From 90284018e57d072ebee2ee6c21406193a5327fa2 Mon Sep 17 00:00:00 2001 From: PYDT <85057800+87owo@users.noreply.github.com> Date: Sun, 24 Aug 2025 22:06:02 +0800 Subject: [PATCH] Add files via upload --- Plugins/Filter/DriverEntry.c | 34 ++++--- Plugins/Filter/ProtectProcess.c | 156 +++++++++++++++----------------- 2 files changed, 95 insertions(+), 95 deletions(-) diff --git a/Plugins/Filter/DriverEntry.c b/Plugins/Filter/DriverEntry.c index 3e1b124..d5f4152 100644 --- a/Plugins/Filter/DriverEntry.c +++ b/Plugins/Filter/DriverEntry.c @@ -61,6 +61,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject) UNICODE_STRING name = RTL_CONSTANT_STRING(L"\\Driver\\Disk"); UNICODE_STRING sym = RTL_CONSTANT_STRING(L"IoDriverObjectType"); POBJECT_TYPE* pType = (POBJECT_TYPE*)MmGetSystemRoutineAddress(&sym); + if (!pType || !*pType) return STATUS_NOT_SUPPORTED; @@ -93,6 +94,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject) status = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter); if (!NT_SUCCESS(status)) continue; + filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE)); status = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached); if (!NT_SUCCESS(status) || !attached) { @@ -123,29 +125,29 @@ static NTSTATUS AttachFsFilters(PDRIVER_OBJECT DriverObject) UNICODE_STRING name; RtlInitUnicodeString(&name, g_AttachDisk[i]); PDEVICE_OBJECT fsCtl = NULL; - + status = ObReferenceObjectByName(&name, OBJ_CASE_INSENSITIVE, NULL, 0, *pDevType, KernelMode, NULL, (PVOID*)&fsCtl); if (!NT_SUCCESS(status) || !fsCtl) continue; - + PDRIVER_OBJECT fsDrv = fsCtl->DriverObject; if (fsDrv) { ULONG need = 0; - + status = IoEnumerateDeviceObjectList(fsDrv, NULL, 0, &need); if (status == STATUS_BUFFER_TOO_SMALL || status == STATUS_SUCCESS) { PDEVICE_OBJECT* list = (PDEVICE_OBJECT*)ExAllocatePool2(POOL_FLAG_NON_PAGED, need * sizeof(PDEVICE_OBJECT), 'fsTA'); if (list) { - + status = IoEnumerateDeviceObjectList(fsDrv, list, need * sizeof(PDEVICE_OBJECT), &need); if (NT_SUCCESS(status)) { for (ULONG j = 0; j < need && g_MbrFilterCount < MAX_MBR_TARGETS; ++j) { - + PDEVICE_OBJECT lower = list[j], filter, attached = NULL; NTSTATUS s2 = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter); if (!NT_SUCCESS(s2)) continue; - + filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE)); s2 = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached); if (!NT_SUCCESS(s2) || !attached) { @@ -171,13 +173,13 @@ static NTSTATUS AttachFsFilters(PDRIVER_OBJECT DriverObject) NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) { UNREFERENCED_PARAMETER(RegistryPath); - + KeInitializeSpinLock(&g_ProtectLock); ExInitializeFastMutex(&HookMutex); KeInitializeEvent(&g_LogDrainEvent, NotificationEvent, TRUE); g_Unloading = FALSE; g_CmRegActive = FALSE; - + InterlockedExchange(&g_LogWorkCount, 0); ExInitializeRundownProtection(&g_Rundown); { @@ -196,10 +198,13 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) NTSTATUS status = IoCreateDevice(DriverObject, 0, &g_DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_ControlDeviceObject); if (!NT_SUCCESS(status)) return status; - + DriverObject->DriverUnload = DriverUnload; for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i) DriverObject->MajorFunction[i] = CombinedDispatch; + + DriverObject->Flags |= 0x20; + g_ControlDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING; IoDeleteSymbolicLink(&g_SymLink); { @@ -208,7 +213,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) status = IoCreateSymbolicLink(&g_SymLink, &g_DeviceName); if (NT_SUCCESS(status)) break; - + LARGE_INTEGER d = { 0 }; d.QuadPart = -10LL * 1000LL * 10LL; KeDelayExecutionThread(KernelMode, FALSE, &d); @@ -228,7 +233,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) LARGE_INTEGER t = KeQueryPerformanceCounter(NULL); RtlStringCchPrintfW(regAltBuf, RTL_NUMBER_OF(regAltBuf), L"385100.%I64x", t.QuadPart); RtlInitUnicodeString(®Alt, regAltBuf); - + status = CmRegisterCallbackEx(RegistryProtectCallback, ®Alt, DriverObject, NULL, &g_CmRegHandle, NULL); if (NT_SUCCESS(status)) g_CmRegActive = TRUE; @@ -272,8 +277,11 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject) UninitRemoteProtect(); UninitScreenProtect(); UninitProcessProtect(); - ExWaitForRundownProtectionRelease(&g_Rundown); + ExWaitForRundownProtectionRelease(&g_Rundown); + if (InterlockedCompareExchange((volatile LONG*)&g_LogWorkCount, 0, 0) != 0) { + KeWaitForSingleObject(&g_LogDrainEvent, Executive, KernelMode, FALSE, NULL); + } if (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0) { KeResetEvent(&g_LogDrainEvent); while (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0) @@ -299,4 +307,4 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject) IoDeleteDevice(g_GuardDevice); g_GuardDevice = NULL; } -} +} \ No newline at end of file diff --git a/Plugins/Filter/ProtectProcess.c b/Plugins/Filter/ProtectProcess.c index ee3bd96..6fe1a79 100644 --- a/Plugins/Filter/ProtectProcess.c +++ b/Plugins/Filter/ProtectProcess.c @@ -20,79 +20,54 @@ static BOOLEAN g_ProcNotifyEnabled = FALSE; static PVOID g_ObCookie = NULL; static OBCTX g_ObCtx = { 0 }; static HANDLE g_ProtectedPid = NULL; +static PWCH g_ObAltitudeBuf = NULL; -static BOOLEAN EndsWithNameA(PCSTR s, PCSTR name) { - if (!s || !name) { +static BOOLEAN IsProcNameEq(PEPROCESS p, PCSTR name) +{ + PCSTR img = PsGetProcessImageFileName(p); + if (!img || !name) return FALSE; - } - SIZE_T n = strlen(s); - SIZE_T m = strlen(name); - if (n < m) { - return FALSE; - } - return _stricmp(s + (n - m), name) == 0; + + ANSI_STRING a = { 0 }, b = { 0 }; + RtlInitAnsiString(&a, img); + RtlInitAnsiString(&b, name); + return RtlEqualString(&a, &b, TRUE) ? TRUE : FALSE; } -static BOOLEAN EndsWithNameUS(PUNICODE_STRING s, const wchar_t* name) { - if (!s || !s->Buffer || s->Length == 0 || !name) { - return FALSE; - } - SIZE_T n = s->Length / sizeof(WCHAR); - SIZE_T m = wcslen(name); - if (n < m) { - return FALSE; - } - return _wcsnicmp(s->Buffer + (n - m), name, m) == 0; -} - -static BOOLEAN IsTargetProcess(PEPROCESS p) { - if (!p) { - return FALSE; - } - HANDLE pid = PsGetProcessId(p); - WCHAR buf[512] = { 0 }; - UNICODE_STRING img = { 0 }; - img.Buffer = buf; - img.MaximumLength = sizeof(buf); - if (GetProcessImagePathByPid(pid, &img)) { - if (EndsWithNameUS(&img, L"PYAS.exe")) { - return TRUE; - } - return FALSE; - } - return EndsWithNameA(PsGetProcessImageFileName(p), "PYAS.exe"); -} - -static NTSTATUS SetPPL31(PEPROCESS p) { - if (!g_PsSetProcessProtection) { +static NTSTATUS SetPPL31(PEPROCESS p) +{ + if (!g_PsSetProcessProtection) return STATUS_PROCEDURE_NOT_FOUND; - } + PS_PROTECTION pr = { 0 }; pr.Level = 0x31; ((VOID(NTAPI*)(PEPROCESS, PS_PROTECTION))g_PsSetProcessProtection)(p, pr); return STATUS_SUCCESS; } -static VOID LogSet(HANDLE pid, NTSTATUS st) { +static VOID LogSet(HANDLE pid, NTSTATUS st) +{ CHAR b[128] = { 0 }; RtlStringCchPrintfA(b, RTL_NUMBER_OF(b), "PROC_PPL_SET | %u | 0x31 | 0x%08X", (ULONG)(ULONG_PTR)pid, st); SendPipeLog(b, strlen(b)); } -static VOID UpdateProtectedPid(HANDLE pid) { +static VOID UpdateProtectedPid(HANDLE pid) +{ InterlockedExchangePointer((PVOID*)&g_ProtectedPid, pid); } -static VOID BootstrapExisting(VOID) { +static VOID BootstrapExisting(VOID) +{ typedef PEPROCESS(NTAPI* PFN_PsGetNextProcess)(PEPROCESS); UNICODE_STRING n = RTL_CONSTANT_STRING(L"PsGetNextProcess"); PFN_PsGetNextProcess fp = (PFN_PsGetNextProcess)MmGetSystemRoutineAddress(&n); - if (!fp) { + if (!fp) return; - } + PEPROCESS p = fp(NULL); while (p) { - if (IsTargetProcess(p)) { + if (IsProcNameEq(p, "PYAS.exe")) { HANDLE pid = PsGetProcessId(p); NTSTATUS s = SetPPL31(p); UpdateProtectedPid(pid); @@ -104,7 +79,8 @@ static VOID BootstrapExisting(VOID) { } } -static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info) { +static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info) +{ ACCESS_MASK d = PROCESS_TERMINATE | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_SET_INFORMATION | PROCESS_SET_LIMITED_INFORMATION | PROCESS_SUSPEND_RESUME | PROCESS_DUP_HANDLE; if (Info->Operation == OB_OPERATION_HANDLE_CREATE) { Info->Parameters->CreateHandleInformation.DesiredAccess &= ~d; @@ -114,7 +90,8 @@ static VOID StripProcessAccess(POB_PRE_OPERATION_INFORMATION Info) { } } -static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info) { +static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info) +{ ACCESS_MASK d = THREAD_TERMINATE | THREAD_SUSPEND_RESUME | THREAD_SET_CONTEXT | THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION; if (Info->Operation == OB_OPERATION_HANDLE_CREATE) { Info->Parameters->CreateHandleInformation.DesiredAccess &= ~d; @@ -124,42 +101,42 @@ static VOID StripThreadAccess(POB_PRE_OPERATION_INFORMATION Info) { } } -static OB_PREOP_CALLBACK_STATUS ObPreOperation(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info) { +static OB_PREOP_CALLBACK_STATUS ObPreOperation(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info) +{ UNREFERENCED_PARAMETER(RegistrationContext); - if (g_Unloading) { + + if (g_Unloading) return OB_PREOP_SUCCESS; - } - if (!ExAcquireRundownProtection(&g_Rundown)) { + if (!Info || Info->KernelHandle) return OB_PREOP_SUCCESS; - } + if (!ExAcquireRundownProtection(&g_Rundown)) + return OB_PREOP_SUCCESS; + if (Info->ObjectType == g_ObCtx.ProcessType) { PEPROCESS pe = (PEPROCESS)Info->Object; HANDLE tpid = PsGetProcessId(pe); if (g_ProtectedPid && tpid == g_ProtectedPid) { - if (PsGetCurrentProcessId() != g_ProtectedPid) { - StripProcessAccess(Info); - } + if (PsGetCurrentProcessId() != g_ProtectedPid) StripProcessAccess(Info); } } else if (Info->ObjectType == g_ObCtx.ThreadType) { PETHREAD th = (PETHREAD)Info->Object; HANDLE owner = PsGetThreadProcessId(th); if (g_ProtectedPid && owner == g_ProtectedPid) { - if (PsGetCurrentProcessId() != g_ProtectedPid) { - StripThreadAccess(Info); - } + if (PsGetCurrentProcessId() != g_ProtectedPid) StripThreadAccess(Info); } } ExReleaseRundownProtection(&g_Rundown); return OB_PREOP_SUCCESS; } -static NTSTATUS InitObCallbacks(VOID) +static NTSTATUS InitObCallbacks(VOID) { g_ObCtx.ProcessType = *PsProcessType; g_ObCtx.ThreadType = *PsThreadType; - OB_OPERATION_REGISTRATION ops[2] = { 0 }; + static OB_OPERATION_REGISTRATION ops[2]; + RtlZeroMemory(ops, sizeof(ops)); ops[0].ObjectType = PsProcessType; ops[0].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE; ops[0].PreOperation = ObPreOperation; @@ -167,45 +144,55 @@ static NTSTATUS InitObCallbacks(VOID) ops[1].Operations = OB_OPERATION_HANDLE_CREATE | OB_OPERATION_HANDLE_DUPLICATE; ops[1].PreOperation = ObPreOperation; - UNICODE_STRING alt; - RtlInitUnicodeString(&alt, L"385100"); + const WCHAR* altStatic = L"321000"; + USHORT alen = (USHORT)(wcslen(altStatic) * sizeof(WCHAR)); + g_ObAltitudeBuf = (PWCH)ExAllocatePool2(POOL_FLAG_NON_PAGED, alen + sizeof(WCHAR), 'tlaO'); + if (!g_ObAltitudeBuf) + return STATUS_INSUFFICIENT_RESOURCES; + RtlCopyMemory(g_ObAltitudeBuf, altStatic, alen); + g_ObAltitudeBuf[alen / sizeof(WCHAR)] = 0; + + UNICODE_STRING alt = { 0 }; + alt.Buffer = g_ObAltitudeBuf; + alt.Length = alen; + alt.MaximumLength = alen; OB_CALLBACK_REGISTRATION reg = { 0 }; reg.Version = OB_FLT_REGISTRATION_VERSION; reg.OperationRegistrationCount = 2; - reg.RegistrationContext = NULL; + reg.RegistrationContext = g_ObAltitudeBuf; reg.Altitude = alt; reg.OperationRegistration = ops; - return ObRegisterCallbacks(®, &g_ObCookie); + + NTSTATUS s = ObRegisterCallbacks(®, &g_ObCookie); + if (!NT_SUCCESS(s)) { + ExFreePool2(g_ObAltitudeBuf, 'tlaO', NULL, 0); + g_ObAltitudeBuf = NULL; + } + return s; } -static VOID ProcessNotifyEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) { - if (g_Unloading) { +static VOID ProcessNotifyEx(PEPROCESS Process, HANDLE ProcessId, PPS_CREATE_NOTIFY_INFO CreateInfo) +{ + if (g_Unloading) return; - } - if (!ExAcquireRundownProtection(&g_Rundown)) { + if (!ExAcquireRundownProtection(&g_Rundown)) return; - } if (CreateInfo) { - UNICODE_STRING img = { 0 }; - if (CreateInfo->ImageFileName) { - img = *CreateInfo->ImageFileName; - } - if ((img.Buffer && EndsWithNameUS(&img, L"PYAS.exe")) || (!img.Buffer && IsTargetProcess(Process))) { + if (IsProcNameEq(Process, "PYAS.exe")) { NTSTATUS s = SetPPL31(Process); UpdateProtectedPid(ProcessId); LogSet(ProcessId, s); } } else { - if (g_ProtectedPid && ProcessId == g_ProtectedPid) { - UpdateProtectedPid(NULL); - } + if (g_ProtectedPid && ProcessId == g_ProtectedPid) UpdateProtectedPid(NULL); } ExReleaseRundownProtection(&g_Rundown); } -NTSTATUS InitProcessProtect(VOID) { +NTSTATUS InitProcessProtect(VOID) +{ UNICODE_STRING n = RTL_CONSTANT_STRING(L"PsSetProcessProtection"); g_PsSetProcessProtection = MmGetSystemRoutineAddress(&n); @@ -220,7 +207,8 @@ NTSTATUS InitProcessProtect(VOID) { return STATUS_SUCCESS; } -VOID UninitProcessProtect(VOID) { +VOID UninitProcessProtect(VOID) +{ if (g_ProcNotifyEnabled) { PsSetCreateProcessNotifyRoutineEx(ProcessNotifyEx, TRUE); g_ProcNotifyEnabled = FALSE; @@ -229,4 +217,8 @@ VOID UninitProcessProtect(VOID) { ObUnRegisterCallbacks(g_ObCookie); g_ObCookie = NULL; } + if (g_ObAltitudeBuf) { + ExFreePool2(g_ObAltitudeBuf, 'tlaO', NULL, 0); + g_ObAltitudeBuf = NULL; + } }