Mostrar Mensajes
Código
#include "ntddk.h"
#pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t;
#pragma pack()
__declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable;
#define SYSTEMSERVICE(_function) KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)_function+1)]
UNICODE_STRING Dev,lnk;
PMDL g_pmdlSystemCall;
PVOID *MappedSystemCallTable;
#define SYSCALL_INDEX(_Function) *(PULONG)((PUCHAR)_Function+1)
#define HOOK_SYSCALL(_Function, _Hook, _Orig ) \
_Orig = (PVOID) InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
#define UNHOOK_SYSCALL(_Function, _Hook, _Orig ) \
InterlockedExchange( (PLONG) &MappedSystemCallTable[SYSCALL_INDEX(_Function)], (LONG) _Hook)
NTSYSAPI NTSTATUS NTAPI ZwDeviceIoControlFile(IN HANDLE FileHandle,IN HANDLE Event,IN PIO_APC_ROUTINE ApcRoutine,IN PVOID ApcContext,OUT PIO_STATUS_BLOCK IoStatusBlock,IN ULONG IoControlCode,IN PVOID InputBuffer,IN ULONG InputBufferLength,OUT PVOID OutputBuffer,IN ULONG OutputBufferLength);
NTSYSAPI NTSTATUS NTAPI ZwCreateFile(OUT PHANDLE FileHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,OUT PIO_STATUS_BLOCK IoStatusBlock,IN PLARGE_INTEGER AllocationSize OPTIONAL,IN ULONG FileAttributes,IN ULONG ShareAccess,IN ULONG CreateDisposition,IN ULONG CreateOptions,IN PVOID EaBuffer OPTIONAL,IN ULONG EaLength);
typedef NTSTATUS (*typeZwDeviceIoControlFile)(IN HANDLE FileHandle,IN HANDLE Event,IN PIO_APC_ROUTINE ApcRoutine,IN PVOID ApcContext,OUT PIO_STATUS_BLOCK IoStatusBlock,IN ULONG IoControlCode,IN PVOID InputBuffer,IN ULONG InputBufferLength,OUT PVOID OutputBuffer,IN ULONG OutputBufferLength);
typedef NTSTATUS (*typeZwCreateFile)(OUT PHANDLE FileHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,OUT PIO_STATUS_BLOCK IoStatusBlock,IN PLARGE_INTEGER AllocationSize OPTIONAL,IN ULONG FileAttributes,IN ULONG ShareAccess,IN ULONG CreateDisposition,IN ULONG CreateOptions,IN PVOID EaBuffer OPTIONAL,IN ULONG EaLength);
typeZwDeviceIoControlFile ZwDeviceIoControlFileIni;
typeZwCreateFile ZwCreateFileIni;
NTSTATUS ZwDeviceIoControlFileRep(IN HANDLE FileHandle,IN HANDLE Event,IN PIO_APC_ROUTINE ApcRoutine,IN PVOID ApcContext,OUT PIO_STATUS_BLOCK IoStatusBlock,IN ULONG IoControlCode,IN PVOID InputBuffer,IN ULONG InputBufferLength,OUT PVOID OutputBuffer,IN ULONG OutputBufferLength)
{
NTSTATUS ntStatus;
HANDLE pid;
int PID;
int e;
pid = PsGetCurrentProcessId();
PID = (int)pid;
DbgPrint("---------------------------------");
DbgPrint("Hook DeviceIoControl");
DbgPrint("Aplicacion que lo llama: %i",PID);
DbgPrint("Handle: 0%x",FileHandle);
DbgPrint("IoControlCode: %i",IoControlCode);
DbgPrint("Parametros: %s (0x%x)",&InputBuffer,InputBuffer);
DbgPrint("Longitud: %i",InputBufferLength);
DbgPrint("---------------------------------");
ntStatus = ((typeZwDeviceIoControlFile)(ZwDeviceIoControlFileIni)) (FileHandle,Event,ApcRoutine,ApcContext,IoStatusBlock,IoControlCode,InputBuffer,InputBufferLength,OutputBuffer,OutputBufferLength);
return ntStatus;
}
NTSTATUS ZwCreateFileRep(OUT PHANDLE FileHandle,IN ACCESS_MASK DesiredAccess,IN POBJECT_ATTRIBUTES ObjectAttributes,OUT PIO_STATUS_BLOCK IoStatusBlock,IN PLARGE_INTEGER AllocationSize OPTIONAL,IN ULONG FileAttributes,IN ULONG ShareAccess,IN ULONG CreateDisposition,IN ULONG CreateOptions,IN PVOID EaBuffer OPTIONAL,IN ULONG EaLength)
{
NTSTATUS ntStatus;
ANSI_STRING strf;
HANDLE pid;
int PID;
RtlUnicodeStringToAnsiString(&strf,ObjectAttributes->ObjectName,TRUE);
pid = PsGetCurrentProcessId();
PID = (int)pid;
DbgPrint("---------------------------------");
DbgPrint("Hook CreateFile");
DbgPrint("Aplicacion que lo llama: %i",PID);
DbgPrint("Archivo: %s",strf.Buffer);
DbgPrint("---------------------------------");
ntStatus = ((typeZwCreateFile)(ZwCreateFileIni))(FileHandle,DesiredAccess,ObjectAttributes,IoStatusBlock, AllocationSize,FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
return ntStatus;
}
VOID OnUnload(IN PDRIVER_OBJECT DriverObject)
{
DbgPrint("Descargando driver...");
UNHOOK_SYSCALL(ZwDeviceIoControlFile, ZwDeviceIoControlFileIni, ZwDeviceIoControlFileRep);
UNHOOK_SYSCALL(ZwCreateFile, ZwCreateFileIni, ZwCreateFileRep);
if(g_pmdlSystemCall)
{
MmUnmapLockedPages(MappedSystemCallTable, g_pmdlSystemCall);
IoFreeMdl(g_pmdlSystemCall);
}
}
NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING theRegistryPath)
{
NTSTATUS s = STATUS_SUCCESS;
DriverObject->DriverUnload=OnUnload;
DbgPrint("+++++++++++++++++++++++++++++");
DbgPrint("+ IOCTL Sniffer +");
DbgPrint("+ By Hendrix +");
DbgPrint("++++++++++++++++++++++++++++");
ZwDeviceIoControlFileIni =(typeZwDeviceIoControlFile)(SYSTEMSERVICE(ZwDeviceIoControlFile));
g_pmdlSystemCall = MmCreateMdl(NULL, KeServiceDescriptorTable.ServiceTableBase, KeServiceDescriptorTable.NumberOfServices*4);
if(!g_pmdlSystemCall)
return STATUS_UNSUCCESSFUL;
MmBuildMdlForNonPagedPool(g_pmdlSystemCall);
g_pmdlSystemCall->MdlFlags = g_pmdlSystemCall->MdlFlags | MDL_MAPPED_TO_SYSTEM_VA;
MappedSystemCallTable = MmMapLockedPages(g_pmdlSystemCall, KernelMode);
HOOK_SYSCALL(ZwDeviceIoControlFile, ZwDeviceIoControlFileRep, ZwDeviceIoControlFileIni);
HOOK_SYSCALL(ZwCreateFile, ZwCreateFileRep, ZwCreateFileIni);
return s;
}
Si alguien se anima a crearle una GUI que me avise
).
