白驱动 Kill AV/EDR（上）

#include <ntddk.h>
void DriverUnload(PDRIVER_OBJECT pDriverObject);
//入口函数，相当于mainNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath){
  UNREFERENCED_PARAMETER(pRegPath); // 解决pRegPath 变量的未引用报警  KdPrint(("DriverEntry okn"));  NTSTATUS status = STATUS_SUCCESS;  pDriverObject->DriverUnload = DriverUnload;
  return status;}//用于驱动程序卸载时执行void DriverUnload(PDRIVER_OBJECT pDriverObject){  UNREFERENCED_PARAMETER(pDriverObject);  KdPrint(("DriverUnload okn"));
  return;}

#本机打开测试签名模式，并重启bcdedit /set testsigning on#安装驱动sc create DriverTest type= kernel binPath= "C:UsersAdministratorMyDriver.sys"#加载驱动sc start DriverTest#卸载驱动sc stop DriverTest

#include <ntddk.h>
typedef struct {
  ULONG ThreadId;  ULONG Create_ProcessId;  ULONG Belong_ProcessId;
}ThreadData;typedef struct {  LIST_ENTRY Entry;  ThreadData Data;}Item;
typedef struct {  FAST_MUTEX Mutex;  ULONG ItemCount;  LIST_ENTRY Header;}Global;//全局变量Global global;void DriverUnload(PDRIVER_OBJECT pDriverObject);void ThreadNotify(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create);NTSTATUS DispatchFuncRead(PDEVICE_OBJECT DeviceObject, PIRP Irp);NTSTATUS DispatchFuncDefault(PDEVICE_OBJECT DeviceObject, PIRP Irp);void PushItem(LIST_ENTRY* entry);//入口函数，相当于mainNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath){  UNREFERENCED_PARAMETER(pRegPath);  UNICODE_STRING DevName = RTL_CONSTANT_STRING(L"\Device\RemoteThreadDev");  //创建设备对象  PDEVICE_OBJECT DeviceObject;  NTSTATUS status = IoCreateDevice(pDriverObject, 0, &DevName, FILE_DEVICE_UNKNOWN, 0, 0, &DeviceObject);  if (!NT_SUCCESS(status)) {    KdPrint(("设备对象创建失败 (0x%08X)n",status));    return status;  }  DeviceObject->Flags |= DO_DIRECT_IO;  //提供符号链接使得设备能够被用户态的调用者访问  //下面创建了一个符号链接并将其与我们的设备对象连接起来  UNICODE_STRING SymbolicLink = RTL_CONSTANT_STRING(L"\??\RemoteThreadCheck");  status = IoCreateSymbolicLink(&SymbolicLink, &DevName);
  if (!NT_SUCCESS(status)) {    KdPrint(("符号链接创建失败 (0x%08X)n", status));    //创建失败时 要销毁设备对象    IoDeleteDevice(DeviceObject);    return status;  }  //此函数是用于注册线程创建和销毁的回调通知  status = PsSetCreateThreadNotifyRoutine(ThreadNotify);  if (!NT_SUCCESS(status)) {    KdPrint(("注册线程回调失败 (0x%08X)n", status));    //失败情况需要销毁申请的句柄    IoDeleteDevice(DeviceObject);    IoDeleteSymbolicLink(&SymbolicLink);    return status;
  }  KdPrint(("线程回调注册成功n"));
  pDriverObject->DriverUnload = DriverUnload;
  InitializeListHead(&global.Header);//初始化链表头 LIST_ENTRY结构的双向链表  ExInitializeFastMutex(&global.Mutex);
  //指定Create和 Close 分发例程  pDriverObject->MajorFunction[IRP_MJ_CLOSE] = pDriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchFuncDefault;  //指定读设备对象的分发例程  pDriverObject->MajorFunction[IRP_MJ_READ] = DispatchFuncRead;
  status = STATUS_SUCCESS;  return status;}
NTSTATUS DispatchFuncRead(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
  UNREFERENCED_PARAMETER(DeviceObject);
  PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);  //缓冲区长度  ULONG len = stack->Parameters.Read.Length;
  ULONG count = 0;
  NT_ASSERT(Irp->MdlAddress);
  //获取缓冲区地址  //此函数返回MdlAddress描述的缓冲区非分页系统虚拟机地址  UCHAR* buffer = (UCHAR*)MmGetSystemAddressForMdlSafe(Irp->MdlAddress, NormalPagePriority);   if (!buffer) {    KdPrint(("获取缓冲区非分页虚拟地址失败"));    return STATUS_UNSUCCESSFUL;  }
  ExAcquireFastMutex(&global.Mutex);
  //一次性将链表中的内容读出来  while (1) {
    if (IsListEmpty(&global.Header)) break;
    PLIST_ENTRY entry = RemoveHeadList(&global.Header);//去除第一个
    Item* info = CONTAINING_RECORD(entry, Item, Entry);//找到Item结构体地址
    ULONG size = sizeof(ThreadData);
    if (len < size) {
      //如果缓冲区长度不够 就将原数据插回去 然后在退出      InsertTailList(&global.Header, entry);      break;    }
    global.ItemCount--;
    //复制到缓冲区    memcpy(buffer, &info->Data, size);
    buffer += size;
    len -= size;
    count += size;
    ExFreePool(info);
  }
  ExReleaseFastMutex(&global.Mutex);  //向用户进程响应请求完成的代码  Irp->IoStatus.Information = count;
  Irp->IoStatus.Status = STATUS_SUCCESS;
  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;
}

//此分发例程只需要返回请求成功的状态代码NTSTATUS DispatchFuncDefault(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
  UNREFERENCED_PARAMETER(DeviceObject);  Irp->IoStatus.Information = 0;  Irp->IoStatus.Status = STATUS_SUCCESS;  IoCompleteRequest(Irp, IO_NO_INCREMENT);
  return STATUS_SUCCESS;}

//用于驱动程序卸载时执行void DriverUnload(PDRIVER_OBJECT pDriverObject){  UNICODE_STRING symLink = RTL_CONSTANT_STRING(L"\??\RemoteThreadCheck");  IoDeleteSymbolicLink(&symLink);  IoDeleteDevice(pDriverObject->DeviceObject);
  PsRemoveCreateThreadNotifyRoutine(ThreadNotify);
  //清除整个链表  while (!IsListEmpty(&global.Header)) {    PLIST_ENTRY item = RemoveHeadList(&global.Header);    Item* fullitem = CONTAINING_RECORD(item, Item, Entry);    ExFreePool(fullitem);  }  KdPrint(("DriverUnload okn"));  return;}//触发线程创建销毁时执行void ThreadNotify(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create) {  if (Create) {    //如果线程的所属进程和创建的进程不一致，说明这个线程是远程进程创建的。    //这里只收集新线程的信息，判断处理交给用户态进程    Item* item = (Item *)ExAllocatePool2(POOL_FLAG_PAGED, sizeof(Item), 'abcd');    if (item) {      item->Data.ThreadId = HandleToUlong(ThreadId);      item->Data.Create_ProcessId = HandleToUlong(PsGetCurrentProcessId());      item->Data.Belong_ProcessId = HandleToUlong(ProcessId);      //所有新进程的第一个线程都是由pid为4的System进程创建的，所以需要排除      if (item->Data.Create_ProcessId != item->Data.Belong_ProcessId && item->Data.Create_ProcessId !=4) {        //到这步检测已完成        KdPrint(("检测到远程线程注入,tid %d ,cpid %d , bpid %dn", item->Data.ThreadId, item->Data.Create_ProcessId, item->Data.Belong_ProcessId));        //但是需要把数据传回到用户态的进程，以便弹窗显示威胁        //将LIST_ENTRY存储到双向链表中        PushItem(&item->Entry);      }      //ExFreePool(item);    }      }}
void PushItem(LIST_ENTRY* entry) {
  ExAcquireFastMutex(&global.Mutex);
  if (global.ItemCount > 1024) { //大于1024个就删除第一个添加的程序
    PLIST_ENTRY pitem = RemoveHeadList(&global.Header);    //CONTAINING_RECORD 根据结构体成员变量的地址计算出结构体地址    ExFreePool(CONTAINING_RECORD(pitem, Item, Entry));
    global.ItemCount--;
  }  //插入新数据  InsertTailList(&global.Header, entry);  global.ItemCount++;  ExReleaseFastMutex(&global.Mutex);}

#include <windows.h>#include <stdio.h>#include <Psapi.h>#pragma comment(lib,"psapi.lib")typedef struct {
    ULONG ThreadId;    ULONG Create_ProcessId;    ULONG Belong_ProcessId;
}ThreadData;
CHAR* GetPathByProcessId(DWORD dwPid){    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);    if (hProcess == NULL)        return NULL;    CHAR* path = (CHAR*)calloc(MAX_PATH,1);    GetModuleFileNameExA(hProcess, NULL, path, MAX_PATH);    return path;}
int main() {    HANDLE hFile = CreateFile(L"\\.\RemoteThreadCheck", GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
    if (hFile == INVALID_HANDLE_VALUE) {
        printf("设备对象打开失败n");        return 0;
    }    while (1) {        BYTE* buffer = (BYTE*)calloc(1024*200, 1);        if (buffer == NULL) return 0;        DWORD bytes = 0;        ReadFile(hFile, buffer, 1024, &bytes, 0);        while (bytes > 0) {            ThreadData* item = (ThreadData*)buffer;            printf("ThreadId:%d, BelongPid:%d, CreatePid:%dn", item->ThreadId, item->Belong_ProcessId, item->Create_ProcessId);            CHAR* WarningText = (CHAR*)calloc(1024*20,1);            if (WarningText == NULL) return 0;            CHAR* process1 = GetPathByProcessId(item->Create_ProcessId);            CHAR* process2 = GetPathByProcessId(item->Belong_ProcessId);            if (process1 && process2 && process1[0]!='�' && process2[0] != '�') {                sprintf_s(WarningText, 1024 * 20, "进程:n %s n在向进程:n %s n进行远程线程注入, 注入的线程ID为: %d", process1, process2, item->ThreadId);                MessageBoxA(NULL, WarningText, "警告", MB_OK);            }            buffer += sizeof(ThreadData);            bytes -= sizeof(ThreadData);        }
        Sleep(1000);
    }
}

#define _CRT_SECURE_NO_WARNINGS
#include <windows.h>#include <Windows.h>
#include <stdio.h>
int main() {
    char szdllname[MAX_PATH] ="kernel32.dll";
    int pid;
    printf("input pidrn");
    scanf("%d", &pid);
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
    LPVOID addralloc = VirtualAllocEx(hProcess, NULL, strlen(szdllname), MEM_COMMIT, PAGE_READWRITE);
    if (!addralloc) {
        printf("alloc mem err!rn");
        return -1;    }
    if (!WriteProcessMemory(hProcess, addralloc, szdllname, strlen(szdllname), 0)) {
        printf("wirte mem err!rn");
        return -2;
    }
    //获取LoadLibraryA的地址
    PTHREAD_START_ROUTINE pLoadLibrary = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandleA("kernel32.dll")
        , "LoadLibraryA");
    if (!pLoadLibrary) {
        printf("pLoadLibrary mem err!rn");
        return -3;
    }
    HANDLE hThread = CreateRemoteThread(hProcess, 0, 0, pLoadLibrary, addralloc, 0, 0);
    if (!hThread) {
        printf("CreateRemoteThread err!rn");
        return -4;
    }
    WaitForSingleObject(hThread, INFINITE);
    printf("dll injected successly!rn");    system("pause");    return 0;
}

#include <ntddk.h>

//需要保护的进程pidULONG ToProtectPid = 9132;
#define PROCESS_TERMINATE 1PVOID RegHandle = NULL;void DriverUnload(PDRIVER_OBJECT pDriverObject);OB_PREOP_CALLBACK_STATUS OnPreOpenProcess(PVOID  RegistrationContext , POB_PRE_OPERATION_INFORMATION Info);//入口函数，相当于mainNTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegPath){
  UNREFERENCED_PARAMETER(pRegPath); 
  OB_OPERATION_REGISTRATION operations[] = {    {      PsProcessType,          OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE,      OnPreOpenProcess, NULL    }  };  OB_CALLBACK_REGISTRATION reg = {    OB_FLT_REGISTRATION_VERSION,    1,            RTL_CONSTANT_STRING(L"12345.6171"),      NULL,        operations  };
    NTSTATUS status = ObRegisterCallbacks(&reg, &RegHandle);  if (!NT_SUCCESS(status)) {    KdPrint(("failed to register callbacksn"));    return status;  }

  KdPrint(("DriverEntry okn"));  status = STATUS_SUCCESS;  pDriverObject->DriverUnload = DriverUnload;
  return status;}//用于驱动程序卸载时执行void DriverUnload(PDRIVER_OBJECT pDriverObject){  UNREFERENCED_PARAMETER(pDriverObject);  //取消注册  ObUnRegisterCallbacks(RegHandle);  KdPrint(("DriverUnload okn"));
  return;}
OB_PREOP_CALLBACK_STATUS OnPreOpenProcess(PVOID  RegistrationContext , POB_PRE_OPERATION_INFORMATION Info) {  UNREFERENCED_PARAMETER(RegistrationContext);  if (Info->KernelHandle)    return OB_PREOP_SUCCESS;
  PEPROCESS process = (PEPROCESS)Info->Object;  ULONG pid = HandleToULong(PsGetProcessId(process));  //是否匹配  if (pid == ToProtectPid) {    Info->Parameters->CreateHandleInformation.DesiredAccess &= ~PROCESS_TERMINATE;  }
  return OB_PREOP_SUCCESS;}