init

2026-05-27 13:24:57 +08:00
commit 4bf9a42170
21 changed files with 901 additions and 0 deletions
@@ -0,0 +1,82 @@
+#include "ob_reg_callback.h"
+void* reg_ob_callback_handle;
+
+
+auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL
+{
+	if (!image_file_name->Buffer)
+		return FALSE;
+
+	if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe"))
+		return TRUE;
+
+	return FALSE;
+}
+
+
+auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
+{
+	auto ob_callback = [](_In_ PVOID RegistrationContext, 
+		_In_ POB_PRE_OPERATION_INFORMATION pOperationInformation) -> OB_PREOP_CALLBACK_STATUS
+	{
+		UNREFERENCED_PARAMETER(RegistrationContext);
+		auto dwPid = PsGetProcessId(reinterpret_cast<PEPROCESS>(pOperationInformation->Object));
+		
+		auto operation_eprocess = PsGetCurrentProcess();
+
+		PUNICODE_STRING image_file_name{ 0 };
+		auto status = SeLocateProcessImageName(operation_eprocess, &image_file_name);
+		if (NT_SUCCESS(status))
+		{
+			if(is_allow_process(image_file_name))
+				goto end;
+				
+			if (dwPid == ULongToHandle(1836))
+			{
+				pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
+				pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
+			}
+		}
+	end:
+		return OB_PREOP_SUCCESS;
+	};
+
+	NTSTATUS status;
+	OB_CALLBACK_REGISTRATION obReg;
+	OB_OPERATION_REGISTRATION opReg;
+	memset(&obReg, 0, sizeof(obReg));
+	obReg.Version = ObGetFilterVersion();
+	obReg.OperationRegistrationCount = 1;
+	obReg.RegistrationContext = NULL;
+	RtlInitUnicodeString(&obReg.Altitude, L"32688");
+	obReg.OperationRegistration = &opReg;
+	memset(&opReg, 0, sizeof(opReg));
+	opReg.ObjectType = PsProcessType;
+	opReg.Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
+	opReg.PreOperation = (POB_PRE_OPERATION_CALLBACK)ob_callback;
+
+	//-------------------------------------------------------
+	//PVOID addr = (PVOID)((ULONG64)*PsProcessType + 0x40 + 0x20);
+	//*(PULONG)addr = 0x1fffff;  //注意  ： 修改PsProcessType/PsThreadType下_OBJECT_TYPE_INITIALIZER下RetainAccess为0x1fffff 无视抹权限 ObpPreInterceptHandleCreate
+	//方式2 : 注册两个ObRegisterCallbacks 层分别在xx的上方和下方 等xx抹了之后 抹回去
+	//方式3 ：Pte hook Obp
+	//方式4 ：遍历CallbacksList替换或修改Pre Post函数
+
+	status = ObRegisterCallbacks(&obReg, &reg_ob_callback_handle);
+	return status;
+	
+}
+
+auto ob_call_back::uninstall_ob_callback() -> BOOLEAN
+{
+
+	if (reg_ob_callback_handle)
+	{
+		ObUnRegisterCallbacks(reg_ob_callback_handle);
+		reg_ob_callback_handle = nullptr;
+
+		return TRUE;
+	}
+	
+	return FALSE;
+}