madchook 驱动逆向伪代码( ida pro机器逆向)

楼主^#

更多发布于：2008-06-01 10:57

/* This file has been generated by the Hex-Rays decompiler.
   Copyright (c) 2007 Hex-Rays sprl <info@hex-rays.com>

   Detected compiler: Visual C++
*/

#include <windows.h>
#include <defs.h>

//-------------------------------------------------------------------------
// Data declarations

extern const WCHAR SourceString[]; // idb
extern void *dword_10740; // idb

//-------------------------------------------------------------------------
// Function declarations

#define __thiscall __cdecl // Test compile in C mode

int __stdcall sub_10280(int a1, int a2, int a3, int a4, int a5, int a6);
bool __cdecl sub_102A0();
__int32 __stdcall NotifyRoutine(HANDLE a1, HANDLE a2, BOOLEAN a3); // idb
int __stdcall DriverDispatch(int a1, PIRP Irp); // idb
int __stdcall DriverEntry(int a1, int a2);
// void *__cdecl memcpy(void *, const void *, size_t); idb
// int __stdcall ObOpenObjectByPointer(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD); weak
// NTSTATUS __stdcall PsSetCreateProcessNotifyRoutine(PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine, BOOLEAN Remove); idb
// NTSTATUS __stdcall ZwClose(HANDLE Handle); idb
// NTSTATUS __stdcall ZwUnmapViewOfSection(HANDLE ProcessHandle, PVOID BaseAddress); idb
// PVOID __stdcall ExAllocatePoolWithTag(POOL_TYPE PoolType, SIZE_T NumberOfBytes, ULONG Tag); idb
// NTSTATUS __stdcall ZwMapViewOfSection(HANDLE SectionHandle, HANDLE ProcessHandle, PVOID *BaseAddress, ULONG ZeroBits, ULONG CommitSize, PLARGE_INTEGER SectionOffset, PULONG ViewSize, SECTION_INHERIT InheritDisposition, ULONG AllocationType, ULONG Protect); idb
// NTSTATUS __stdcall ZwOpenSection(PHANDLE SectionHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes); idb
// void __stdcall RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString); idb
// LONG_PTR __fastcall ObfDereferenceObject(PVOID Object); idb
// NTSTATUS __stdcall ZwAllocateVirtualMemory(HANDLE ProcessHandle, PVOID *BaseAddress, ULONG ZeroBits, PULONG AllocationSize, ULONG AllocationType, ULONG Protect); idb
// int __thiscall PsLookupProcessByProcessId(_DWORD, _DWORD, _DWORD); weak
// void __fastcall IofCompleteRequest(PIRP Irp, CCHAR PriorityBoost); idb

//----- (00010280) --------------------------------------------------------
int __stdcall sub_10280(int a1, int a2, int a3, int a4, int a5, int a6)
{
  int result; // eax@1

  result = a1;
  __asm { int 2Eh ; DOS 2+ internal - EXECUTE COMMAND }
  return result;
}

//----- (000102A0) --------------------------------------------------------
bool __cdecl sub_102A0()
{
  PVOID BaseAddress; // [sp+8h] [bp-24h]@2
  UNICODE_STRING DestinationString; // [sp+Ch] [bp-20h]@2
  OBJECT_ATTRIBUTES ObjectAttributes; // [sp+14h] [bp-18h]@2
  HANDLE Handle; // [sp+4h] [bp-28h]@2
  ULONG ViewSize; // [sp+0h] [bp-2Ch]@3

  if ( !dword_10740 )
  {
   BaseAddress = 0;
   RtlInitUnicodeString(&DestinationString, L"\\BaseNamedObjects\\mchInjDrvMap");
   ObjectAttributes.Length = 24;
   ObjectAttributes.RootDirectory = 0;
   ObjectAttributes.ObjectName = &DestinationString;
   ObjectAttributes.Attributes = 0;
   ObjectAttributes.SecurityDescriptor = 0;
   ObjectAttributes.SecurityQualityOfService = 0;
   if ( !ZwOpenSection(&Handle, 4u, &ObjectAttributes) )
   {
   ViewSize = 0;
   if ( !ZwMapViewOfSection(Handle, (HANDLE)0xFFFFFFFF, &BaseAddress, 0, 0, 0, &ViewSize, ViewShare, 0, 2u) )
   {
   dword_10740 = ExAllocatePoolWithTag(PagedPool, *(_DWORD *)BaseAddress, 0);
   if ( dword_10740 )
   memcpy(dword_10740, BaseAddress, *(_DWORD *)BaseAddress);
   ZwUnmapViewOfSection((HANDLE)0xFFFFFFFF, BaseAddress);
   }
   ZwClose(Handle);
   }
  }
  return dword_10740 != 0;
}

//----- (00010390) --------------------------------------------------------
__int32 __stdcall NotifyRoutine(HANDLE a1, HANDLE a2, BOOLEAN a3)
{
  __int32 result; // eax@1
  PVOID Object; // [sp+24h] [bp-4h]@3
  HANDLE Handle; // [sp+20h] [bp-8h]@4
  PVOID BaseAddress; // [sp+18h] [bp-10h]@5
  ULONG AllocationSize; // [sp+1Ch] [bp-Ch]@5
  char v8; // [sp+Ch] [bp-1Ch]@7
  char v9; // [sp+10h] [bp-18h]@8
  int v10; // [sp+4h] [bp-24h]@10
  signed int v11; // [sp+8h] [bp-20h]@10
  int v12; // [sp+0h] [bp-28h]@10
  char v13; // [sp+11h] [bp-17h]@11
  char v14; // [sp+12h] [bp-16h]@11
  char v15; // [sp+13h] [bp-15h]@11
  char *v16; // [sp+14h] [bp-14h]@11

  result = a3;
  if ( a3 )
  {
   result = sub_102A0();
   if ( (unsigned __int8)result )
   {
   result = PsLookupProcessByProcessId((unsigned __int8)result, a2, &Object);
   if ( !result )
   {
   if ( !ObOpenObjectByPointer(Object, 0, 0, 2035711, 0, 0, &Handle) )
   {
   BaseAddress = (PVOID)1903165440;
   AllocationSize = *(_DWORD *)dword_10740;
   if ( !ZwAllocateVirtualMemory(Handle, &BaseAddress, 0, &AllocationSize, 0x2000u, 0x40u) )
   {
   if ( !ZwAllocateVirtualMemory(Handle, &BaseAddress, 0, &AllocationSize, 0x1000u, 0x40u) )
   {
   if ( !sub_10280(
   *((_DWORD *)dword_10740 + 3),
   (int)Handle,
   (int)BaseAddress,
   (int)dword_10740,
   *(_DWORD *)dword_10740,
   (int)&v8) )
   {
   if ( !sub_10280(
   *((_DWORD *)dword_10740 + 2),
   (int)Handle,
   *((_DWORD *)dword_10740 + 8),
   (int)&v9,
   8,
   (int)&v8) )
   {
   if ( !sub_10280(
   *((_DWORD *)dword_10740 + 3),
   (int)Handle,
   (int)((char *)BaseAddress + 36),
   (int)&v9,
   8,
   (int)&v8) )
   {
   v10 = *((_DWORD *)dword_10740 + 8);
   v11 = 8;
   if ( !sub_10280(*((_DWORD *)dword_10740 + 1), (int)Handle, (int)&v10, (int)&v11, 64, (int)&v12) )
   {
   v9 = 80;
   v13 = 80;
   v14 = 80;
   v15 = -23;
   v16 = (char *)BaseAddress + *((_DWORD *)dword_10740 + 4) - *((_DWORD *)dword_10740 + 8) - 8;
   sub_10280(
   *((_DWORD *)dword_10740 + 3),
   (int)Handle,
   *((_DWORD *)dword_10740 + 8),
   (int)&v9,
   8,
   (int)&v8);
   v10 = *((_DWORD *)dword_10740 + 8);
   v11 = 8;
   sub_10280(*((_DWORD *)dword_10740 + 1), (int)Handle, (int)&v10, (int)&v11, v12, (int)&v8);
   }
   }
   }
   }
   }
   }
   ZwClose(Handle);
   }
   result = ObfDereferenceObject(Object);
   }
   }
  }
  return result;
}

//----- (000105B0) --------------------------------------------------------
int __stdcall DriverDispatch(int a1, PIRP Irp)
{
  Irp->IoStatus.Status = 0;
  Irp->IoStatus.Information = 0;
  IofCompleteRequest(Irp, 0);
  return 0;
}

//----- (000105E0) --------------------------------------------------------
int __stdcall DriverEntry(int a1, int a2)
{
  *(_DWORD *)(a1 + 56) = DriverDispatch;
  *(_DWORD *)(a1 + 64) = DriverDispatch;
  PsSetCreateProcessNotifyRoutine((void (__stdcall *)(HANDLE, HANDLE, BOOLEAN))NotifyRoutine, 0);
  return 0;
}

// ALL OK, 5 function(s) have been successfully decompiled

喜欢0

http://www.zndev.com 免费源码交换网 ----------------------------- 软件创造价值，驱动提供力量! 淡泊以明志，宁静以致远。 ---------------------------------- 勤用搜索，多查资料，先搜再问。

killvxk

论坛版主

注册日期2005-10-03
最后登录2014-04-14
粉丝3
关注1
积分1082分
威望2003点
贡献值0点
好评度1693点
原创分2分
专家分0分

加关注写私信

沙发^#

发布于：2008-06-10 13:19

此方法不是很好~~现在都流行APC插入DLL了~

没有战争就没有进步 X3工作组为您提供最好的军火

回复喜欢

znsoft

管理员

注册日期2001-03-23
最后登录2023-10-25
粉丝300
关注6
积分910分
威望14796点
贡献值7点
好评度2410点
原创分5分
专家分100分

加关注写私信

板凳^#

发布于：2008-07-04 17:45

apc一堆问题..杀软先不放过你...

http://www.zndev.com 免费源码交换网 ----------------------------- 软件创造价值，驱动提供力量! 淡泊以明志，宁静以致远。 ---------------------------------- 勤用搜索，多查资料，先搜再问。

回复喜欢

basketwill

驱动牛犊

注册日期2005-09-02
最后登录2016-04-05
粉丝8
关注0
积分47分
威望410点
贡献值1点
好评度6点
原创分0分
专家分0分

加关注写私信

地板^#

发布于：2010-05-06 17:09

madchook 驱动比较简单,madcHook.dll的文件也已经被分析出来了，曾经改了一下dll里面的东西，防止被杀毒软件报木马，只要用文件工具把整个dll文件用0x55异或一下，dll的关键内容就出来了，大家可以修改，但是驱动的那个mchInjDrvMap映射名称也要做同样的修改

宛俊_三哥！

回复喜欢

basketwill

驱动牛犊

注册日期2005-09-02
最后登录2016-04-05
粉丝8
关注0
积分47分
威望410点
贡献值1点
好评度6点
原创分0分
专家分0分

加关注写私信

地下室^#

发布于：2010-05-06 17:12

注意修改了以后还要用0x55把整个dll异或回去

宛俊_三哥！

回复喜欢

您需要登录后才可以回帖，登录或者注册

madchook 驱动逆向伪代码( ida pro机器逆向)

最新喜欢：