCLIENT_ID          ClientId )
{
    NTSTATUS rc;

    rc = OldZwOpenThread(ThreadHandle,AccessMask,ObjectAttributes,ClientId);

    return rc;
}

NTSTATUS Hook_ZwCreateFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN PLARGE_INTEGER      AllocationSize OPTIONAL,
IN ULONG                FileAttributes,
IN ULONG                ShareAccess,
IN ULONG                CreateDisposition,
IN ULONG                CreateOptions,
IN PVOID                EaBuffer OPTIONAL,
IN ULONG                EaLength )
{
    NTSTATUS rc;

    rc = OldZwCreateFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,
                            AllocationSize,FileAttributes,ShareAccess,CreateDisposition,
                            CreateOptions,EaBuffer,EaLength);

    return rc;
}

NTSTATUS Hook_ZwOpenFile(
OUT PHANDLE            FileHandle,
IN ACCESS_MASK          DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes,
OUT PIO_STATUS_BLOCK    IoStatusBlock,
IN ULONG                ShareAccess,
IN ULONG                OpenOptions )
{
    NTSTATUS rc;

    rc = OldZwOpenFile(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock,ShareAccess,
                            OpenOptions);

    return rc;
}


NTSTATUS Hook_ZwClose(
IN HANDLE              ObjectHandle )
{
    NTSTATUS rc;

    //在这里执行扫描必须十分注意,否则容易蓝屏

    rc = OldZwClose(ObjectHandle);
    return rc;
}
NTSTATUS DriverEntry(
    IN PDRIVER_OBJECT DriverObject,
    IN PUNICODE_STRING RegistryPath
    )
{
    NTSTATUS        ntStatus;
    UNICODE_STRING uszDriverString;
    UNICODE_STRING uszDeviceString;
    UNICODE_STRING uszEventString;
    PDEVICE_OBJECT    pDeviceObject;
    PDEVICE_EXTENSION extension;
    // 初始化设备对象名
    RtlInitUnicodeString(&uszDriverString, L"//Device//ITSys");
    // 创建并初始化对象
    ntStatus = IoCreateDevice(
        DriverObject,
        sizeof(DEVICE_EXTENSION),
        &uszDriverString,
        FILE_DEVICE_UNKNOWN,
        0,
        FALSE,
        &pDeviceObject
        );
    if(ntStatus != STATUS_SUCCESS)
        return ntStatus;
    extension = pDeviceObject->DeviceExtension;
    RtlInitUnicodeString(&uszDeviceString, L"//DosDevices//ITSys");
    // 创建用户可见连接名称
    ntStatus = IoCreateSymbolicLink(&uszDeviceString, &uszDriverString);
    if(ntStatus != STATUS_SUCCESS)
    {
        // 创建失败，删除对象并返回错误值
        IoDeleteDevice(pDeviceObject);
        return ntStatus;
    }
    // 赋值全局设备对象指针

    // Assign global pointer to the device object for use by the callback functions
    g_pDeviceObject = pDeviceObject;
    // 设置所有可用的DeviceIoControl的处理IRP的函数

DriverObject->DriverUnload                            = UnloadDriver;
    DriverObject->MajorFunction[IRP_MJ_CREATE]            = DispatchCreate;
    DriverObject->MajorFunction[IRP_MJ_CLOSE]            = DispatchClose;
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]    = DispatchIoCtrl;

#if DBG
    KdPrint(("RegistryPath : %ws/n",RegistryPath->Buffer));
#endif

    //SDT挂接
    StartHook();

    return ntStatus;
}

void StartHook (void)
{
    //获取未导出的服务函数索引号
    HANDLE    hFile;
    PCHAR    pDllFile;
    ULONG ulSize;
    ULONG ulByteReaded;

    __asm
    {
        push    eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    //挂接SDT函数
    OldZwCreateFile                    = (ZWCREATEFILE)    InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateFile),
                                                        (LONG)Hook_ZwCreateFile);
    OldZwOpenFile                    = (ZWOPENFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenFile),
                                                        (LONG)Hook_ZwOpenFile);
    OldZwClose                        = (ZWCLOSE)            InterlockedExchange((PLONG)
                                                        &SDT(ZwClose),
                                                        (LONG)Hook_ZwClose);
    OldZwReadFile                    = (ZWREADFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwReadFile),
                                                        (LONG)Hook_ZwReadFile);
    OldZwWriteFile                    = (ZWWRITEFILE)        InterlockedExchange((PLONG)
                                                        &SDT(ZwWriteFile),
                                                        (LONG)Hook_ZwWriteFile);

    OldZwTerminateProcess            = (ZWTERMINATEPROCESS)InterlockedExchange((PLONG)
                                                        &SDT(ZwTerminateProcess),
                                                        (LONG)Hook_ZwTerminateProcess);

    OldZwOpenProcess                = (ZWOPENPROCESS)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenProcess),
                                                        (LONG)Hook_ZwOpenProcess);

    OldZwOpenThread                    = (ZWOPENTHREAD)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenThread),
                                                        (LONG)Hook_ZwOpenThread);
    OldZwCreateSection                = (ZWCREATESECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateSection),
                                                        (LONG)Hook_ZwCreateSection);
    OldZwOpenSection                = (ZWOPENSECTION)InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenSection),
                                                        (LONG)Hook_ZwOpenSection);

    OldZwOpenKey                    = (ZWOPENKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwOpenKey),ZwOpenKey);
    OldZwCreateKey                    = (ZWCREATEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwCreateKey),
                                                        (LONG)Hook_ZwCreateKey);
    OldZwSetValueKey                = (ZWSETVALUEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwSetValueKey),   
                                                        (LONG)Hook_ZwSetValueKey);
    OldZwDeleteKey                    = (ZWDELETEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwDeleteKey),
                                                        (LONG)Hook_ZwDeleteKey);
    OldZwDeleteValueKey                = (ZWDELETEVALUEKEY) InterlockedExchange((PLONG)
                                                        &SDT(ZwDeleteValueKey),
                                                        (LONG)Hook_ZwDeleteValueKey);
    OldZwSetSecurityObject            = (ZWSETSECURITYOBJECT)InterlockedExchange((PLONG)
                                                        &SDT(ZwSetSecurityObject),
                                                        (LONG)Hook_ZwSetSecurityObject);

    OldZwLoadDriver                    = (ZWLOADDRIVER)InterlockedExchange((PLONG)
                                                        &SDT(ZwLoadDriver),
                                                        (LONG)Hook_ZwLoadDriver);

    OldZwSetSystemInformation        = (ZWSETSYSTEMINFORMATION)InterlockedExchange((PLONG)
                                                        &SDT(ZwSetSystemInformation),
                                                        (LONG)Hook_ZwSetSystemInformation);

    OldZwQuerySystemInformation        = (ZWQUERYSYSTEMINFORMATION)InterlockedExchange((PLONG)
                                                        &SDT(ZwQuerySystemInformation),
                                                        (LONG)Hook_ZwQuerySystemInformation);

    //关闭
    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
    return ;
}

void RemoveHook (void)
{
    __asm
    {
        push    eax
        mov        eax, CR0
        and        eax, 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }

    InterlockedExchange( (PLONG) &SDT(ZwCreateFile)                , (LONG) OldZwCreateFile                );
    InterlockedExchange( (PLONG) &SDT(ZwOpenFile)                , (LONG) OldZwOpenFile                    );
    InterlockedExchange( (PLONG) &SDT(ZwClose)                    , (LONG) OldZwClose                    );
    InterlockedExchange( (PLONG) &SDT(ZwReadFile)                , (LONG) OldZwReadFile                    );
    InterlockedExchange( (PLONG) &SDT(ZwWriteFile)                , (LONG) OldZwWriteFile                );

    InterlockedExchange( (PLONG) &SDT(ZwTerminateProcess)        , (LONG) OldZwTerminateProcess            );
    InterlockedExchange( (PLONG) &SDT(ZwOpenProcess)            , (LONG) OldZwOpenProcess                );
    InterlockedExchange( (PLONG) &SDT(ZwOpenThread)                , (LONG) OldZwOpenThread                );
    InterlockedExchange( (PLONG) &SDT(ZwCreateSection)            , (LONG) OldZwCreateSection            );
    InterlockedExchange( (PLONG) &SDT(ZwOpenSection)            , (LONG) OldZwOpenSection                );
; InterlockedExchange( (PLONG) &SDT(ZwOpenKey)                , (LONG) OldZwOpenKey                    );
    InterlockedExchange( (PLONG) &SDT(ZwCreateKey)                , (LONG) OldZwCreateKey                );
    InterlockedExchange( (PLONG) &SDT(ZwSetValueKey)            , (LONG) OldZwSetValueKey                );
    InterlockedExchange( (PLONG) &SDT(ZwDeleteKey)                , (LONG) OldZwDeleteKey                );
    InterlockedExchange( (PLONG) &SDT(ZwDeleteValueKey)            , (LONG) OldZwDeleteValueKey            );
    InterlockedExchange( (PLONG) &SDT(ZwSetSecurityObject)        , (LONG) OldZwSetSecurityObject        );

    InterlockedExchange( (PLONG) &SDT(ZwLoadDriver)                , (LONG) OldZwLoadDriver                );

    InterlockedExchange( (PLONG) &SDT(ZwSetSystemInformation)    , (LONG) OldZwSetSystemInformation        );
    InterlockedExchange( (PLONG) &SDT(ZwQuerySystemInformation)    , (LONG) OldZwQuerySystemInformation    );

    __asm
    {
        push    eax
        mov        eax, CR0
        or        eax, NOT 0FFFEFFFFh
        mov        CR0, eax
        pop        eax
    }
}

void UnloadDriver(IN PDRIVER_OBJECT DriverObject)
{
    UNICODE_STRING uszDeviceString;
    NTSTATUS        ntStatus;


    //移除挂接
    RemoveHook();

    IoDeleteDevice(DriverObject->DeviceObject);

    RtlInitUnicodeString(&uszDeviceString, L"//DosDevices//ITSys");
    IoDeleteSymbolicLink(&uszDeviceString);

}

xxagri
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
内核钩子2.0
07-26
KBMHOOK(Keyboard Mapper Advance)是一款能够映射、置换键位的软件，通过它您可以解决一些在使用时感到键位不适、但应用程序并未提供键位设置功能的问题。KBMHOOK属于免费软件，著作权为LOVEHINA-AVC(Advance)所有，这意味着您可以在自己的权利范围内自由的使用它，但作者不承担任何运行该软件所带来的风险和意外损失。2.0版的变更点如下： 1.基于内核键盘类过滤驱动，相对于1.03版的低级键盘钩子而言，内核驱动无延迟，且更有效率。 2.能够区分物理击键来源，在接入多块键盘时可以重用相同的键位。 3.基本上通杀所有应用，即使是采用了Direct Input的游戏也能够正常重用原来的键位。 4.改进了存档功能。
内核钩子模板
lbird
10-16 2128
#include #include #pragma pack(1)typedef struct ServiceDescriptorEntry {    unsigned int *ServiceTableBase;    unsigned int *ServiceCounterTableBase; //Used only in checked build    unsigned int Numbe
重载内核实现绕过一切钩子
weixin_30390075的博客
09-09 414
很久不玩PE格式了，这次由于要恢复SSDT表的缘故+一个忽然兴起的念头，导致我花了一个小午写了个运行在Ring0的简单PE加载器，并且有意外的收获。 恢复SSDT表手段很多，基本上都是直接从文件中依赖重定位表获取对应数据，重定位后得到相对当前内核加载位置的正确调用地址。大部分的实现代码比较粗糙，因为要不停的在文件地址和内存地址之间进行转换，因此代码繁琐不易读懂。 我在考虑解放方案的时...
xuetrue 查看 内核驱动钩子
08-28
黑客必备工具，内核驱动钩子；查看被挂钩的教程，隐藏进程
内核钩子学习
bcbobo21cn的专栏
05-10 860
如何建立内核级钩子控制操作系统实现程序隐身 我们知道，应用程序总是离不开系统内核所提供的服务，比如它要使用内存的时候，只要跟操作系统申请就行了，而不用自己操心哪里有空闲的内存空间等问题，实际上，这些问题是由操作系统的内核来代劳的。站在黑客的角度讲，如果能够控制内核，实际上就是控制了内核之上的各种应用程序。本文将向您介绍如何建立内核级钩子来控制操作系统向上提供的各种低级功能。有了内核级钩子，我们不但能够控制、监视其他程序并过滤有关数据，还能用其实现Rootkit本身及其它程序的隐形。 本文首先回顾系统调用
仿瑞星小狮子界面VB6.0源代码.rar
04-13
《仿瑞星小狮子界面VB6.0源代码解析与探讨》 VB6.0，全称Visual Basic 6.0，是微软公司推出的一种基于事件驱动的编程环境，广泛应用于Windows应用程序开发。该编程语言以其易学易用、丰富的控件库以及强大的集成...
GH0ST源码过瑞星主动
10-27
【标题】"GH0ST源码过瑞星主动"指的是一个针对瑞星主动防御机制的规避技术，涉及到了恶意软件的开发与反病毒软件的绕过策略。GH0ST是一种远程访问工具（RAT），通常被用作恶意软件，允许攻击者在目标计算机上进行...
C# 类似瑞星小狮子的程序代码.rar
12-11
描述中提到的"C# 类似瑞星小狮子的程序代码.rar By Goosoz"表明这是由Goosoz开发的一个项目，他将源代码打包成RAR压缩文件分享出来。RAR是一种流行的文件压缩格式，用于存储多个文件在一个单一的档案中，便于分享和...
过卡巴瑞星主动防御
08-04
在本例中，"过卡巴瑞星主动防御.exe"可能是一个尝试绕过卡巴斯基主动防御的工具，这可能是为了测试系统的安全性，也可能是出于非法目的。"新建 文本文档.txt"可能是相关说明或日志文件。 总的来说，理解和正确配置...
瑞星源代码（欢迎大家讨论）
03-01
关于瑞星的一些源代码，欢迎大家一起讨论，踊跃发言.提供的代码仅供个人参考！
内核钩子的一个小demo
Begin From C++
08-10 786
前几日学习了内核Hook，兴趣使然，写了一个小Demo，代码如下，供大家分享 这个Demo的作用是禁止鼠标和键盘的操作，有点邪恶-，-，请慎用（界面没做修改只是hook了windows事件消息） // HookTestDlg.cpp : implementation file
抹掉所有进程中自己的句柄(源代码)
12-09 2145
 by  achillis之前听过一个检测进程的想法，就是暴力枚举所有进程中的handle,查找其中类型为PROCESS的．此法也被炉子牛用于他的LzOpenProcess()．下面我就写了一断代码来对抗这个方法，纯属小伎俩，牛牛们飘过～严格说，此段代码不算原创，是从某rootkit的bin中扒出来的，因此基本保留其原貌，经我修改测试，主要函数如下：Copy codevoid CloseAllmy
阻止windows关机时自动结束进程，导致数据丢失或异常
C++入门到放弃
12-08 2782
阻止windows关机或注销操作
Windows Hook的简单介绍——此树是我栽，此路是我开
CodeBowl的博客
09-08 2381
千里之行，始于足下！ 今天是正式启程的第一天，一直明白自己的缺点就是不够坚持，同时没有坚定目标，或许是目标不够诱人吧。但是如果我可以成为这个领域中相当牛逼的人，那还是十分有吸引力的。 之前学习的过程中，学会了一项技术，时常感觉“无用武之地”，这应该是我自己学习的一个误区，之后自己会多在实战中检验技术，也希望有大佬多多指点。 本文内容 本文将简单介绍Windows Hook的基本内容，以及一些自己的看法，希望可以帮助您快速了解这一内容。 HOOK是什么？ Hook，中文里常常被译作“钩子”或者“挂钩”，其实是
Zw 系列函数
huanongying131的博客
11-19 3618
转：http://blog.sina.com.cn/s/blog_4a1acc7f0100cfud.html      896  37F 0000D379 ZwAcceptConnectPort         897  380 0000D38E ZwAccessCheck         898  381 0000D3A3 ZwAccessCheckAndAuditAlarm         ...
一句代码提升进程权限
weixin_30845171的博客
01-13 271
RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE,1,0,NULL);这个函数封装在NtDll.dll中（在所有DLL加载之前加载），被微软严格保密，就是说你在MSDN上查不到关于他的任何信息。.常量SE_BACKUP_PRIVILEGE,"17",公开.常量SE_RESTORE_PRIVILEGE,"18",公开.常量SE_SHUTDOWN_PRIVILE...
ZwOpenFile [WDK翻译]
死胖子的博客
02-03 1770
ZwOpenFile 提供了一个句柄，通过它可以操作一个文件的数据或者是文件状态，或是文件的属性。ZwOpenFile 提供了ZwCreateFile的一个功能子集（ZwCreateFile能做更多事）.
瑞星ESM操作手册：企业终端安全管理详解
《瑞星ESM操作手册》是一份详尽的指南，专为企业用户提供瑞星防病毒软件在企业终端安全管理中的应用和操作指导。该手册针对北京瑞星信息技术股份有限公司的各类企业级产品，如网络版杀毒软件、企业终端安全管理系统...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值