ZwSetSystemInformation 로 드라이버 로드…

ZwSetSystemInformation 로 드라이버를 로드하는 방법이 있습니다.

루트킷에서 사용되는 방법인데… 위의 방법으로 로드하면 레지스트리의 키에도 기록되지 않을 뿐더러… 소아에서도 잡히지 않고… 드라이버를 숨기고 동작 시킬 수 있습니다.

#include
#include

typedef struct _UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
#ifdef MIDL_PASS
[size_is(MaximumLength / 2), length_is((Length) / 2) ] USHORT * Buffer;
#else // MIDL_PASS
PWSTR Buffer;
#endif // MIDL_PASS
} UNICODE_STRING, *PUNICODE_STRING;

typedef unsigned long NTSTATUS;
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)

typedef NTSTATUS (__stdcall *ZWSETSYSTEMINFORMATION)(
IN DWORD SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength
);
typedef VOID (__stdcall *RTLINITUNICODESTRING)(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);

NTSTATUS (__stdcall *ZwSetSystemInformation)(
IN DWORD SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformationLength
);

VOID (__stdcall *RtlInitUnicodeString)(
IN OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);

typedef struct _SYSTEM_LOAD_AND_CALL_IMAGE
{
UNICODE_STRING ModuleName;
} SYSTEM_LOAD_AND_CALL_IMAGE, *PSYSTEM_LOAD_AND_CALL_IMAGE;

#define SystemLoadAndCallImage 38

void main(void)
{
///////////////////////////////////////////////////////////////
// Why mess with Drivers?
///////////////////////////////////////////////////////////////
SYSTEM_LOAD_AND_CALL_IMAGE GregsImage;
WCHAR daPath[] = L”\\??\\E:\\MyProjects\\AFDMJHook\\AFDMJHK\\Debug\\AFDHK.sys”;

//////////////////////////////////////////////////////////////
// get DLL entry points
//////////////////////////////////////////////////////////////
if( !(RtlInitUnicodeString =
(RTLINITUNICODESTRING) GetProcAddress( GetModuleHandle(“ntdll.dll”),
“RtlInitUnicodeString” )) )
exit(1);

if( !(ZwSetSystemInformation =
(ZWSETSYSTEMINFORMATION) GetProcAddress( GetModuleHandle(“ntdll.dll”),
“ZwSetSystemInformation” )) )
exit(1);

RtlInitUnicodeString( &(GregsImage.ModuleName),
daPath );

if(0 <= ZwSetSystemInformation( SystemLoadAndCallImage, &GregsImage, sizeof(SYSTEM_LOAD_AND_CALL_IMAGE)) ){
printf(“Driver Loaded.\n”);
} else {
printf(“Driver not loaded.\n”);
}
}

그런데…ㅜㅜ

2K 까지만 동작하는거 같습니다…ㅜㅜ
2003 에서 테스트를 해보니… 안되더군요… MS에서 패치해버린거 같습니다…흑…ㅜㅜ

ZwSetSystemInformation 로 드라이버 로드…”에 대한 41개의 생각

  1. 핑백: dll error fixes

  2. 핑백: Mammut Heron Light 65 Pack

  3. 핑백: Weatherbeeta Orican Freestyle Standard Neck Lite

  4. 핑백: Weatherbeeta Orican Freestyle High Neck Heavy

  5. 핑백: Weatherbeeta Orican Freestyle High Neck Lite

  6. 핑백: Weatherbeeta Orican Freestyle High Neck Lite

  7. 핑백: Rubbermaid 175 Bushels White Flex N Carry Hamper

  8. 핑백: Nabisco Premium Saltine Crackers Original Convenience Pack 12 Pack

  9. 핑백: Alabama Crimson Tide Bama Car Auto Floor Mats Front Seat

  10. 핑백: Outback Trading Unisex Magnum Vest

  11. 핑백: Alabama Crimson Tide Bama Car Auto Floor Mats Front Seat

  12. 핑백: Outback Trading Unisex Magnum Vest

  13. 핑백: Alabama Crimson Tide Bama Rock Glass Shot Glass Set

  14. 핑백: Taj Mahal Traditional Throw Rugs Black Gold Surya Tj 309

  15. 핑백: Alabama Crimson Tide Bama Baseball Wine Cheese Cutting Board

  16. 핑백: Alabama Crimson Tide Bama Framed Panoramic Photo

  17. 핑백: Alabama Crimson Tide Bama Glass Candy Jar

  18. 핑백: Allen Head Fixed Blade Screwdrivers 116 Screwdriver

  19. 핑백: Alabama Crimson Tide Bama All Weather Rubber Auto Car Mats

  20. 핑백: Alabama Crimson Tide Bama Wooden 3d Football Wall Art

  21. 핑백: Alabama Crimson Tide Bama Womens Sexy Thong Panties

  22. 핑백: Alabama Crimson Tide Bama 2 Bottle Wine Tote Cooler Bag

  23. 핑백: Alabama Crimson Tide Bama Wood Cutting Board

  24. 핑백: Allen Head Fixed Blade Screwdrivers 116 Screwdriver

  25. 핑백: homepage

  26. 핑백: Minnesota Vikings Womens Counter Purple Full Zip Track Jacket Vf Imagewear

  27. 핑백: provillus reviews 2011

  28. 핑백: pocket pussy reviews

  29. 핑백: binary options strategy

  30. 핑백: オンラインカジノ

  31. 핑백: Nabisco Premium Saltine Crackers Original Convenience Pack 12 Pack

  32. 핑백: online casino

  33. 핑백: get free ms points microsoft

  34. 핑백: please click the up coming post

  35. 핑백: discount gift cards

  36. 핑백: trade gift cards

  37. 핑백: http://minecraftcodes.org

  38. 핑백: http://www.bosgemors.co.za

  39. 핑백: justinsurancebrokers.com

  40. 핑백: freebies

  41. 핑백: New Orleans Saints Womens Gray Boyfriend Briefs VF Imagewear

댓글 남기기

이메일은 공개되지 않습니다. 필수 입력창은 * 로 표시되어 있습니다