与杀毒软件共处一室的姿势

#define NOT_FOUND_SYSCALL_ID -1
#define IS_NOT_FUND(x) (x == NOT_FOUND_SYSCALL_ID)
/*
0x4c,0x8b,0xd1,            //mov r10,rcx
0xb8,0xb9,0x00,0x00,0x00, //mov eax,0B9h
0x0f,0x05,                //syscall0xc3                      //ret
*/
unsigned char SYS_CALL_START_MAGIC[] = { 
 0x4c, 0x8b, 0xd1, 0xb8
};
#define SYS_CALL_START_MAGIC_LENGTH 4
#define MAX_SEARCH_LENGTH  24
DWORD MatchSyscallId(BYTE* pData)
{
  // 通过内存搜索的方式绕过HOOK  
  // HOOK一般会在函数开始处插入调整指令，通过内存搜索的方式查找到真实的函数位置，并提取SyscallId  
  DWORD syscallId = NOT_FOUND_SYSCALL_ID;  
  for (int item = 0; item < MAX_SEARCH_LENGTH; item++) {  
    if (memcmp((pData + item), &SYS_CALL_START_MAGIC, SYS_CALL_START_MAGIC_LENGTH) == 0) {   
       memcpy(&syscallId, (pData + item + 4), sizeof(DWORD));      
       break;    
     }  
   }  
   return syscallId;
}

; syscall.DATA  syscallId DWORD 000h.CODESetSyscallId PROC        mov syscallId, 000h    mov syscallId, ecx    retSetSyscallId ENDP
DynamicSyscall PROC        mov r10, rcx        mov eax, syscallId        syscall        retDynamicSyscall ENDPEND

extern "C"
{
  VOID SetSyscallId(DWORD syscallId);  
  NTSTATUS WINAPI DynamicSyscall();
}

#include <Windows.h>#include "SyscallIdFinder.h"

/*0x4c,0x8b,0xd1,        //mov r10,rcx0xb8,0xb9,0x00,0x00,0x00, //mov eax,0B9h0x0f,0x05,          //syscall0xc3            //ret
*/#define SYS_CALL_START_MAGIC_LENGTH 4unsigned char SYS_CALL_START_MAGIC[] = {  0x4c, 0x8b, 0xd1, 0xb8};
#define MAX_SEARCH_LENGTH  24
PVOID RVAtoRawOffset(DWORD_PTR RVA, PIMAGE_SECTION_HEADER section) {  return (PVOID)(RVA - section->VirtualAddress + section->PointerToRawData);}
SyscallIdFinder::SyscallIdFinder(){  _m_bImageInit = InitializeImage();}
SyscallIdFinder::~SyscallIdFinder(){  if (_m_pFileData)  {    ::HeapFree(GetProcessHeap(), HEAP_ZERO_MEMORY, _m_pFileData);    _m_pFileData = NULL;  }
  if (_m_hFile != INVALID_HANDLE_VALUE && _m_hFile != NULL)  {    ::CloseHandle(_m_hFile);    _m_hFile = NULL;  }}
DWORD SyscallIdFinder::GetSyscallIdFromMemeory(const CHAR* pszFuncName){  HMODULE hModule = ::GetModuleHandleA("ntdll.dll");  unsigned char* pFuncAddr = (unsigned char*)::GetProcAddress(hModule, pszFuncName);  if (pFuncAddr == NULL) {    return NOT_FOUND_SYSCALL_ID;  }  return MatchSyscallId(pFuncAddr);}
DWORD SyscallIdFinder::GetSystemIdFromImage(const CHAR* pszFuncName){  if (!_m_bImageInit) {    return NOT_FOUND_SYSCALL_ID;  }  PDWORD addressOfNames = (PDWORD)RVAtoRawOffset((DWORD_PTR)_m_pFileData + *(&_m_pExportDirectory->AddressOfNames), _m_pRDATASection);  PDWORD addressOfFunctions = (PDWORD)RVAtoRawOffset((DWORD_PTR)_m_pFileData + *(&_m_pExportDirectory->AddressOfFunctions), _m_pRDATASection);  BOOL stubFound = FALSE;
  for (size_t i = 0; i < _m_pExportDirectory->NumberOfNames; i++)  {    DWORD_PTR functionNameVA = (DWORD_PTR)RVAtoRawOffset((DWORD_PTR)_m_pFileData + addressOfNames[i], _m_pRDATASection);    LPCSTR functionNameResolved = (LPCSTR)functionNameVA;    if (strcmp(functionNameResolved, pszFuncName) == 0)    {      DWORD_PTR functionVA = (DWORD_PTR)RVAtoRawOffset((DWORD_PTR)_m_pFileData + addressOfFunctions[i + 1], _m_pTEXTSection);      DWORD syscallId = MatchSyscallId((unsigned char*)functionVA);      if (syscallId > 0) {        return syscallId;      }    }  }
  return NOT_FOUND_SYSCALL_ID;}
BOOL SyscallIdFinder::InitializeImage(){  _m_pFileData = NULL;  _m_hFile = CreateFileA("c:\\windows\\system32\\ntdll.dll",    GENERIC_READ,    FILE_SHARE_READ,    NULL,    OPEN_EXISTING,    FILE_ATTRIBUTE_NORMAL,    NULL);  if (_m_hFile == NULL || _m_hFile == INVALID_HANDLE_VALUE) {    return FALSE;  }  DWORD fileSize = ::GetFileSize(_m_hFile, NULL);  _m_pFileData = ::HeapAlloc(GetProcessHeap(), 0, fileSize);  ::ReadFile(_m_hFile, _m_pFileData, fileSize, &fileSize, NULL);
  PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)_m_pFileData;  PIMAGE_NT_HEADERS imageNTHeaders = (PIMAGE_NT_HEADERS)((DWORD_PTR)_m_pFileData + dosHeader->e_lfanew);  DWORD exportDirRVA = imageNTHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;  PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(imageNTHeaders);  _m_pTEXTSection = section;  _m_pRDATASection = section;  for (int i = 0; i < imageNTHeaders->FileHeader.NumberOfSections; i++)  {    if (strcmp((CHAR*)section->Name, (CHAR*)".rdata") == 0) {      _m_pRDATASection = section;      break;    }    section++;  }  _m_pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)RVAtoRawOffset((DWORD_PTR)_m_pFileData + exportDirRVA, _m_pRDATASection);  return TRUE;}
DWORD SyscallIdFinder::MatchSyscallId(unsigned char* pData){  // bypass inline hook and iat hook  // Inline hook usually occupies 5 bytes or 7 bytes at the beginning of the function  // eg. jump xxxx  DWORD syscallId = NOT_FOUND_SYSCALL_ID;  for (int item = 0; item < MAX_SEARCH_LENGTH; item++) {    if (memcmp((pData + item), &SYS_CALL_START_MAGIC, SYS_CALL_START_MAGIC_LENGTH) == 0) {      memcpy(&syscallId, (pData + item + 4), sizeof(DWORD));      break;    }  }  return syscallId;}

OBJECT_ATTRIBUTES oa;HANDLE fileHandle = NULL;UNICODE_STRING fileName;RtlInitUnicodeString(&fileName, (PCWSTR)L"\\??\\C:\\test.log");IO_STATUS_BLOCK osb;ZeroMemory(&osb, sizeof(IO_STATUS_BLOCK));InitializeObjectAttributes(&oa, &fileName, 0x00000040, NULL, NULL);
// 通过PEB的方式获取NTDLL.DLL的函数代码段BYTE* pFuncStub = GetFunctionStubFromMemory((CHAR*)"NtCreateFile");// 从函数代码段中匹配到系统调用号DWORD syscallId = MatchSyscallId(pFuncStub);// 设置系统调用号，此时的汇编代码就是NT函数的实现SetSyscallId(syscallId);// 将DynamicSyscall函数指针赋值给定义NtCreateFile函数指针变量fnNtCreateFile fNtCreateFile = (fnNtCreateFile)DynamicSyscall;// 进行函数参数传递并调用NTSTATUS status = fNtCreateFile(&fileHandle,    FILE_GENERIC_WRITE,    &oa,    &osb,    0,    FILE_ATTRIBUTE_NORMAL,    FILE_SHARE_WRITE,    0x00000005,    0x00000020,    NULL, 0);