驅動開發：內核運用LoadImage屏蔽驅動

在筆者上一篇文章《驅動開發：內核監視LoadImage映像回調》中LyShark簡單介紹瞭如何通過PsSetLoadImageNotifyRoutine函數註冊回調來監視驅動模塊的加載，注意我這裏用的是監視而不是監控之所以是監視而不是監控那是因爲PsSetLoadImageNotifyRoutine無法實現參數控制，而如果我們想要控制特定驅動的加載則需要自己做一些事情來實現，如下LyShark將解密如何實現屏蔽特定驅動的加載。

要想實現驅動屏蔽其原理很簡單，通過ImageInfo->ImageBase得到鏡像基地址，然後調用GetDriverEntryByImageBase函數來得到程序的入口地址，找NT頭的OptionalHeader節點，該節點裏面就是被加載驅動入口，通過彙編在驅動頭部寫入ret返回指令，即可實現屏蔽加載特定驅動文件。

原理其實很容易理解，如果我們需要實現則只需要在《驅動開發：內核監視LoadImage映像回調》這篇文章的代碼上稍加改進即可，當檢測到lyshark.sys驅動加載時，直接跳轉到入口處快速寫入一個Ret讓驅動返回即可，至於如何寫出指令的問題如果不懂建議回頭看看《驅動開發：內核CR3切換讀寫內存》文章中是如何讀寫內存的，這段代碼實現如下所示。

// 署名權
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: [email protected]
#include <ntddk.h>
#include <intrin.h>
#include <ntimage.h>

PVOID GetDriverEntryByImageBase(PVOID ImageBase)
{
	PIMAGE_DOS_HEADER pDOSHeader;
	PIMAGE_NT_HEADERS64 pNTHeader;
	PVOID pEntryPoint;
	pDOSHeader = (PIMAGE_DOS_HEADER)ImageBase;
	pNTHeader = (PIMAGE_NT_HEADERS64)((ULONG64)ImageBase + pDOSHeader->e_lfanew);
	pEntryPoint = (PVOID)((ULONG64)ImageBase + pNTHeader->OptionalHeader.AddressOfEntryPoint);
	return pEntryPoint;
}

VOID UnicodeToChar(PUNICODE_STRING dst, char *src)
{
	ANSI_STRING string;
	RtlUnicodeStringToAnsiString(&string, dst, TRUE);
	strcpy(src, string.Buffer);
	RtlFreeAnsiString(&string);
}

// 使用開關寫保護需要在[C/C++]->[優化]->啓用內部函數
// 關閉寫保護
KIRQL  WPOFFx64()
{
	KIRQL  irql = KeRaiseIrqlToDpcLevel();
	UINT64  cr0 = __readcr0();
	cr0 &= 0xfffffffffffeffff;
	_disable();
	__writecr0(cr0);
	return  irql;
}

// 開啓寫保護
void  WPONx64(KIRQL  irql)
{
	UINT64  cr0 = __readcr0();
	cr0 |= 0x10000;
	_enable();
	__writecr0(cr0);
	KeLowerIrql(irql);
}

BOOLEAN DenyLoadDriver(PVOID DriverEntry)
{
	UCHAR fuck[] = "\xB8\x22\x00\x00\xC0\xC3";
	KIRQL kirql;
	/* 在模塊開頭寫入以下彙編指令
	Mov eax,c0000022h
	ret
	*/
	if (DriverEntry == NULL) return FALSE;
	kirql = WPOFFx64();
	memcpy(DriverEntry, fuck, sizeof(fuck) / sizeof(fuck[0]));
	WPONx64(kirql);
	return TRUE;
}

VOID MyLySharkComLoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ModuleStyle, PIMAGE_INFO ImageInfo)
{
	PVOID pDrvEntry;
	char szFullImageName[256] = { 0 };

	// MmIsAddress 驗證地址可用性
	if (FullImageName != NULL && MmIsAddressValid(FullImageName))
	{
		// ModuleStyle爲零表示加載sys
		if (ModuleStyle == 0)
		{
			pDrvEntry = GetDriverEntryByImageBase(ImageInfo->ImageBase);
			UnicodeToChar(FullImageName, szFullImageName);
			if (strstr(_strlwr(szFullImageName), "lyshark.sys"))
			{
				DbgPrint("[LyShark] 攔截SYS內核模塊：%s", szFullImageName);
				DenyLoadDriver(pDrvEntry);
			}
		}
	}
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
	PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)MyLySharkComLoadImageNotifyRoutine);
	DbgPrint("驅動卸載完成...");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark.com \n");

	PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)MyLySharkComLoadImageNotifyRoutine);
	DbgPrint("驅動加載完成...");
	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

首先運行我們的驅動，然後我們接着加載lyshark.sys則你會發現驅動被攔截了。

我們看下驅動加載器，提示的信息是拒絕訪問，因爲這個驅動其實是加載了的，只是入口處被填充了返回而已。

除了使用Ret強制返回的方法意外，屏蔽驅動加載還可以使用另一種方式實現禁用模塊加載，例如當驅動被加載首先回調函數內可以接收到，當接收到以後直接調用MmUnmapViewOfSection函數強制卸載掉即可，如果使用這種方法實現則這段代碼需要改進成如下樣子。

// 署名權
// right to sign one's name on a piece of work
// PowerBy: LyShark
// Email: [email protected]
#include <ntifs.h>
#include <ntimage.h>
#include <intrin.h>

NTSTATUS MmUnmapViewOfSection(PEPROCESS Process, PVOID BaseAddress);
NTSTATUS SetNotifyRoutine();
NTSTATUS RemoveNotifyRoutine();

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo);
NTSTATUS U2C(PUNICODE_STRING pustrSrc, PCHAR pszDest, ULONG ulDestLength);
VOID ThreadProc(_In_ PVOID StartContext);

// 拒絕加載驅動
NTSTATUS DenyLoadDriver(PVOID pImageBase);

// 拒絕加載DLL模塊
NTSTATUS DenyLoadDll(HANDLE ProcessId, PVOID pImageBase);

typedef struct _MY_DATA
{
	HANDLE ProcessId;
	PVOID pImageBase;
}MY_DATA, *PMY_DATA;

// 設置消息回調
NTSTATUS SetNotifyRoutine()
{
	NTSTATUS status = STATUS_SUCCESS;
	status = PsSetLoadImageNotifyRoutine(LoadImageNotifyRoutine);
	return status;
}

// 關閉消息回調
NTSTATUS RemoveNotifyRoutine()
{
	NTSTATUS status = STATUS_SUCCESS;
	status = PsRemoveLoadImageNotifyRoutine(LoadImageNotifyRoutine);
	return status;
}

VOID LoadImageNotifyRoutine(PUNICODE_STRING FullImageName, HANDLE ProcessId, PIMAGE_INFO ImageInfo)
{
	DbgPrint("PID: %d --> 完整路徑: %wZ --> 大小: %d --> 基地址: 0x%p \n", ProcessId, FullImageName, ImageInfo->ImageSize, ImageInfo->ImageBase);

	HANDLE hThread = NULL;
	CHAR szTemp[1024] = { 0 };
	U2C(FullImageName, szTemp, 1024);
	if (NULL != strstr(szTemp, "lyshark.sys"))
	{
		// EXE或者DLL
		if (0 != ProcessId)
		{
			// 創建多線程 延時1秒鐘後再卸載模塊
			PMY_DATA pMyData = ExAllocatePool(NonPagedPool, sizeof(MY_DATA));
			pMyData->ProcessId = ProcessId;
			pMyData->pImageBase = ImageInfo->ImageBase;
			PsCreateSystemThread(&hThread, 0, NULL, NtCurrentProcess(), NULL, ThreadProc, pMyData);
			DbgPrint("[LyShark] 禁止加載DLL文件 \n");
		}
		// 驅動
		else
		{
			DenyLoadDriver(ImageInfo->ImageBase);
			DbgPrint("[LyShark] 禁止加載SYS驅動文件 \n");
		}
	}
}

// 拒絕加載驅動
NTSTATUS DenyLoadDriver(PVOID pImageBase)
{
	NTSTATUS status = STATUS_SUCCESS;
	PMDL pMdl = NULL;
	PVOID pVoid = NULL;
	ULONG ulShellcodeLength = 16;
	UCHAR pShellcode[16] = { 0xB8, 0x22, 0x00, 0x00, 0xC0, 0xC3, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
	PIMAGE_DOS_HEADER pDosHeader = pImageBase;
	PIMAGE_NT_HEADERS pNtHeaders = (PIMAGE_NT_HEADERS)((PUCHAR)pDosHeader + pDosHeader->e_lfanew);
	PVOID pDriverEntry = (PVOID)((PUCHAR)pDosHeader + pNtHeaders->OptionalHeader.AddressOfEntryPoint);

	pMdl = MmCreateMdl(NULL, pDriverEntry, ulShellcodeLength);
	MmBuildMdlForNonPagedPool(pMdl);
	pVoid = MmMapLockedPages(pMdl, KernelMode);
	RtlCopyMemory(pVoid, pShellcode, ulShellcodeLength);
	MmUnmapLockedPages(pVoid, pMdl);
	IoFreeMdl(pMdl);

	return status;
}

// 調用 MmUnmapViewOfSection 函數來卸載已經加載的 DLL 模塊
NTSTATUS DenyLoadDll(HANDLE ProcessId, PVOID pImageBase)
{
	NTSTATUS status = STATUS_SUCCESS;
	PEPROCESS pEProcess = NULL;

	status = PsLookupProcessByProcessId(ProcessId, &pEProcess);
	if (!NT_SUCCESS(status))
	{
		return status;
	}

	// 卸載模塊
	status = MmUnmapViewOfSection(pEProcess, pImageBase);
	if (!NT_SUCCESS(status))
	{
		return status;
	}
	return status;
}

VOID ThreadProc(_In_ PVOID StartContext)
{
	PMY_DATA pMyData = (PMY_DATA)StartContext;
	LARGE_INTEGER liTime = { 0 };

	// 延時 1 秒 負值表示相對時間
	liTime.QuadPart = -10 * 1000 * 1000;
	KeDelayExecutionThread(KernelMode, FALSE, &liTime);

	// 卸載
	DenyLoadDll(pMyData->ProcessId, pMyData->pImageBase);

	ExFreePool(pMyData);
}

NTSTATUS U2C(PUNICODE_STRING pustrSrc, PCHAR pszDest, ULONG ulDestLength)
{
	NTSTATUS status = STATUS_SUCCESS;
	ANSI_STRING strTemp;

	RtlZeroMemory(pszDest, ulDestLength);
	RtlUnicodeStringToAnsiString(&strTemp, pustrSrc, TRUE);
	if (ulDestLength > strTemp.Length)
	{
		RtlCopyMemory(pszDest, strTemp.Buffer, strTemp.Length);
	}
	RtlFreeAnsiString(&strTemp);

	return status;
}

VOID UnDriver(PDRIVER_OBJECT driver)
{
	PsRemoveLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)RemoveNotifyRoutine);
	DbgPrint("驅動卸載完成...");
}

NTSTATUS DriverEntry(IN PDRIVER_OBJECT Driver, PUNICODE_STRING RegistryPath)
{
	DbgPrint("hello lyshark.ocm \n");

	PsSetLoadImageNotifyRoutine((PLOAD_IMAGE_NOTIFY_ROUTINE)SetNotifyRoutine);
	DbgPrint("驅動加載完成...");
	Driver->DriverUnload = UnDriver;
	return STATUS_SUCCESS;
}

加載這段驅動程序，當有DLL文件被加載後，則會強制彈出，從而實現屏蔽模塊加載的作用。

當然用LoadImage回調做監控並不靠譜，因爲它很容易被繞過，其實系統裏存在一個開關，叫做PspNotifyEnableMask如果它的值被設置爲0，那麼所有的相關操作都不會經過回調，所有回調都會失效。

驅動開發：內核運用LoadImage屏蔽驅動

C++ Qt開發：QProcess進程管理模塊

C++ Qt開發：QUdpSocket實現組播通信

C++ Qt開發：QUdpSocket網絡通信組件

C++ Qt開發：QTcpSocket網絡通信組件

C++ Qt開發：QNetworkAccessManager網絡接口組件

https://yachay.unat.edu.pe/blog/index.php?comment_area=format_blog&comment_component=blog&comment_co

linux以太網驅動總結