87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
PYDT authored and GitHub committed 2025-08-15 23:56:43 +08:00
1 parent 66aa76c836
commit e0aa080f00
8 files changed
+350 -171
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Plugins/Filter/DriverEntry.c
+80 -33
View File
@@ -10,9 +10,10 @@ PDRIVER_OBJECT DiskDrvObj = NULL;
KEVENT g_LogDrainEvent;
BOOLEAN g_Unloading = FALSE;
BOOLEAN g_CmRegActive = FALSE;
EX_RUNDOWN_REF g_Rundown;
PDEVICE_OBJECT g_GuardDevice = NULL;
volatile LONG g_LogWorkCount = 0;
static UNICODE_STRING g_DeviceName;
static WCHAR g_DeviceNameBuf[64];
static UNICODE_STRING g_SymLink = RTL_CONSTANT_STRING(L"\\??\\PYAS_Driver");
@@ -79,7 +80,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
}
status = IoEnumerateDeviceObjectList(DiskDrvObj, list, done * sizeof(PDEVICE_OBJECT), &done);
if (!NT_SUCCESS(status)) {
ExFreePool(list);
ExFreePool2(list, 'dskT', NULL, 0);
ObDereferenceObject(DiskDrvObj);
DiskDrvObj = NULL;
return status;
@@ -89,6 +90,7 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
status = IoCreateDevice(DriverObject, 0, NULL, lower->DeviceType, lower->Characteristics, FALSE, &filter);
if (!NT_SUCCESS(status))
continue;
filter->Flags |= (lower->Flags & (DO_BUFFERED_IO | DO_DIRECT_IO | DO_POWER_PAGABLE));
status = IoAttachDeviceToDeviceStackSafe(filter, lower, &attached);
if (!NT_SUCCESS(status) || !attached) {
@@ -103,22 +105,28 @@ static NTSTATUS AttachDiskFilters(PDRIVER_OBJECT DriverObject)
}
for (ULONG i = 0; i < done; ++i)
ObDereferenceObject(list[i]);
ExFreePool(list);
ExFreePool2(list, 'dskT', NULL, 0);
return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
UNREFERENCED_PARAMETER(RegistryPath);
KeInitializeSpinLock(&g_ProtectLock);
ExInitializeFastMutex(&HookMutex);
KeInitializeEvent(&g_LogDrainEvent, NotificationEvent, TRUE);
g_Unloading = FALSE;
g_CmRegActive = FALSE;
InterlockedExchange(&g_LogWorkCount, 0);
ExInitializeRundownProtection(&g_Rundown);
{
UNICODE_STRING guardName = RTL_CONSTANT_STRING(L"\\Device\\PYAS_Driver_Guard");
NTSTATUS gs = IoCreateDevice(DriverObject, 0, &guardName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_GuardDevice);
if (!NT_SUCCESS(gs))
return STATUS_DEVICE_BUSY;
}
{
LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
g_DeviceName.Buffer = g_DeviceNameBuf;
@@ -126,26 +134,47 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
RtlStringCchPrintfW(g_DeviceName.Buffer, RTL_NUMBER_OF(g_DeviceNameBuf), L"\\Device\\PYAS_Driver_%p_%I64x", DriverObject, t.QuadPart);
g_DeviceName.Length = (USHORT)(wcslen(g_DeviceName.Buffer) * sizeof(WCHAR));
}
NTSTATUS status = IoCreateDevice(DriverObject, 0, &g_DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &g_ControlDeviceObject);
if (!NT_SUCCESS(status))
if (!NT_SUCCESS(status))
return status;
DriverObject->DriverUnload = DriverUnload;
for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
for (ULONG i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; ++i)
DriverObject->MajorFunction[i] = CombinedDispatch;
g_ControlDeviceObject->Flags &= ~DO_DEVICE_INITIALIZING;
IoDeleteSymbolicLink(&g_SymLink);
if (NT_SUCCESS(IoCreateSymbolicLink(&g_SymLink, &g_DeviceName)))
g_SymLinkCreated = TRUE;
UNICODE_STRING alt = RTL_CONSTANT_STRING(L"385100");
status = CmRegisterCallbackEx(RegistryProtectCallback, &alt, DriverObject, NULL, &g_CmRegHandle, NULL);
if (NT_SUCCESS(status))
g_CmRegActive = TRUE;
{
UINT i = 0;
for (; i < 50; ++i) {
status = IoCreateSymbolicLink(&g_SymLink, &g_DeviceName);
if (NT_SUCCESS(status))
break;
LARGE_INTEGER d = { 0 };
d.QuadPart = -10LL * 1000LL * 10LL;
KeDelayExecutionThread(KernelMode, FALSE, &d);
IoDeleteSymbolicLink(&g_SymLink);
}
if (!NT_SUCCESS(status)) {
IoDeleteDevice(g_ControlDeviceObject);
g_ControlDeviceObject = NULL;
if (g_GuardDevice) {
IoDeleteDevice(g_GuardDevice);
g_GuardDevice = NULL;
}
return status;
}
}
g_SymLinkCreated = TRUE;
{
static WCHAR regAltBuf[32];
static UNICODE_STRING regAlt;
LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
RtlStringCchPrintfW(regAltBuf, RTL_NUMBER_OF(regAltBuf), L"385100.%I64x", t.QuadPart);
RtlInitUnicodeString(&regAlt, regAltBuf);
status = CmRegisterCallbackEx(RegistryProtectCallback, &regAlt, DriverObject, NULL, &g_CmRegHandle, NULL);
if (NT_SUCCESS(status))
g_CmRegActive = TRUE;
}
InitImageProtect();
InitInjectProtect();
AttachDiskFilters(DriverObject);
@@ -156,15 +185,20 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{
UNREFERENCED_PARAMETER(DriverObject);
g_Unloading = TRUE;
if (g_CmRegActive) {
CmUnRegisterCallback(g_CmRegHandle);
g_CmRegActive = FALSE;
ExWaitForRundownProtectionRelease(&g_Rundown);
if (g_SymLinkCreated) {
IoDeleteSymbolicLink(&g_SymLink);
g_SymLinkCreated = FALSE;
}
if (g_CmRegActive) {
CmUnRegisterCallback(g_CmRegHandle);
g_CmRegActive = FALSE;
}
UninitInjectProtect();
UninitImageProtect();
if (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0) {
KeResetEvent(&g_LogDrainEvent);
while (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0)
while (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) != 0)
KeWaitForSingleObject(&g_LogDrainEvent, Executive, KernelMode, FALSE, NULL);
}
for (ULONG i = 0; i < g_MbrFilterCount; ++i) {
@@ -175,15 +209,28 @@ VOID DriverUnload(PDRIVER_OBJECT DriverObject)
}
}
g_MbrFilterCount = 0;
IoDeleteSymbolicLink(&g_SymLink);
g_SymLinkCreated = FALSE;
if (g_ControlDeviceObject) {
IoDeleteDevice(g_ControlDeviceObject);
g_ControlDeviceObject = NULL;
for (;;) {
if (InterlockedCompareExchange(&g_LogWorkCount, 0, 0) == 0 && g_MbrFilterCount == 0 && g_ControlDeviceObject == NULL && DiskDrvObj == NULL)
break;
LARGE_INTEGER d = { 0 };
d.QuadPart = -10LL * 1000LL * 50LL;
KeDelayExecutionThread(KernelMode, FALSE, &d);
if (DiskDrvObj == NULL && g_ControlDeviceObject != NULL) {
IoDeleteDevice(g_ControlDeviceObject);
g_ControlDeviceObject = NULL;
}
if (DiskDrvObj) {
ObDereferenceObject(DiskDrvObj);
DiskDrvObj = NULL;
}
}
if (DiskDrvObj) {
ObDereferenceObject(DiskDrvObj);
DiskDrvObj = NULL;
{
LARGE_INTEGER sd = { 0 };
sd.QuadPart = -10LL * 1000LL * 300LL;
KeDelayExecutionThread(KernelMode, FALSE, &sd);
}
if (g_GuardDevice) {
IoDeleteDevice(g_GuardDevice);
g_GuardDevice = NULL;
}
}
Plugins/Filter/DriverEntry.h
+65
View File
@@ -6,6 +6,9 @@
#define PIPE_NAME L"\\??\\pipe\\PYAS_Output_Pipe"
#define MAX_MBR_TARGETS 52
#ifndef POOL_FLAG_NON_PAGED
#define POOL_FLAG_NON_PAGED 0x00000001
#endif
#ifndef PROCESS_CREATE_THREAD
#define PROCESS_CREATE_THREAD 0x0002
#endif
@@ -33,6 +36,9 @@
#ifndef PROCESS_SUSPEND_RESUME
#define PROCESS_SUSPEND_RESUME 0x0800
#endif
#ifndef PROCESS_QUERY_LIMITED_INFORMATION
#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000
#endif
#ifndef PROCESS_SET_LIMITED_INFORMATION
#define PROCESS_SET_LIMITED_INFORMATION 0x2000
#endif
@@ -57,12 +63,71 @@ extern POBJECT_TYPE* IoDriverObjectType;
extern FAST_MUTEX HookMutex;
extern PDRIVER_OBJECT DiskDrvObj;
extern PCSTR PsGetProcessImageFileName(PEPROCESS Process);
extern EX_RUNDOWN_REF g_Rundown;
extern PDEVICE_OBJECT g_GuardDevice;
typedef PVOID(NTAPI* _pyas_ExAllocatePool2)(ULONG, SIZE_T, ULONG);
typedef VOID(NTAPI* _pyas_ExFreePool2)(PVOID, ULONG, PVOID, ULONG);
typedef PVOID(NTAPI* _pyas_ExAllocatePoolWithTag)(POOL_TYPE, SIZE_T, ULONG);
typedef VOID(NTAPI* _pyas_ExFreePoolWithTag)(PVOID, ULONG);
static __forceinline PVOID PYAS_ExAllocatePool2(ULONG f, SIZE_T s, ULONG t) {
static _pyas_ExAllocatePool2 p2 = 0;
if (!p2) {
UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExAllocatePool2");
p2 = (_pyas_ExAllocatePool2)MmGetSystemRoutineAddress(&n);
}
if (p2)
return p2(f, s, t);
static _pyas_ExAllocatePoolWithTag p1 = 0;
if (!p1) {
UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExAllocatePoolWithTag");
p1 = (_pyas_ExAllocatePoolWithTag)MmGetSystemRoutineAddress(&n);
}
if (p1)
return p1((f & POOL_FLAG_NON_PAGED) ? NonPagedPoolNx : PagedPool, s, t);
return NULL;
}
static __forceinline VOID PYAS_ExFreePool2(PVOID a, ULONG t, PVOID h, ULONG f) {
UNREFERENCED_PARAMETER(h);
UNREFERENCED_PARAMETER(f);
static _pyas_ExFreePool2 p2 = 0;
if (!p2) {
UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExFreePool2");
p2 = (_pyas_ExFreePool2)MmGetSystemRoutineAddress(&n);
}
if (p2) {
p2(a, t, h, f);
return;
}
static _pyas_ExFreePoolWithTag p1 = 0;
if (!p1) {
UNICODE_STRING n = RTL_CONSTANT_STRING(L"ExFreePoolWithTag");
p1 = (_pyas_ExFreePoolWithTag)MmGetSystemRoutineAddress(&n);
}
if (p1) {
p1(a, t);
return;
}
}
#define ExAllocatePool2 PYAS_ExAllocatePool2
#define ExFreePool2 PYAS_ExFreePool2
VOID DriverUnload(PDRIVER_OBJECT DriverObject);
VOID SendPipeLog(PCSTR msg, SIZE_T len);
VOID UninitImageProtect(VOID);
VOID UninitInjectProtect(VOID);
NTSYSAPI NTSTATUS NTAPI ZwQueryInformationProcess(
_In_ HANDLE ProcessHandle,
_In_ PROCESSINFOCLASS ProcessInformationClass,
_Out_writes_bytes_opt_(ProcessInformationLength) PVOID ProcessInformation,
_In_ ULONG ProcessInformationLength,
_Out_opt_ PULONG ReturnLength
);
NTSTATUS ObReferenceObjectByName(
IN PUNICODE_STRING ObjectName,
IN ULONG Attributes,
Plugins/Filter/DriverPipe.c
+5 -6
View File
@@ -26,8 +26,8 @@ static VOID PipeLogWork(PDEVICE_OBJECT DeviceObject, PVOID Context)
ZwClose(h);
}
IoFreeWorkItem(ctx->Item);
ExFreePool(ctx->Buf);
ExFreePool(ctx);
ExFreePool2(ctx->Buf, 'golP', NULL, 0);
ExFreePool2(ctx, 'golP', NULL, 0);
if (InterlockedDecrement(&g_LogWorkCount) == 0 && g_Unloading)
KeSetEvent(&g_LogDrainEvent, IO_NO_INCREMENT, FALSE);
}
@@ -48,15 +48,14 @@ VOID SendPipeLog(PCSTR msg, SIZE_T len)
ctx->Len = len;
ctx->Buf = (PCHAR)ExAllocatePool2(POOL_FLAG_NON_PAGED, ctx->Len, 'golP');
if (!ctx->Buf) {
ExFreePool(ctx);
ExFreePool2(ctx, 'golP', NULL, 0);
return;
}
RtlCopyMemory(ctx->Buf, msg, ctx->Len);
ctx->Item = IoAllocateWorkItem(g_ControlDeviceObject);
if (!ctx->Item) {
ExFreePool(ctx->Buf);
ExFreePool(ctx);
ExFreePool2(ctx->Buf, 'golP', NULL, 0);
ExFreePool2(ctx, 'golP', NULL, 0);
return;
}
InterlockedIncrement(&g_LogWorkCount);
Plugins/Filter/ProtectBoot.c
+30 -20
View File
@@ -14,40 +14,49 @@ NTSTATUS FileProtectDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
IoCompleteRequest(Irp, IO_NO_INCREMENT);
return STATUS_INVALID_DEVICE_REQUEST;
}
if (g_Unloading) {
if (!ExAcquireRundownProtection(&g_Rundown)) {
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(lower, Irp);
}
if (g_Unloading) {
IoSkipCurrentIrpStackLocation(Irp);
NTSTATUS st = IoCallDriver(lower, Irp);
ExReleaseRundownProtection(&g_Rundown);
return st;
}
PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
if (stack->MajorFunction == IRP_MJ_POWER) {
PoStartNextPowerIrp(Irp);
IoSkipCurrentIrpStackLocation(Irp);
return PoCallDriver(lower, Irp);
NTSTATUS st = PoCallDriver(lower, Irp);
ExReleaseRundownProtection(&g_Rundown);
return st;
}
HANDLE pid = PsGetCurrentProcessId();
ULONG currentPid = (ULONG)(ULONG_PTR)pid;
if (currentPid == 0 || currentPid == 4) {
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(lower, Irp);
NTSTATUS st = IoCallDriver(lower, Irp);
ExReleaseRundownProtection(&g_Rundown);
return st;
}
BOOLEAN blocked = FALSE, is_white = FALSE;
CHAR logbuf[1024] = { 0 };
WCHAR exeBuf[512] = { 0 };
UNICODE_STRING exeName = { 0 };
exeName.Buffer = exeBuf;
exeName.MaximumLength = sizeof(exeBuf);
exeName.Length = 0;
if (KeGetCurrentIrql() == PASSIVE_LEVEL) {
if (GetProcessImagePathByPid(pid, &exeName))
if (GetProcessImagePathByPid(pid, &exeName))
is_white = IsWhitelist(&exeName);
else {
PEPROCESS eproc = PsGetCurrentProcess();
PCSTR n = PsGetProcessImageFileName(eproc);
size_t l = n ? strlen(n) : 0;
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(exeBuf) - 1; i++)
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(exeBuf) - 1; i++)
exeBuf[i] = (WCHAR)n[i];
exeBuf[l] = 0;
exeName.Length = (USHORT)(l * sizeof(WCHAR));
@@ -65,8 +74,7 @@ NTSTATUS FileProtectDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
}
}
if (isDisk) {
if (mj == IRP_MJ_WRITE || mj == IRP_MJ_SET_INFORMATION || mj == IRP_MJ_DEVICE_CONTROL || mj == IRP_MJ_INTERNAL_DEVICE_CONTROL)
blocked = TRUE;
if (mj == IRP_MJ_WRITE || mj == IRP_MJ_SET_INFORMATION || mj == IRP_MJ_DEVICE_CONTROL || mj == IRP_MJ_INTERNAL_DEVICE_CONTROL) blocked = TRUE;
}
}
if (blocked) {
@@ -74,40 +82,42 @@ NTSTATUS FileProtectDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp)
CHAR target[64] = "None";
ULONG ret = 0;
POBJECT_NAME_INFORMATION oni = (POBJECT_NAME_INFORMATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, 1024, 'nOmD');
if (oni && NT_SUCCESS(ObQueryNameString(lower, oni, 1024, &ret)) && oni->Name.Buffer && oni->Name.Length >= sizeof(WCHAR) * 2) {
USHORT len = oni->Name.Length / sizeof(WCHAR);
ULONG dr = 0;
BOOLEAN hasDr = FALSE;
for (USHORT i = 0; i + 2 < len; i++) {
if (oni->Name.Buffer[i] == L'D' && oni->Name.Buffer[i + 1] == L'R') {
USHORT j = i + 2;
ULONG x = 0;
while (j < len && oni->Name.Buffer[j] >= L'0' && oni->Name.Buffer[j] <= L'9') {
x = x * 10 + (oni->Name.Buffer[j] - L'0');
j++;
x = x * 10 + (oni->Name.Buffer[j] - L'0');
j++;
}
dr = x;
hasDr = TRUE;
break;
}
}
if (hasDr)
if (hasDr)
RtlStringCchPrintfA(target, sizeof(target), "Disk\\Device\\DR%u", dr);
}
if (oni)
ExFreePool(oni);
if (oni)
ExFreePool2(oni, 'nOmD', NULL, 0);
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "BOOT_BLOCK | %u | %wZ | %s", currentPid, &exeName, target);
SendPipeLog(logbuf, strlen(logbuf));
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
}
Irp->IoStatus.Status = STATUS_ACCESS_DENIED;
Irp->IoStatus.Information = 0;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
ExReleaseRundownProtection(&g_Rundown);
return STATUS_ACCESS_DENIED;
}
IoSkipCurrentIrpStackLocation(Irp);
return IoCallDriver(lower, Irp);
NTSTATUS st = IoCallDriver(lower, Irp);
ExReleaseRundownProtection(&g_Rundown);
return st;
}
Plugins/Filter/ProtectImage.c
+21 -13
View File
@@ -91,48 +91,56 @@ static VOID ImageLoadNotify(IN PUNICODE_STRING FullImageName, IN HANDLE ProcessI
return;
if (ProcessId == (HANDLE)0 || ProcessId == (HANDLE)4)
return;
if (KeGetCurrentIrql() != PASSIVE_LEVEL)
if (KeGetCurrentIrql() != PASSIVE_LEVEL)
return;
if (!ExAcquireRundownProtection(&g_Rundown))
return;
WCHAR exeBuf[512] = { 0 };
UNICODE_STRING exeName = { 0 };
exeName.Buffer = exeBuf;
exeName.MaximumLength = sizeof(exeBuf);
exeName.Length = 0;
if (!GetProcessImagePathByPid(ProcessId, &exeName)) {
PEPROCESS eproc = PsGetCurrentProcess();
PCSTR n = PsGetProcessImageFileName(eproc);
size_t l = n ? strlen(n) : 0;
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(exeBuf) - 1; i++)
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(exeBuf) - 1; i++)
exeBuf[i] = (WCHAR)n[i];
exeBuf[l] = 0;
exeName.Length = (USHORT)(l * sizeof(WCHAR));
}
if (exeName.Length & 1) exeName.Length--;
{
if (exeName.Length & 1)
exeName.Length--;
size_t elen = exeName.Length / sizeof(WCHAR);
if ((elen >= 14 && _wcsnicmp(exeName.Buffer + elen - 14, L"powershell.exe", 14) == 0) ||
(elen >= 8 && _wcsnicmp(exeName.Buffer + elen - 8, L"pwsh.exe", 8) == 0))
return;
(elen >= 8 && _wcsnicmp(exeName.Buffer + elen - 8, L"pwsh.exe", 8) == 0)) {
ExReleaseRundownProtection(&g_Rundown);
return;
}
}
if (IsWhitelist(&exeName)) {
ExReleaseRundownProtection(&g_Rundown);
return;
}
if (IsWhitelist(&exeName))
return;
CHAR logbuf[1024] = { 0 };
if (FullImageName && FullImageName->Buffer) {
if ((StrStrI(FullImageName->Buffer, L"clr.dll") || StrStrI(FullImageName->Buffer, L"mscorwks.dll")) && !IsFrameworkClrPath(FullImageName->Buffer)) {
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "CLR_BLOCK | %u | %wZ | %wZ", (ULONG)(ULONG_PTR)ProcessId, &exeName, FullImageName);
SendPipeLog(logbuf, strlen(logbuf));
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
ExReleaseRundownProtection(&g_Rundown);
return;
}
}
if (CheckShellcodeWalkStack(8)) {
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "SHELLCODE_BLOCK | %u | %wZ | None", (ULONG)(ULONG_PTR)ProcessId, &exeName);
SendPipeLog(logbuf, strlen(logbuf));
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
ExReleaseRundownProtection(&g_Rundown);
return;
}
ExReleaseRundownProtection(&g_Rundown);
}
NTSTATUS InitImageProtect(VOID) {
Plugins/Filter/ProtectInject.c
+67 -52
View File
@@ -11,53 +11,58 @@ static OB_PREOP_CALLBACK_STATUS PreProcessCallback(PVOID RegistrationContext, PO
UNREFERENCED_PARAMETER(RegistrationContext);
if (g_Unloading)
return OB_PREOP_SUCCESS;
if (!Info || Info->KernelHandle)
if (!Info || Info->KernelHandle)
return OB_PREOP_SUCCESS;
if (!Info->Object)
return OB_PREOP_SUCCESS;
if (Info->Operation != OB_OPERATION_HANDLE_CREATE && Info->Operation != OB_OPERATION_HANDLE_DUPLICATE)
return OB_PREOP_SUCCESS;
if (!ExAcquireRundownProtection(&g_Rundown))
return OB_PREOP_SUCCESS;
HANDLE cur = PsGetCurrentProcessId();
if (cur == (HANDLE)0 || cur == (HANDLE)4)
return OB_PREOP_SUCCESS;
if (cur == (HANDLE)0 || cur == (HANDLE)4) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
HANDLE target = PsGetProcessId((PEPROCESS)Info->Object);
if (target == cur)
if (target == cur) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
ACCESS_MASK* desired = (Info->Operation == OB_OPERATION_HANDLE_CREATE) ? &Info->Parameters->CreateHandleInformation.DesiredAccess : &Info->Parameters->DuplicateHandleInformation.DesiredAccess;
ACCESS_MASK mask = PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE;
PCSTR tn = PsGetProcessImageFileName((PEPROCESS)Info->Object);
if (tn && (_stricmp(tn, "lsass.exe") == 0))
mask |= PROCESS_VM_READ;
if ((*desired & mask) == 0)
if ((*desired & mask) == 0) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
BOOLEAN logok = (KeGetCurrentIrql() == PASSIVE_LEVEL);
WCHAR cbuf[512] = { 0 }, tbuf[512] = { 0 };
UNICODE_STRING cexe = { 0 }, texe = { 0 };
cexe.Buffer = cbuf;
cexe.MaximumLength = sizeof(cbuf);
texe.Buffer = tbuf;
texe.MaximumLength = sizeof(tbuf);
if (logok)
cexe.Buffer = cbuf; cexe.MaximumLength = sizeof(cbuf);
texe.Buffer = tbuf; texe.MaximumLength = sizeof(tbuf);
if (logok)
GetProcessImagePathByPid(cur, &cexe);
if (logok && IsWhitelist(&cexe))
return OB_PREOP_SUCCESS;
if (logok && IsWhitelist(&cexe)) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
ACCESS_MASK old = *desired;
*desired &= ~mask;
if ((*desired) != old && logok) {
GetProcessImagePathByPid(target, &texe);
if (cexe.Length == 0) {
PEPROCESS eproc = PsGetCurrentProcess();
PCSTR n = PsGetProcessImageFileName(eproc);
size_t l = n ? strlen(n) : 0;
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(cbuf) - 1; i++)
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(cbuf) - 1; i++)
cbuf[i] = (WCHAR)n[i];
cbuf[l] = 0;
cexe.Length = (USHORT)(l * sizeof(WCHAR));
@@ -65,57 +70,61 @@ static OB_PREOP_CALLBACK_STATUS PreProcessCallback(PVOID RegistrationContext, PO
CHAR logbuf[1024] = { 0 };
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "INJECT_BLOCK | %u | %wZ | %wZ", (ULONG)(ULONG_PTR)cur, &cexe, &texe);
SendPipeLog(logbuf, strlen(logbuf));
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
}
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
static OB_PREOP_CALLBACK_STATUS PreThreadCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info) {
static OB_PREOP_CALLBACK_STATUS PreThreadCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION Info)
{
UNREFERENCED_PARAMETER(RegistrationContext);
if (!Info || Info->KernelHandle)
if (!Info || Info->KernelHandle)
return OB_PREOP_SUCCESS;
if (Info->Object == NULL)
if (Info->Object == NULL)
return OB_PREOP_SUCCESS;
if (Info->Operation != OB_OPERATION_HANDLE_CREATE && Info->Operation != OB_OPERATION_HANDLE_DUPLICATE)
return OB_PREOP_SUCCESS;
if (!ExAcquireRundownProtection(&g_Rundown))
return OB_PREOP_SUCCESS;
HANDLE cur = PsGetCurrentProcessId();
if (cur == (HANDLE)0 || cur == (HANDLE)4)
return OB_PREOP_SUCCESS;
if (cur == (HANDLE)0 || cur == (HANDLE)4) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
HANDLE owner = PsGetThreadProcessId((PETHREAD)Info->Object);
if (owner == cur)
return OB_PREOP_SUCCESS;
if (owner == cur) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
ACCESS_MASK tmask = THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME | THREAD_IMPERSONATE | THREAD_DIRECT_IMPERSONATION;
ACCESS_MASK* desired = (Info->Operation == OB_OPERATION_HANDLE_CREATE) ? &Info->Parameters->CreateHandleInformation.DesiredAccess : &Info->Parameters->DuplicateHandleInformation.DesiredAccess;
if ((*desired & tmask) == 0)
if ((*desired & tmask) == 0) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
BOOLEAN logok = (KeGetCurrentIrql() == PASSIVE_LEVEL);
WCHAR cbuf[512] = { 0 };
UNICODE_STRING cexe = { 0 };
cexe.Buffer = cbuf;
cexe.MaximumLength = sizeof(cbuf);
if (logok)
if (logok)
GetProcessImagePathByPid(cur, &cexe);
if (logok) {
if (IsWhitelist(&cexe))
return OB_PREOP_SUCCESS;
if (logok && IsWhitelist(&cexe)) {
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
ACCESS_MASK old = *desired;
*desired &= ~tmask;
if ((*desired) != old && logok) {
CHAR logbuf[1024] = { 0 };
if (cexe.Length == 0) {
PEPROCESS eproc = PsGetCurrentProcess();
PCSTR n = PsGetProcessImageFileName(eproc);
size_t l = n ? strlen(n) : 0;
for (size_t i = 0; i < l && i < RTL_NUMBER_OF(cbuf) - 1; i++)
cbuf[i] = (WCHAR)n[i];
cbuf[l] = 0;
@@ -123,14 +132,19 @@ static OB_PREOP_CALLBACK_STATUS PreThreadCallback(PVOID RegistrationContext, POB
}
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "THREAD_BLOCK | %u | %wZ | %u", (ULONG)(ULONG_PTR)cur, &cexe, (ULONG)(ULONG_PTR)owner);
SendPipeLog(logbuf, strlen(logbuf));
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
}
ExReleaseRundownProtection(&g_Rundown);
return OB_PREOP_SUCCESS;
}
NTSTATUS InitInjectProtect(VOID) {
UNICODE_STRING alt;
RtlInitUnicodeString(&alt, L"385000");
NTSTATUS InitInjectProtect(VOID)
{
static WCHAR obAltBuf[32];
static UNICODE_STRING obAlt;
LARGE_INTEGER t = KeQueryPerformanceCounter(NULL);
RtlStringCchPrintfW(obAltBuf, RTL_NUMBER_OF(obAltBuf), L"385000.%I64x", t.QuadPart);
RtlInitUnicodeString(&obAlt, obAltBuf);
g_ObOps = (POB_OPERATION_REGISTRATION)ExAllocatePool2(POOL_FLAG_NON_PAGED, sizeof(OB_OPERATION_REGISTRATION) * 2, 'bOpr');
if (!g_ObOps)
return STATUS_INSUFFICIENT_RESOURCES;
@@ -146,26 +160,27 @@ NTSTATUS InitInjectProtect(VOID) {
RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
g_ObReg.Version = OB_FLT_REGISTRATION_VERSION;
g_ObReg.OperationRegistrationCount = 2;
g_ObReg.Altitude = alt;
g_ObReg.Altitude = obAlt;
g_ObReg.RegistrationContext = NULL;
g_ObReg.OperationRegistration = g_ObOps;
NTSTATUS s = ObRegisterCallbacks(&g_ObReg, &g_ObRegHandle);
if (!NT_SUCCESS(s)) {
ExFreePool(g_ObOps);
ExFreePool2(g_ObOps, 'bOpr', NULL, 0);
g_ObOps = NULL;
RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
}
return s;
}
VOID UninitInjectProtect(VOID) {
VOID UninitInjectProtect(VOID)
{
if (g_ObRegHandle) {
ObUnRegisterCallbacks(g_ObRegHandle);
g_ObRegHandle = NULL;
}
if (g_ObOps) {
ExFreePool(g_ObOps);
if (g_ObOps) {
ExFreePool2(g_ObOps, 'bOpr', NULL, 0);
g_ObOps = NULL;
}
RtlZeroMemory(&g_ObReg, sizeof(g_ObReg));
Plugins/Filter/ProtectReg.c
+20 -17
View File
@@ -15,7 +15,7 @@ static BOOLEAN QueryRegPathFromObject(PVOID KeyObject, PUNICODE_STRING OutPath,
s = ObQueryNameString(KeyObject, p, len, &len);
if (!NT_SUCCESS(s) || !p->Name.Buffer || p->Name.Length == 0) {
ExFreePool(p);
ExFreePool2(p, 'rgeR', NULL, 0);
return FALSE;
}
*OutInfo = p;
@@ -28,33 +28,36 @@ static BOOLEAN QueryRegPathFromObject(PVOID KeyObject, PUNICODE_STRING OutPath,
NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
{
UNREFERENCED_PARAMETER(ctx);
if (g_Unloading)
if (g_Unloading)
return STATUS_SUCCESS;
if (!ExAcquireRundownProtection(&g_Rundown))
return STATUS_SUCCESS;
REG_NOTIFY_CLASS type = (REG_NOTIFY_CLASS)(ULONG_PTR)arg1;
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING checkReg = { 0 };
POBJECT_NAME_INFORMATION nameInfo = NULL;
UNICODE_STRING exe = { 0 };
WCHAR exeBuf[260] = { 0 };
exe.Buffer = exeBuf;
exe.MaximumLength = sizeof(exeBuf);
exe.Length = 0;
HANDLE pid = PsGetCurrentProcessId();
if (pid == (HANDLE)0 || pid == (HANDLE)4)
return STATUS_SUCCESS;
if (pid == (HANDLE)0 || pid == (HANDLE)4) {
ExReleaseRundownProtection(&g_Rundown);
return STATUS_SUCCESS;
}
PUNICODE_STRING valueName = NULL;
BOOLEAN need_log = FALSE;
CHAR logbuf[1024] = { 0 };
BOOLEAN canQuery = (KeGetCurrentIrql() == PASSIVE_LEVEL);
if (type == RegNtPreSetValueKey) {
PREG_SET_VALUE_KEY_INFORMATION s = (PREG_SET_VALUE_KEY_INFORMATION)arg2;
valueName = s->ValueName;
if (canQuery)
if (canQuery)
QueryRegPathFromObject(s->Object, &checkReg, &nameInfo);
}
else if (type == RegNtPreDeleteValueKey) {
@@ -65,7 +68,7 @@ NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
}
else if (type == RegNtPreDeleteKey) {
PREG_DELETE_KEY_INFORMATION d = (PREG_DELETE_KEY_INFORMATION)arg2;
if (canQuery)
if (canQuery)
QueryRegPathFromObject(d->Object, &checkReg, &nameInfo);
}
else if (type == RegNtPreRenameKey) {
@@ -75,12 +78,12 @@ NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
}
else if (type == RegNtPreCreateKeyEx) {
PREG_CREATE_KEY_INFORMATION c = (PREG_CREATE_KEY_INFORMATION)arg2;
if (c->CompleteName)
if (c->CompleteName)
checkReg = *c->CompleteName;
}
else if (type == RegNtPreReplaceKey) {
PREG_REPLACE_KEY_INFORMATION rk = (PREG_REPLACE_KEY_INFORMATION)arg2;
if (canQuery)
if (canQuery)
QueryRegPathFromObject(rk->Object, &checkReg, &nameInfo);
}
else if (type == RegNtPreSaveKey) {
@@ -90,7 +93,7 @@ NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
}
else if (type == RegNtPreRestoreKey) {
PREG_RESTORE_KEY_INFORMATION res = (PREG_RESTORE_KEY_INFORMATION)arg2;
if (canQuery)
if (canQuery)
QueryRegPathFromObject(res->Object, &checkReg, &nameInfo);
}
else if (type == RegNtPreLoadKey) {
@@ -100,17 +103,17 @@ NTSTATUS RegistryProtectCallback(PVOID ctx, PVOID arg1, PVOID arg2)
}
if (checkReg.Buffer || (valueName && valueName->Buffer)) {
GetProcessImagePathByPid(pid, &exe);
if (IsRegistryBlock(&checkReg, valueName, &exe)) {
RtlStringCchPrintfA(logbuf, sizeof(logbuf), "REG_BLOCK | %u | %wZ | %wZ", (ULONG)(ULONG_PTR)pid, &exe, &checkReg);
need_log = TRUE;
status = STATUS_ACCESS_DENIED;
if (canQuery)
ZwTerminateProcess(NtCurrentProcess(), STATUS_ACCESS_DENIED);
}
}
if (nameInfo)
ExFreePool(nameInfo);
ExFreePool2(nameInfo, 'rgeR', NULL, 0);
if (need_log)
SendPipeLog(logbuf, strlen(logbuf));
ExReleaseRundownProtection(&g_Rundown);
return status;
}
Plugins/Filter/ProtectRules.c
+62 -30
View File
@@ -260,17 +260,49 @@ static wchar_t* MatchListGetRule(PUNICODE_STRING s, wchar_t** list)
return 0;
}
static __forceinline BOOLEAN USOK(PUNICODE_STRING s)
{
return s && s->Buffer && s->Length;
}
BOOLEAN IsRegistryBlock(PUNICODE_STRING key, PUNICODE_STRING valueName, PUNICODE_STRING exe)
{
if (exe && exe->Buffer && exe->Length) {
if (USOK(exe)) {
if (IsWhitelist(exe))
return FALSE;
}
if (key && key->Buffer && key->Length) {
if (USOK(exe) && USOK(key)) {
size_t elen = exe->Length / sizeof(WCHAR);
size_t klen = key->Length / sizeof(WCHAR);
if (((elen >= 12 && _wcsnicmp(exe->Buffer + elen - 12, L"services.exe", 12) == 0) ||
(elen >= 11 && _wcsnicmp(exe->Buffer + elen - 11, L"svchost.exe", 11) == 0) ||
(elen >= 6 && _wcsnicmp(exe->Buffer + elen - 6, L"sc.exe", 6) == 0))) {
if (WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\SYSTEM\\CurrentControlSet\\Services\\**"))
return FALSE;
}
if ((elen >= 14 && _wcsnicmp(exe->Buffer + elen - 14, L"powershell.exe", 14) == 0) ||
(elen >= 8 && _wcsnicmp(exe->Buffer + elen - 8, L"pwsh.exe", 8) == 0)) {
if (WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\CurrentVersion\\Internet Settings\\ZoneMap") ||
WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\CurrentVersion\\Internet Settings\\ZoneMap\\**"))
return FALSE;
}
if ((elen >= 11 && _wcsnicmp(exe->Buffer + elen - 11, L"msiexec.exe", 11) == 0) ||
(elen >= 20 && _wcsnicmp(exe->Buffer + elen - 20, L"TrustedInstaller.exe", 20) == 0)) {
if (WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\CurrentVersion\\Installer\\**") ||
WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\CurrentVersion\\Uninstall\\**") ||
WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\SYSTEM\\CurrentControlSet\\Services\\**"))
return FALSE;
}
if (elen >= 12 && _wcsnicmp(exe->Buffer + elen - 12, L"schtasks.exe", 12) == 0) {
if (WildMatchN(key->Buffer, klen, L"\\REGISTRY\\**\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\**"))
return FALSE;
}
}
if (USOK(key)) {
if (MatchBlockReg(key))
return TRUE;
}
if (valueName && valueName->Buffer && valueName->Length) {
if (USOK(valueName)) {
SIZE_T n = valueName->Length / sizeof(WCHAR);
for (SIZE_T i = 0; g_BlockReg[i]; ++i) {
wchar_t* pat = g_BlockReg[i];
@@ -291,40 +323,40 @@ BOOLEAN GetProcessImagePathByPid(HANDLE pid, PUNICODE_STRING ProcessImagePath)
if (!NT_SUCCESS(status))
return FALSE;
#if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
UNICODE_STRING* image = NULL;
status = SeLocateProcessImageName(process, &image);
if (NT_SUCCESS(status) && image) {
if (ProcessImagePath->MaximumLength >= image->Length + sizeof(WCHAR)) {
HANDLE h = NULL;
status = ObOpenObjectByPointer(process, OBJ_KERNEL_HANDLE, NULL, PROCESS_QUERY_LIMITED_INFORMATION, *PsProcessType, KernelMode, &h);
if (!NT_SUCCESS(status)) {
ObDereferenceObject(process);
return FALSE;
}
ULONG len = 0;
status = ZwQueryInformationProcess(h, ProcessImageFileName, NULL, 0, &len);
if (status != STATUS_INFO_LENGTH_MISMATCH || len == 0) {
ZwClose(h);
ObDereferenceObject(process);
return FALSE;
}
PVOID buf = ExAllocatePool2(POOL_FLAG_NON_PAGED, len, 'iPgN');
if (!buf) {
ZwClose(h);
ObDereferenceObject(process);
return FALSE;
}
status = ZwQueryInformationProcess(h, ProcessImageFileName, buf, len, &len);
if (NT_SUCCESS(status)) {
PUNICODE_STRING image = (PUNICODE_STRING)buf;
if (image->Buffer && image->Length > 0 && ProcessImagePath->MaximumLength >= image->Length + sizeof(WCHAR)) {
RtlCopyMemory(ProcessImagePath->Buffer, image->Buffer, image->Length);
ProcessImagePath->Length = image->Length;
ProcessImagePath->Buffer[image->Length / sizeof(WCHAR)] = 0;
ExFreePool(image);
ExFreePool2(buf, 'iPgN', NULL, 0);
ZwClose(h);
ObDereferenceObject(process);
return TRUE;
}
ExFreePool(image);
}
#endif
{
PCSTR nameA = PsGetProcessImageFileName(process);
if (nameA) {
ANSI_STRING as;
UNICODE_STRING us = { 0 };
RtlInitAnsiString(&as, nameA);
if (NT_SUCCESS(RtlAnsiStringToUnicodeString(&us, &as, TRUE)) && ProcessImagePath->MaximumLength >= us.Length + sizeof(WCHAR)) {
RtlCopyMemory(ProcessImagePath->Buffer, us.Buffer, us.Length);
ProcessImagePath->Length = us.Length;
ProcessImagePath->Buffer[us.Length / sizeof(WCHAR)] = 0;
RtlFreeUnicodeString(&us);
ObDereferenceObject(process);
return TRUE;
}
RtlFreeUnicodeString(&us);
}
}
ExFreePool2(buf, 'iPgN', NULL, 0);
ZwClose(h);
ObDereferenceObject(process);
return FALSE;
}