106 lines
3.0 KiB
C++
106 lines
3.0 KiB
C++
#include "ob_reg_callback.h"
|
|
#include "create_thread_callback.h"
|
|
#include "process_notify_callback.h"
|
|
#include "protect_filter.h"
|
|
#include "comm.h"
|
|
#include "inline_hooks.h"
|
|
#include "mouse_keybord_hook.h"
|
|
|
|
typedef NTSTATUS (NTAPI* fnNtOpenProcess)(
|
|
_Out_ PHANDLE ProcessHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
|
_In_opt_ PCLIENT_ID ClientId);
|
|
|
|
typedef NTSTATUS(NTAPI* fnNtCreateFile)(
|
|
_Out_ PHANDLE FileHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
|
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
|
_In_opt_ PLARGE_INTEGER AllocationSize,
|
|
_In_ ULONG FileAttributes,
|
|
_In_ ULONG ShareAccess,
|
|
_In_ ULONG CreateDisposition,
|
|
_In_ ULONG CreateOptions,
|
|
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
|
|
_In_ ULONG EaLength
|
|
);
|
|
|
|
|
|
fnNtOpenProcess origon_ntOpenProcess;
|
|
fnNtCreateFile origon_ntCreatFile;
|
|
|
|
NTSTATUS NTAPI hkNtOpenProcess(
|
|
_Out_ PHANDLE ProcessHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
|
_In_opt_ PCLIENT_ID ClientId
|
|
)
|
|
{
|
|
|
|
DbgPrintEx(77, 0, "NtOpenProcess\n");
|
|
|
|
return origon_ntOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
NTAPI
|
|
hkNtCreateFile(
|
|
_Out_ PHANDLE FileHandle,
|
|
_In_ ACCESS_MASK DesiredAccess,
|
|
_In_ POBJECT_ATTRIBUTES ObjectAttributes,
|
|
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
|
|
_In_opt_ PLARGE_INTEGER AllocationSize,
|
|
_In_ ULONG FileAttributes,
|
|
_In_ ULONG ShareAccess,
|
|
_In_ ULONG CreateDisposition,
|
|
_In_ ULONG CreateOptions,
|
|
_In_reads_bytes_opt_(EaLength) PVOID EaBuffer,
|
|
_In_ ULONG EaLength
|
|
)
|
|
|
|
{
|
|
|
|
DbgPrintEx(77, 0, "NtCreateFile\n");
|
|
|
|
|
|
return origon_ntCreatFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
|
|
}
|
|
|
|
EXTERN_C NTSTATUS DriverEntry(PDRIVER_OBJECT drv_obj, PUNICODE_STRING)
|
|
{
|
|
if (drv_obj)
|
|
{
|
|
drv_obj->DriverUnload = [](PDRIVER_OBJECT)
|
|
{
|
|
kernel_comm_create::remove();
|
|
ob_call_back::uninstall_ob_callback();
|
|
process_notify_callback::remov_process_notify();
|
|
thread_notify_routine::unload_thread_routine();
|
|
|
|
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtOpenProcess);
|
|
inline_hooks_manager::fn_get_instance()->inline_remov_hook((void**)NtCreateFile);
|
|
|
|
mouse_keybord_hook::remove_mouse_keybord_hook();
|
|
};
|
|
}
|
|
|
|
protect_filter::Init();
|
|
kernel_api::kernel_api_init();
|
|
kernel_comm_create::Init();
|
|
|
|
|
|
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtOpenProcess, hkNtOpenProcess, (void**)&origon_ntOpenProcess);
|
|
//inline_hooks_manager::fn_get_instance()->inline_install_hook(NtCreateFile, hkNtCreateFile, (void**)&origon_ntCreatFile);
|
|
|
|
|
|
mouse_keybord_hook::install_mouse_keybord_hook();
|
|
DbgPrintEx(77, 0, "[+]ob_reg_callback status:%x\n", ob_call_back::register_ob_reg_callback());
|
|
DbgPrintEx(77, 0, "[+]process_notify_callback status:%x\n", process_notify_callback::install_process_notify());
|
|
DbgPrintEx(77, 0, "[+]create_thread_routine status:%x\n", thread_notify_routine::create_thread_routine());
|
|
|
|
|
|
|
|
return STATUS_SUCCESS;
|
|
} |