【】编写驱动拦截NT的API实现隐藏文件目录

朴灿烈づ我的快乐病毒、 2022-08-24 00:44 113阅读 0赞

目前NT下有很多种隐藏文件和目录的方法，其中最简单的一种是给文件和文件夹加上系统属性和隐藏属性，操作系统就会不在显示了，而且查找也找不到了，但是这种方法一点都不彻底，没有可用性！下面我们来介绍用NT驱动 [程序][Link 1]来拦截NTAPI来实现彻底隐藏文件和目录的目的。NT下有一个文件NTDLL.DLL，大部分NTAPI都是在这个库中封装的。其中实现查找文件和目录的API接口是ZwQueryDirectoryFile，所以我们只要拦截这个API的话，文件和目录就可以完全隐藏了！下面来一步不实现（准备工作：到NTDDK中找一个WDM驱动 [程序][Link 1]模型，也就是最简单的驱动 [程序][Link 1]了）：  
  
1.定义FILE\_INFORMATION\_CLASS的第3号结构：\_FILE\_BOTH\_DIR\_INFORMATION，这个结构是ZwQueryDirectoryFile必须参数。  
  
typedef struct \_FILE\_BOTH\_DIR\_INFORMATION \{  
ULONG NextEntryOffset;  
ULONG FileIndex;  
LARGE\_INTEGER CreationTime;  
LARGE\_INTEGER LastAccessTime;  
LARGE\_INTEGER LastWriteTime;  
LARGE\_INTEGER ChangeTime;  
LARGE\_INTEGER EndOfFile;  
LARGE\_INTEGER AllocationSize;  
ULONG FileAttributes;  
ULONG FileNameLength;  
ULONG EaSize;  
CCHAR ShortNameLength;  
WCHAR ShortName\[12\];  
WCHAR FileName\[1\];  
\} FILE\_BOTH\_DIR\_INFORMATION, \*PFILE\_BOTH\_DIR\_INFORMATION;  
  
  
  
2.先申明ZwQueryDirectoryFile，然后定义ZwQueryDirectoryFile的原型：  
  
extern NTSYSAPI NTSTATUS NTAPI ZwQueryDirectoryFile(  
IN HANDLE hFile,  
IN HANDLE hEvent OPTIONAL,  
IN PIO\_APC\_ROUTINE IoApcRoutine OPTIONAL,  
IN PVOID IoApcContext OPTIONAL,  
OUT PIO\_STATUS\_BLOCK pIoStatusBlock,  
OUT PVOID FileInformationBuffer,  
IN ULONG FileInformationBufferLength,  
IN FILE\_INFORMATION\_CLASS FileInfoClass,  
IN BOOLEAN bReturnOnlyOneEntry,  
IN PUNICODE\_STRING PathMask OPTIONAL,  
IN BOOLEAN bRestartQuery);  
  
//定义ZwQueryDirectoryFile的原型  
  
typedef NTSTATUS (\*REALZWQUERYDIRECTORYFILE)(IN HANDLE hFile,  
IN HANDLE hEvent OPTIONAL,  
IN PIO\_APC\_ROUTINE IoApcRoutine OPTIONAL,  
IN PVOID IoApcContext OPTIONAL,  
OUT PIO\_STATUS\_BLOCK pIoStatusBlock,  
OUT PVOID FileInformationBuffer,  
IN ULONG FileInformationBufferLength,  
IN FILE\_INFORMATION\_CLASS FileInfoClass,  
IN BOOLEAN bReturnOnlyOneEntry,  
IN PUNICODE\_STRING PathMask OPTIONAL,  
IN BOOLEAN bRestartQuery);  
  
//定义一个原函数指针  
REALZWQUERYSYSTEMINFORMATION RealZwQuerySystemInformation;  
  
3.定义替换API函数的原型：  
  
NTSTATUS HookZwQueryDirectoryFile(  
IN HANDLE hFile,  
IN HANDLE hEvent OPTIONAL,  
IN PIO\_APC\_ROUTINE IoApcRoutine OPTIONAL,  
IN PVOID IoApcContext OPTIONAL,  
OUT PIO\_STATUS\_BLOCK pIoStatusBlock,  
OUT PVOID FileInformationBuffer,  
IN ULONG FileInformationBufferLength,  
IN FILE\_INFORMATION\_CLASS FileInfoClass,  
IN BOOLEAN bReturnOnlyOneEntry,  
IN PUNICODE\_STRING PathMask OPTIONAL,  
IN BOOLEAN bRestartQuery);  
  
4.在DriverEntry（驱动入口）函数中加入如下申明：  
  
//保存真正的ZwQueryDirectoryFile函数地址  
  
RealZwQueryDirectoryFile=(REALZWQUERYDIRECTORYFILE)(SYSTEMSERVICE(ZwQueryDirectoryFile));  
  
//把自定义的替换函数指针指向真正的ZwQueryDirectoryFile函数  
  
(REALZWQUERYDIRECTORYFILE)(SYSTEMSERVICE(ZwQueryDirectoryFile))=HookZwQueryDirectoryFile;  
  
5.在DriverUnload（驱动卸载函数）函数中加入恢复代码：  
  
//恢复原来的函数指针  
  
(REALZWQUERYDIRECTORYFILE)(SYSTEMSERVICE(ZwQueryDirectoryFile))=RealZwQueryDirectoryFile;  
  
6.现在准备工作做好了，函数指针都已经设置转向了，剩下的是实现这个我们自定义的替换函数HookZwQueryDirectoryFile，代码如下：  
  
NTSTATUS HookZwQueryDirectoryFile(  
IN HANDLE hFile,  
IN HANDLE hEvent OPTIONAL,  
IN PIO\_APC\_ROUTINE IoApcRoutine OPTIONAL,  
IN PVOID IoApcContext OPTIONAL,  
OUT PIO\_STATUS\_BLOCK pIoStatusBlock,  
OUT PVOID FileInformationBuffer,  
IN ULONG FileInformationBufferLength,  
IN FILE\_INFORMATION\_CLASS FileInfoClass,  
IN BOOLEAN bReturnOnlyOneEntry,  
IN PUNICODE\_STRING PathMask OPTIONAL,  
IN BOOLEAN bRestartQuery)  
\{  
NTSTATUS rc;  
ULONG CR0VALUE;  
  
ANSI\_STRING ansiFileName,ansiDirName,HideDirFile;  
UNICODE\_STRING uniFileName;  
  
//初始化要过虑的文件名这里是debug.exe  
RtlInitAnsiString(&HideDirFile,"DBGVIEW.EXE");  
  
// 执行真正的ZwQueryDirectoryFile函数  
rc = ((REALZWQUERYDIRECTORYFILE)(RealZwQueryDirectoryFile))(  
hFile,  
hEvent,  
IoApcRoutine,  
IoApcContext,  
pIoStatusBlock,  
FileInformationBuffer,  
FileInformationBufferLength,  
FileInfoClass,  
bReturnOnlyOneEntry,  
PathMask,  
bRestartQuery);  
/\*如果执行成功（而且FILE\_INFORMATION\_CLASS的值为FileBothDirectoryInformation，我们就进行处理，过滤\*/  
if(NT\_SUCCESS(rc)&& (FileInfoClass == FileBothDirectoryInformation))  
\{  
PFILE\_BOTH\_DIR\_INFORMATION pFileInfo;  
PFILE\_BOTH\_DIR\_INFORMATION pLastFileInfo;  
BOOL bLastOne;  
//把执行结果赋给pFileInfo  
pFileInfo = (PFILE\_BOTH\_DIR\_INFORMATION)FileInformationBuffer;  
pLastFileInfo = NULL;  
//循环检查  
do  
\{  
bLastOne = !( pFileInfo->NextEntryOffset );  
RtlInitUnicodeString(&uniFileName,pFileInfo->FileName);  
RtlUnicodeStringToAnsiString(&ansiFileName,&uniFileName,TRUE);  
RtlUnicodeStringToAnsiString(&ansiDirName,&uniFileName,TRUE);  
RtlUpperString(&ansiFileName,&ansiDirName);  
//打印结果，用debugview可以查看打印结果  
DbgPrint("ansiFileName :%s/n",ansiFileName.Buffer);  
DbgPrint("HideDirFile :%s/n",HideDirFile.Buffer);  
  
// 开始进行比较，如果找到了就隐藏这个文件或者目录  
if( RtlCompareMemory(ansiFileName.Buffer,HideDirFile.Buffer,HideDirFile.Length ) == HideDirFile.Length)  
\{  
DbgPrint("This is HideDirFile!/n");  
if(bLastOne)  
\{  
if(pFileInfo == (PFILE\_BOTH\_DIR\_INFORMATION)FileInformationBuffer )  
\{  
rc = 0x80000006; //隐藏文件或者目录;  
\}  
else  
\{  
pLastFileInfo->NextEntryOffset = 0;  
\}  
break;  
\}  
else //指针往后移动  
\{  
int iPos = ((ULONG)pFileInfo) - (ULONG)FileInformationBuffer;  
int iLeft = (DWORD)FileInformationBufferLength - iPos - pFileInfo->NextEntryOffset;  
RtlCopyMemory( (PVOID)pFileInfo, (PVOID)( (char \*)pFileInfo + pFileInfo->NextEntryOffset ), (DWORD)iLeft );  
continue;  
\}  
\}  
pLastFileInfo = pFileInfo;  
pFileInfo = (PFILE\_BOTH\_DIR\_INFORMATION)((char \*)pFileInfo + pFileInfo->NextEntryOffset);  
  
\}while(!bLastOne);  
RtlFreeAnsiString(&ansiDirName);  
RtlFreeAnsiString(&ansiFileName);  
\}  
return(rc);  
\}  
  
本代码在开发机器（WINXP+SP1+XPDDK）上测试通过！

[Link 1]: http://www.programbbs.com/doc/