87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
PYDT authored and GitHub committed 2025-08-24 22:06:02 +08:00
1 parent 46eeec16d4
commit 90284018e5
2 files changed
+95 -95
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Plugins/Filter/DriverEntry.c
+21 -13
View File
@@ -61,6 +61,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
UNICODE_STRING name = RTL_CONSTANT_STRING(L"\\Driver\\Disk");
UNICODE_STRING sym = RTL_CONSTANT_STRING(L"IoDriverObjectType");
POBJECT_TYPE* pType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&sym);
if (!pType || !*pType)
return STATUS_NOT_SUPPORTED;
@@ -93,6 +94,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
status = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter);
if (!NT_SUCCESS(status))
continue;
filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE));
status = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached);
if (!NT_SUCCESS(status) || !attached) {
@@ -123,29 +125,29 @@ static NTSTATUS AttachFsFilters(PDRIVER_OBJECT DriverObject)
UNICODE_STRING name;
RtlInitUnicodeString(&name, g_AttachDisk[i]);
PDEVICE_OBJECT fsCtl = NULL;
status = ObReferenceObjectByName(&name, OBJ_CASE_INSENSITIVE, NULL, 0, *pDevType, KernelMode, NULL, (PVOID*)&fsCtl);
if (!NT_SUCCESS(status) || !fsCtl)
continue;
PDRIVER_OBJECT fsDrv = fsCtl->DriverObject;
if (fsDrv) {
ULONG need = 0;
status = IoEnumerateDeviceObjectList(fsDrv, NULL, 0, &need);
if (status == STATUS_BUFFER_TOO_SMALL || status == STATUS_SUCCESS) {
PDEVICE_OBJECT* list = (PDEVICE_OBJECT*)ExAllocatePool2(POOL_FLAG_NON_PAGED, need * sizeof(PDEVICE_OBJECT), 'fsTA');
if (list) {
status = IoEnumerateDeviceObjectList(fsDrv, list, need * sizeof(PDEVICE_OBJECT), &need);
if (NT_SUCCESS(status)) {
for (ULONG j = 0; j < need && g_MbrFilterCount < MAX_MBR_TARGETS; ++j) {
PDEVICE_OBJECT lower = list[j], filter, attached = NULL;
NTSTATUS s2 = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter);
if (!NT_SUCCESS(s2))
continue;
filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE));
s2 = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached);
if (!NT_SUCCESS(s2) || !attached) {
@@ -171,13 +173,13 @@ static NTSTATUS AttachFsFilters(PDRIVER_OBJECT DriverObject)
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
UNREFERENCED_PARAMETER(RegistryPath);
KeInitializeSpinLock(&g_ProtectLock);
ExInitializeFastMutex(&HookMutex);
KeInitializeEvent(&g_LogDrainEvent, NotificationEvent, TRUE);
g_Unloading = FALSE;
g_CmRegActive = FALSE;
InterlockedExchange(&g_LogWorkCount, 0);
ExInitializeRundownProtection(&g_Rundown);
{
@@ -196,10 +198,13 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
NTSTATUS status = IoCreateDevice(DriverObject, 0, &g_DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_ControlDeviceObject);
if (!NT_SUCCESS(status))
return status;
DriverObject->DriverUnload = DriverUnload;
for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
DriverObject->MajorFunction[i] = CombinedDispatch;
DriverObject->Flags |= 0x20;
g_ControlDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
IoDeleteSymbolicLink(&g_SymLink);
{
@@ -208,7 +213,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
status = IoCreateSymbolicLink(&g_SymLink, &g_DeviceName);
if (NT_SUCCESS(status))
break;
LARGE_INTEGER d = { 0 };
d.QuadPart = -10LL * 1000LL * 10LL;
KeDelayExecutionThread(KernelMode, FALSE, &d);
@@ -228,7 +233,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
RtlStringCchPrintfW(regAltBuf, RTL_NUMBER_OF(regAltBuf), L"385100.%I64x", t.QuadPart);
RtlInitUnicodeString(&regAlt, regAltBuf);
status = CmRegisterCallbackEx(RegistryProtectCallback, &regAlt, DriverObject, NULL, &g_CmRegHandle, NULL);
if (NT_SUCCESS(status))
g_CmRegActive = TRUE;
@@ -272,8 +277,11 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject)
UninitRemoteProtect();
UninitScreenProtect();
UninitProcessProtect();
ExWaitForRundownProtectionRelease(&g_Rundown);
ExWaitForRundownProtectionRelease(&g_Rundown);
if (InterlockedCompareExchange((volatile LONG*)&g_LogWorkCount, 0, 0) != 0) {
KeWaitForSingleObject(&g_LogDrainEvent, Executive, KernelMode, FALSE, NULL);
}
if (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0) {
KeResetEvent(&g_LogDrainEvent);
while (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0)
@@ -299,4 +307,4 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject)
IoDeleteDevice(g_GuardDevice);
g_GuardDevice = NULL;
}
}
}
Plugins/Filter/ProtectProcess.c
+74 -82
View File
@@ -20,79 +20,54 @@ static BOOLEAN g_ProcNotifyEnabled = FALSE;
static PVOID g_ObCookie = NULL;
static OBCTX g_ObCtx = { 0 };
static HANDLE g_ProtectedPid = NULL;
static PWCH g_ObAltitudeBuf = NULL;
static BOOLEAN EndsWithNameA(PCSTR s, PCSTR name) {
if (!s || !name) {
static BOOLEAN IsProcNameEq(PEPROCESS p, PCSTR name)
{
PCSTR img = PsGetProcessImageFileName(p);
if (!img || !name)
return FALSE;
}
SIZE_T n = strlen(s);
SIZE_T m = strlen(name);
if (n < m) {
return FALSE;
}
return _stricmp(s + (n - m), name) == 0;
ANSI_STRING a = { 0 }, b = { 0 };
RtlInitAnsiString(&a, img);
RtlInitAnsiString(&b, name);
return RtlEqualString(&a, &b, TRUE) ? TRUE : FALSE;
}
static BOOLEAN EndsWithNameUS(PUNICODE_STRING s, const wchar_t* name) {
if (!s || !s->Buffer || s->Length == 0 || !name) {
return FALSE;
}
SIZE_T n = s->Length / sizeof(WCHAR);
SIZE_T m = wcslen(name);
if (n < m) {
return FALSE;
}
return _wcsnicmp(s->Buffer + (n - m), name, m) == 0;
}
static BOOLEAN IsTargetProcess(PEPROCESS p) {
if (!p) {
return FALSE;
}
HANDLE pid = PsGetProcessId(p);
WCHAR buf[512] = { 0 };
UNICODE_STRING img = { 0 };
img.Buffer = buf;
img.MaximumLength = sizeof(buf);
if (GetProcessImagePathByPid(pid, &img)) {
if (EndsWithNameUS(&img, L"PYAS.exe")) {
return TRUE;
}
return FALSE;
}
return EndsWithNameA(PsGetProcessImageFileName(p), "PYAS.exe");
}
static NTSTATUS SetPPL31(PEPROCESS p) {
if (!g_PsSetProcessProtection) {
static NTSTATUS SetPPL31(PEPROCESS p)
{
if (!g_PsSetProcessProtection)
return STATUS_PROCEDURE_NOT_FOUND;
}
PS_PROTECTION pr = { 0 };
pr.Level = 0x31;
((VOID(NTAPI*)(PEPROCESS, PS_PROTECTION))g_PsSetProcessProtection)(p, pr);
return STATUS_SUCCESS;
}
static VOID LogSet(HANDLE pid, NTSTATUS st) {
static VOID LogSet(HANDLE pid, NTSTATUS st)
{
CHAR b[128] = { 0 };
RtlStringCchPrintfA(b, RTL_NUMBER_OF(b), "PROC_PPL_SET | %u | 0x31 | 0x%08X", (ULONG)(ULONG_PTR)pid, st);
SendPipeLog(b, strlen(b));
}
static VOID UpdateProtectedPid(HANDLE pid) {
static VOID UpdateProtectedPid(HANDLE pid)
{
InterlockedExchangePointer((PVOID*)&g_ProtectedPid, pid);
}
static VOID BootstrapExisting(VOID) {
static VOID BootstrapExisting(VOID)
{
typedef PEPROCESS(NTAPI* PFN_PsGetNextProcess)(PEPROCESS);
UNICODE_STRING n = RTL_CONSTANT_STRING(L"PsGetNextProcess");
PFN_PsGetNextProcess fp = (PFN_PsGetNextProcess)MmGetSystemRoutineAddress(&n);
if (!fp) {
if (!fp)
return;
}
PEPROCESS p = fp(NULL);
while (p) {
if (IsTargetProcess(p)) {
if (IsProcNameEq(p, "PYAS.exe")) {
HANDLE pid = PsGetProcessId(p);
NTSTATUS s = SetPPL31(p);
UpdateProtectedPid(pid);
@@ -104,7 +79,8 @@ static VOID BootstrapExisting(VOID) {
}
}
static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info) {
static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info)
{
ACCESS_MASK d = PROCESS_TERMINATE | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_SET_INFORMATION | PROCESS_SET_LIMITED_INFORMATION | PROCESS_SUSPEND_RESUME | PROCESS_DUP_HANDLE;
if (Info->Operation == OB_OPERATION_HANDLE_CREATE) {
Info->Parameters->CreateHandleInformation.DesiredAccess &= ~d;
@@ -114,7 +90,8 @@ static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info) {
}
}
static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info) {
static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info)
{
ACCESS_MASK d = THREAD_TERMINATE | THREAD_SUSPEND_RESUME | THREAD_SET_CONTEXT | THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION;
if (Info->Operation == OB_OPERATION_HANDLE_CREATE) {
Info->Parameters->CreateHandleInformation.DesiredAccess &= ~d;
@@ -124,42 +101,42 @@ static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info) {
}
}
static OB_PREOP_CALLBACK_STATUS ObPreOperation(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info) {
static OB_PREOP_CALLBACK_STATUS ObPreOperation(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info)
{
UNREFERENCED_PARAMETER(RegistrationContext);
if (g_Unloading) {
if (g_Unloading)
return OB_PREOP_SUCCESS;
}
if (!ExAcquireRundownProtection(&g_Rundown)) {
if (!Info || Info->KernelHandle)
return OB_PREOP_SUCCESS;
}
if (!ExAcquireRundownProtection(&g_Rundown))
return OB_PREOP_SUCCESS;
if (Info->ObjectType == g_ObCtx.ProcessType) {
PEPROCESS pe = (PEPROCESS)Info->Object;
HANDLE tpid = PsGetProcessId(pe);
if (g_ProtectedPid && tpid == g_ProtectedPid) {
if (PsGetCurrentProcessId() != g_ProtectedPid) {
StripProcessAccess(Info);
}
if (PsGetCurrentProcessId() != g_ProtectedPid) StripProcessAccess(Info);
}
}
else if (Info->ObjectType == g_ObCtx.ThreadType) {
PETHREAD th = (PETHREAD)Info->Object;
HANDLE owner = PsGetThreadProcessId(th);
if (g_ProtectedPid && owner == g_ProtectedPid) {
if (PsGetCurrentProcessId() != g_ProtectedPid) {
StripThreadAccess(Info);
}
if (PsGetCurrentProcessId() != g_ProtectedPid) StripThreadAccess(Info);
}
}
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
static NTSTATUS InitObCallbacks(VOID)
static NTSTATUS InitObCallbacks(VOID)
{
g_ObCtx.ProcessType = *PsProcessType;
g_ObCtx.ThreadType = *PsThreadType;
OB_OPERATION_REGISTRATION ops[2] = { 0 };
static OB_OPERATION_REGISTRATION ops[2];
RtlZeroMemory(ops, sizeof(ops));
ops[0].ObjectType = PsProcessType;
ops[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
ops[0].PreOperation = ObPreOperation;
@@ -167,45 +144,55 @@ static NTSTATUS InitObCallbacks(VOID)
ops[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE;
ops[1].PreOperation = ObPreOperation;
UNICODE_STRING alt;
RtlInitUnicodeString(&alt, L"385100");
const WCHAR* altStatic = L"321000";
USHORT alen = (USHORT)(wcslen(altStatic) * sizeof(WCHAR));
g_ObAltitudeBuf = (PWCH)ExAllocatePool2(POOL_FLAG_NON_PAGED, alen + sizeof(WCHAR), 'tlaO');
if (!g_ObAltitudeBuf)
return STATUS_INSUFFICIENT_RESOURCES;
RtlCopyMemory(g_ObAltitudeBuf, altStatic, alen);
g_ObAltitudeBuf[alen / sizeof(WCHAR)] = 0;
UNICODE_STRING alt = { 0 };
alt.Buffer = g_ObAltitudeBuf;
alt.Length = alen;
alt.MaximumLength = alen;
OB_CALLBACK_REGISTRATION reg = { 0 };
reg.Version = OB_FLT_REGISTRATION_VERSION;
reg.OperationRegistrationCount = 2;
reg.RegistrationContext = NULL;
reg.RegistrationContext = g_ObAltitudeBuf;
reg.Altitude = alt;
reg.OperationRegistration = ops;
return ObRegisterCallbacks(&reg, &g_ObCookie);
NTSTATUS s = ObRegisterCallbacks(&reg, &g_ObCookie);
if (!NT_SUCCESS(s)) {
ExFreePool2(g_ObAltitudeBuf, 'tlaO', NULL, 0);
g_ObAltitudeBuf = NULL;
}
return s;
}
static VOID ProcessNotifyEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) {
if (g_Unloading) {
static VOID ProcessNotifyEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo)
{
if (g_Unloading)
return;
}
if (!ExAcquireRundownProtection(&g_Rundown)) {
if (!ExAcquireRundownProtection(&g_Rundown))
return;
}
if (CreateInfo) {
UNICODE_STRING img = { 0 };
if (CreateInfo->ImageFileName) {
img = *CreateInfo->ImageFileName;
}
if ((img.Buffer && EndsWithNameUS(&img, L"PYAS.exe")) || (!img.Buffer && IsTargetProcess(Process))) {
if (IsProcNameEq(Process, "PYAS.exe")) {
NTSTATUS s = SetPPL31(Process);
UpdateProtectedPid(ProcessId);
LogSet(ProcessId, s);
}
}
else {
if (g_ProtectedPid && ProcessId == g_ProtectedPid) {
UpdateProtectedPid(NULL);
}
if (g_ProtectedPid && ProcessId == g_ProtectedPid) UpdateProtectedPid(NULL);
}
ExReleaseRundownProtection(&g_Rundown);
}
NTSTATUS InitProcessProtect(VOID) {
NTSTATUS InitProcessProtect(VOID)
{
UNICODE_STRING n = RTL_CONSTANT_STRING(L"PsSetProcessProtection");
g_PsSetProcessProtection = MmGetSystemRoutineAddress(&n);
@@ -220,7 +207,8 @@ NTSTATUS InitProcessProtect(VOID) {
return STATUS_SUCCESS;
}
VOID UninitProcessProtect(VOID) {
VOID UninitProcessProtect(VOID)
{
if (g_ProcNotifyEnabled) {
PsSetCreateProcessNotifyRoutineEx(ProcessNotifyEx, TRUE);
g_ProcNotifyEnabled = FALSE;
@@ -229,4 +217,8 @@ VOID UninitProcessProtect(VOID) {
ObUnRegisterCallbacks(g_ObCookie);
g_ObCookie = NULL;
}
if (g_ObAltitudeBuf) {
ExFreePool2(g_ObAltitudeBuf, 'tlaO', NULL, 0);
g_ObAltitudeBuf = NULL;
}
}