针对IPGUARD,阳途，固信，安在的卸载驱动，修改版

显示全部楼层 · 发表于 3 天前

看了下，在IPGUARD驱动中增加了回写，所以还得拦截下驱动的回写。
# Child-SP RetAddr : Args to Child : Call Site
00 fffff880`0a950530 fffff800`047fef00 : fffff880`027c7340 00000000`00000008 fffff880`0a950790 00000000`000007ff : DowithWinhlpsvr!RegistryCallback+0x5e [l:\workcode\syscode\trunk\dowithwinhlpsvr\myregfilter.c @ 250]
01 fffff880`0a950620 fffff800`0479f3b0 : fffff8a0`00000008 fffff880`0a950790 fffffa80`018c4201 fffff800`00000017 : nt!CmpCallCallBacks+0x1c0
02 fffff880`0a9506f0 fffff800`044bdbd3 : fffffa80`03fd59b0 fffff880`0a950a98 00000000`00000002 fffff880`0a950af0 : nt! ?? ::NNGAKEGL::`string'+0x27d10
03 fffff880`0a950870 fffff800`044b33b0 : fffff880`027abe10 fffff880`0a950b00 00000000`00000000 00000000`0002001f : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0a9508e0)
04 fffff880`0a950a78 fffff880`027abe10 : fffff880`0a950b00 00000000`00000000 00000000`0002001f fffff880`0a950c10 : nt!KiServiceLinkage
05 fffff880`0a950a80 fffff880`027abe6e : ffffffff`80000794 fffff880`0a950c08 fffff880`00000010 fffff880`027abdb1 : THlpDrv64+0x1e10
06 fffff880`0a950ad0 fffff880`027ac7ca : 00000000`c000017c 00000000`00000000 00000000`c000017c 00000000`00000000 : THlpDrv64+0x1e6e
07 fffff880`0a950b60 fffff800`0475d1a0 : fffff880`04700180 fffff880`00000000 ffffffff`80000794 ffffffff`4d2fa200 : THlpDrv64+0x27ca
08 fffff880`0a950c00 fffff800`044b5ba6 : fffff880`04700180 fffffa80`03fd59b0 fffff880`0470f0c0 00000000`00000000 : nt!PspSystemThreadStartup+0x194
09 fffff880`0a950c40 00000000`00000000 : fffff880`0a951000 fffff880`0a94b000 fffff880`0a94fe40 00000000`00000000 : nt!KiStartSystemThread+0x16

显示全部楼层 · 发表于 3 天前

支持大佬

显示全部楼层 · 发表于 3 天前

void __fastcall ProtectSystemThread(PVOID StartContext)
{
  unsigned int v2; // edi
  char v3; // r12
  int v4; // r13d
  char v5; // bp
  unsigned int CurrentIrql; // ebx
  HANDLE CurrentThreadId; // rax
  unsigned int v8; // eax
  int v9; // ebx
  unsigned int v10; // eax
  int v11; // ebx
  unsigned int v12; // eax
  unsigned int v13; // eax
  int v14; // ebx
  unsigned int v15; // eax
  unsigned int v16; // ebx
  unsigned int v17; // eax
  int v18; // ebx
  unsigned int v19; // eax
  unsigned int v20; // eax
  struct _IO_STATUS_BLOCK IoStatusBlock; // [rsp+50h] [rbp-48h] BYREF
  unsigned int v22; // [rsp+A8h] [rbp+10h] BYREF
  HANDLE KeyHandle; // [rsp+B0h] [rbp+18h] BYREF
  union _LARGE_INTEGER Timeout; // [rsp+B8h] [rbp+20h] BYREF

  v2 = 0;
  v3 = 1;
  v4 = 0;
  KeyHandle = 0i64;
  v5 = 0;
  Timeout.QuadPart = -3000000000i64;
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THWorkerStart] [----] [%08x]\n", StartContext);
  while ( 1 )
  {
if ( KeGetCurrentIrql() && byte_1A390 )
{
   CurrentIrql = KeGetCurrentIrql();
   CurrentThreadId = PsGetCurrentThreadId();
   DbgPrint("[THlpDrv] [THWorkerStart] [IRQL] [!!!!] [t: %08x, i: %08x]\n", CurrentThreadId, CurrentIrql);
}
if ( !KeyHandle )
{
   v8 = OpenKey(&KeyHandle, 0x2001Fu, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.winhlpsvr");
   v9 = v8;
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [Key] [k: %08x, s: %08x]\n", KeyHandle, v8);
   if ( v9 < 0 || !KeyHandle )
   {
      v2 = 1;
      goto LABEL_57;
   }
}
if ( v4 != dword_1A218 )
{
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [Change] [####]\n");
   v4 = dword_1A218;
   v3 = 1;
}
if ( dword_1A218 == 1 )
{
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--]\n");
   if ( v3 )
   {
      v3 = 0;
      v22 = 0;
      v10 = QueryValueKey(KeyHandle, (__int64)L"Start", &v22);
      v11 = v10;
      if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Enforce] [Query] [d: %08x] [s: %08x]\n", v22, v10);
      if ( v11 >= 0 && v22 != 2 )
      {
      v12 = SetValueKey(KeyHandle, L"Start", 2);
      if ( byte_1A390 )
         DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Enforce] [Set] [####] [d: %08x] [s: %08x]\n", 2i64, v12);
      }
   }
   if ( !v5 )
   {
      v13 = ZwNotifyChangeKey(KeyHandle, Handle, 0i64, 0i64, &IoStatusBlock, 5u, 1u, 0i64, 0, 1u);
      v14 = v13;
      if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Notify] [Register] [s: %08x]\n", v13);
      if ( v14 < 0 )
      goto LABEL_56;
      v5 = 1;
   }
   v15 = ZwWaitForSingleObject(Handle, 0, &Timeout);
   v16 = v15;
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Notify] [Wait] [s: %08x]\n", v15);
   if ( v16 == 258 )
   {
      if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Notify] [TIMEOUT] [s: %08x]\n", 258i64);
   }
   else
   {
      if ( v16 )
      {
      v2 = 3;
      goto LABEL_57;
      }
      v5 = 0;
      v22 = 0;
      v17 = QueryValueKey(KeyHandle, (__int64)L"Start", &v22);
      v18 = v17;
      if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [--START--] [Notify] [SUCCESS] [Query] [d: %08x] [s: %08x]\n", v22, v17);
      if ( v18 == -1073741444 )
      {
      ZwClose(KeyHandle);
      KeyHandle = 0i64;
      sub_12BB4();
      }
      else if ( v18 >= 0 && v22 != 2 )
      {
      v19 = SetValueKey(KeyHandle, L"Start", 2);
      if ( byte_1A390 )
         DbgPrint(
            "[THlpDrv] [THWorkerStart] [--START--] [Notify] [SUCCESS] [Set] [####] [d: %08x] [s: %08x]\n",
            2i64,
            v19);
      }
   }
   goto LABEL_50;
}
if ( dword_1A218 == 2 )
{
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [##PAUSE##]\n");
   v20 = ZwWaitForSingleObject(Handle, 0, &Timeout);
   if ( byte_1A390 )
      DbgPrint("[THlpDrv] [THWorkerStart] [##PAUSE##] [Wait] [s: %08x]\n", v20);
   goto LABEL_50;
}
if ( dword_1A218 == 3 )
   break;
LABEL_50:
if ( !byte_1A392 )
   goto LABEL_57;
  }
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THWorkerStart] [!!STOP!!]\n");
LABEL_56:
  v2 = 2;
LABEL_57:
  if ( KeyHandle )
  {
ZwClose(KeyHandle);
KeyHandle = 0i64;
  }
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THWorkerStart] [====] [%08x] [e: %08x]\n", StartContext, v2);
  PsTerminateSystemThread(0);
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THWorkerStart] [====] 2 [%08x]\n", StartContext);
}

显示全部楼层 · 发表于 3 天前

void sub_12BB4()
{
  unsigned int v0; // r12d
  PVOID PoolWithTag; // rsi
  unsigned int v2; // eax
  int v3; // edi
  unsigned int v4; // eax
  int v5; // edi
  unsigned int v6; // ebp
  unsigned int *v7; // rbx
  __int64 v8; // rdx
  int v9; // eax
  unsigned int v10; // r13d
  int v11; // edi
  NTSTATUS v12; // eax
  int v13; // eax
  int v14; // edi
  __int64 v15; // rcx
  _WORD *v16; // rdi
  bool v17; // zf
  ULONG v18; // edi
  NTSTATUS v19; // eax
  __int64 v20; // [rsp+20h] [rbp-48h]
  __int64 v21; // [rsp+28h] [rbp-40h]
  unsigned int v22; // [rsp+70h] [rbp+8h] BYREF
  HANDLE Handle; // [rsp+78h] [rbp+10h] BYREF

  v0 = 0;
  Handle = 0i64;
  PoolWithTag = 0i64;
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THRestoreReg] [----]\n");
  v2 = OpenKey(&Handle, 0x2001Fu, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.winhlpsvr");
  v3 = v2;
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THRestoreReg] [OpenKey] [key: %08x, status: %08x]\n", Handle, v2);
  if ( v3 >= 0 && Handle )
goto LABEL_11;
  v4 = sub_11CA0(&Handle, 0x2001Fu, L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\.winhlpsvr");
  v5 = v4;
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THRestoreReg] [CreateKey] [key: %08x, status: %08x]\n", Handle, v4);
  if ( v5 >= 0 && Handle )
  {
LABEL_11:
PoolWithTag = ExAllocatePoolWithTag(NonPagedPool, 0x208ui64, 0x74687272u);
if ( PoolWithTag )
{
   v6 = 0;
   v7 = (unsigned int *)&unk_1A11C;
   do
   {
      if ( !*((_BYTE *)v7 + 12) || byte_1A391 )
      {
      if ( *(v7 - 1) == 4 )
      {
         v8 = *(_QWORD *)(v7 - 3);
         v22 = 0;
         v9 = QueryValueKey(Handle, v8, &v22);
         v10 = v22;
         v11 = v9;
         if ( byte_1A390 )
         {
            LODWORD(v20) = v9;
            DbgPrint(
            "[THlpDrv] [THRestoreReg] [i = %d] [Query] [DWORD] [value: %S] [data: %08x] [status: %08x]\n",
            v6,
            *(const wchar_t **)(v7 - 3),
            v22,
            v20);
         }
         if ( v11 < 0 || v10 != *v7 )
         {
            v12 = SetValueKey(Handle, *(const WCHAR **)(v7 - 3), *v7);
            if ( byte_1A390 )
            {
            LODWORD(v20) = v12;
            DbgPrint(
               "[THlpDrv] [THRestoreReg] [i = %d] [Set  ] [DWORD] [####] [value: %S] [data: %08x] [status: %08x]\n",
               v6,
               *(const wchar_t **)(v7 - 3),
               *v7,
               v20);
            }
         }
      }
      else if ( *(v7 - 1) == 1 )
      {
         memset(PoolWithTag, 0, 0x208ui64);
         v22 = 518;
         v13 = sub_11EA8(Handle);
         v14 = v13;
         if ( byte_1A390 )
         {
            LODWORD(v21) = v13;
            LODWORD(v20) = v22;
            DbgPrint(
            "[THlpDrv] [THRestoreReg] [i = %d] [Query] [SZ ] [value: %S] [data: %S] [len: %d] [status: %08x] [data2: %S]\n",
            v6,
            *(const wchar_t **)(v7 - 3),
            (const wchar_t *)PoolWithTag,
            v20,
            v21,
            *(const wchar_t **)(v7 + 1));
         }
         if ( v14 < 0 || wcsicmp((const wchar_t *)PoolWithTag, *(const wchar_t **)(v7 + 1)) )
         {
            if ( wcsicmp(*(const wchar_t **)(v7 + 1), &Str2) )
            {
            v15 = -1i64;
            v16 = *(_WORD **)(v7 + 1);
            do
            {
               if ( !v15 )
                  break;
               v17 = *v16++ == 0;
               --v15;
            }
            while ( !v17 );
            v18 = 2 * ~(_DWORD)v15;
            v19 = SetValueKeyReal(Handle, *(const WCHAR **)(v7 - 3), *(v7 - 1), *(void **)(v7 + 1), v18);
            if ( byte_1A390 )
            {
               LODWORD(v21) = v19;
               LODWORD(v20) = v18;
               DbgPrint(
                  "[THlpDrv] [THRestoreReg] [i = %d] [Set  ] [SZ ] [####] [value: %S] [data: %S] [len: %d] [status: %08x]\n",
                  v6,
                  *(const wchar_t **)(v7 - 3),
                  *(const wchar_t **)(v7 + 1),
                  v20,
                  v21);
            }
            }
         }
      }
      }
      ++v6;
      v7 += 8;
   }
   while ( v6 < 8 );
}
else
{
   v0 = 2;
}
  }
  else
  {
v0 = 1;
  }
  if ( PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0);
  if ( Handle )
  {
ZwClose(Handle);
Handle = 0i64;
  }
  if ( byte_1A390 )
DbgPrint("[THlpDrv] [THRestoreReg] [====] [err: %d]\n", v0);
}

[病毒样本] 针对IPGUARD,阳途，固信，安在的卸载驱动，修改版

本帖子中包含更多资源

评分

评分