diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..4096055 --- /dev/null +++ b/.clang-format @@ -0,0 +1,101 @@ +AccessModifierOffset: -4 +AlignAfterOpenBracket: AlwaysBreak +AlignConsecutiveAssignments: false +AlignConsecutiveDeclarations: false +AlignEscapedNewlines: DontAlign +AlignOperands: true +AllowAllParametersOfDeclarationOnNextLine: false +AllowShortBlocksOnASingleLine: false +AllowShortCaseLabelsOnASingleLine: false +AllowShortFunctionsOnASingleLine: Inline +AllowShortIfStatementsOnASingleLine: false +AllowShortLoopsOnASingleLine: false +AlwaysBreakAfterReturnType: TopLevel +AlwaysBreakBeforeMultilineStrings: false +AlwaysBreakTemplateDeclarations: true +BinPackArguments: false +BinPackParameters: false +BraceWrapping: + AfterClass: true + AfterControlStatement: true + AfterEnum: true + AfterFunction: true + AfterNamespace: false + AfterStruct: true + AfterUnion: true + AfterExternBlock: false + BeforeCatch: true + BeforeElse: true +BreakBeforeBraces: Custom +BreakBeforeBinaryOperators: None +BreakBeforeTernaryOperators: true +BreakConstructorInitializers: AfterColon +BreakStringLiterals: false +ColumnLimit: 120 +CommentPragmas: '^begin_wpp|^end_wpp|^FUNC |^USESUFFIX |^USESUFFIX ' +ConstructorInitializerAllOnOneLineOrOnePerLine: true +ConstructorInitializerIndentWidth: 4 +ContinuationIndentWidth: 4 +Cpp11BracedListStyle: true +DerivePointerAlignment: false +ExperimentalAutoDetectBinPacking: false +IndentCaseLabels: false +IndentPPDirectives: AfterHash +IndentWidth: 4 +KeepEmptyLinesAtTheStartOfBlocks: false +Language: Cpp +MacroBlockBegin: '^BEGIN_MODULE$|^BEGIN_TEST_CLASS$|^BEGIN_TEST_METHOD$' +MacroBlockEnd: '^END_MODULE$|^END_TEST_CLASS$|^END_TEST_METHOD$' +MaxEmptyLinesToKeep: 1 +NamespaceIndentation: None +PointerAlignment: Right +ReflowComments: true +SortIncludes: false +SpaceAfterCStyleCast: false +SpaceBeforeAssignmentOperators: true +SpaceBeforeCtorInitializerColon: true +SpaceBeforeCtorInitializerColon: true +SpaceBeforeParens: ControlStatements +SpaceBeforeRangeBasedForLoopColon: true +SpaceInEmptyParentheses: false +SpacesInAngles: false +SpacesInCStyleCastParentheses: false +SpacesInParentheses: false +SpacesInSquareBrackets: false +Standard: Cpp11 +StatementMacros: [ + 'EXTERN_C', + 'PAGED', + 'PAGEDX', + 'NONPAGED', + 'PNPCODE', + 'INITCODE', + '_At_', + '_When_', + '_Success_', + '_Check_return_', + '_Must_inspect_result_', + '_IRQL_requires_', + '_IRQL_requires_max_', + '_IRQL_requires_min_', + '_IRQL_saves_', + '_IRQL_restores_', + '_IRQL_saves_global_', + '_IRQL_restores_global_', + '_IRQL_raises_', + '_IRQL_lowers_', + '_Acquires_lock_', + '_Releases_lock_', + '_Acquires_exclusive_lock_', + '_Releases_exclusive_lock_', + '_Acquires_shared_lock_', + '_Releases_shared_lock_', + '_Requires_lock_held_', + '_Use_decl_annotations_', + '_Guarded_by_', + '__drv_preferredFunction', + '__drv_allocatesMem', + '__drv_freesMem', + ] +TabWidth: '4' +UseTab: Never diff --git a/FakeEnclave.sln b/FakeEnclave.sln new file mode 100644 index 0000000..5060687 --- /dev/null +++ b/FakeEnclave.sln @@ -0,0 +1,35 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.2.32519.379 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FakeEnclave", "FakeEnclave.vcxproj", "{FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|ARM64.Build.0 = Debug|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|ARM64.Deploy.0 = Debug|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|x64.ActiveCfg = Debug|x64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|x64.Build.0 = Debug|x64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Debug|x64.Deploy.0 = Debug|x64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|ARM64.ActiveCfg = Release|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|ARM64.Build.0 = Release|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|ARM64.Deploy.0 = Release|ARM64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|x64.ActiveCfg = Release|x64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|x64.Build.0 = Release|x64 + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55}.Release|x64.Deploy.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {8852CAE8-8666-47DE-8C40-AA6BF9B7D73B} + EndGlobalSection +EndGlobal diff --git a/FakeEnclave.vcxproj b/FakeEnclave.vcxproj new file mode 100644 index 0000000..425ac1c --- /dev/null +++ b/FakeEnclave.vcxproj @@ -0,0 +1,134 @@ + + + + + Debug + x64 + + + Release + x64 + + + Debug + ARM64 + + + Release + ARM64 + + + + {FE7F43A7-1F9C-4E4B-8898-4B768B43BF55} + {1bc93793-694f-48fe-9372-81e2b05556fd} + v4.5 + 12.0 + Debug + x64 + FakeEnclave + $(LatestTargetPlatformVersion) + + + + Windows10 + true + LLVM-MSVC_v143_KernelMode + Driver + KMDF + Universal + false + + + Windows10 + false + LLVM-MSVC_v143_KernelMode + Driver + KMDF + Universal + false + + + Windows10 + true + LLVM-MSVC_v143_KernelMode + Driver + KMDF + Universal + + + Windows10 + false + LLVM-MSVC_v143_KernelMode + Driver + KMDF + Universal + + + + + + + + + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + sha256 + + + false + Level3 + false + + + DriverEntry + + + + + sha256 + + + false + Level3 + false + + + DriverEntry + + + + + sha256 + + + + + sha256 + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/FakeEnclave.vcxproj.filters b/FakeEnclave.vcxproj.filters new file mode 100644 index 0000000..0f135ea --- /dev/null +++ b/FakeEnclave.vcxproj.filters @@ -0,0 +1,27 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + \ No newline at end of file diff --git a/README.md b/README.md index d1918c9..00ec5f6 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,11 @@ # FakeEnclave +A poc that abuses Enclave +![image](https://user-images.githubusercontent.com/13917777/189128521-bf4e0691-bed8-41b1-aa7b-bd9ed17e39f7.png) -A poc that abuses Enclave \ No newline at end of file +## What it can do? +- Anti-tamper +- There may be nothing to do + +## Compile +- Visual Studio 2022 & WDK10 +- llvm-msvc [[link]](https://github.com/NewWorldComingSoon/llvm-msvc-build) diff --git a/Source.cpp b/Source.cpp new file mode 100644 index 0000000..ce921c5 --- /dev/null +++ b/Source.cpp @@ -0,0 +1,183 @@ +#include +#include +#include "struct.h" + +#define YOUR_APP_NAME "dwm.exe" + +#define dprintf(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__) + +EXTERN_C +PCCHAR +NTAPI +PsGetProcessImageFileName(IN PEPROCESS Process); + +EXTERN_C +PVOID +PsGetProcessSectionBaseAddress(__in PEPROCESS Process); + +using fnMiObtainReferencedVadEx = void *(NTAPI *)(void *a1, char a2, int *a3); + +__declspec(naked) PVOID GetNtosBase() +{ + _asm { + mov rax, qword ptr gs:[18h] + mov rcx, [rax+38h] + mov rax, 0FFFFFFFFFFFFF000h + and rax, [rcx+4h] + jmp while_begin + search_begin: + add rax, 0FFFFFFFFFFFFF000h + while_begin: + xor ecx, ecx + jmp search_cmp + search_next: + add rcx, 1 + cmp rcx, 0FF9h + jz search_begin + search_cmp: + cmp byte ptr[rax+rcx], 48h + jnz search_next + cmp byte ptr[rax+rcx+1], 8Dh + jnz search_next + cmp byte ptr[rax+rcx+2], 1Dh + jnz search_next + cmp byte ptr[rax+rcx+6], 0FFh + jnz search_next + mov r8d,[rax+rcx+3] + lea edx,[rcx+r8] + add edx, eax + add edx, 7 + test edx, 0FFFh + jnz search_next + mov rdx, 0FFFFFFFF00000000h + and rdx, rax + add r8d, eax + lea eax,[rcx+r8] + add eax, 7 + or rax, rdx + ret + } +} + +static PUCHAR +FindPattern(PVOID Module, ULONG Size, LPCSTR Pattern, LPCSTR Mask) +{ + auto checkMask = [](PUCHAR Buffer, LPCSTR Pattern, LPCSTR Mask) -> bool { + for (auto x = Buffer; *Mask; Pattern++, Mask++, x++) + { + auto addr = *(UCHAR *)(Pattern); + if (addr != *x && *Mask != '?') + return false; + } + + return true; + }; + + for (auto x = 0; x < Size - strlen(Mask); x++) + { + auto addr = (PUCHAR)Module + x; + if (checkMask(addr, Pattern, Mask)) + return addr; + } + + return nullptr; +} + +static PEPROCESS +FindDWMEprocess(ULONG &OutPid) +{ + OutPid = 0; + PEPROCESS pEpDWM = nullptr; + for (ULONG i = 0; i < 0x5000; i += 4) + { + PEPROCESS pEp = nullptr; + auto lStatus = PsLookupProcessByProcessId((HANDLE)i, &pEp); + if (!NT_SUCCESS(lStatus) || !pEp) + { + continue; + } + + auto pName = PsGetProcessImageFileName(pEp); + // A more casual code + if (pName && strstr(pName, YOUR_APP_NAME)) + { + pEpDWM = pEp; + } + ObDereferenceObject(pEp); + + if (pEpDWM) + { + OutPid = i; + break; + } + } + + return pEpDWM; +} + +EXTERN_C +NTSTATUS +DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) +{ + dprintf("new world!\n"); + + PVOID pNtosBase = GetNtosBase(); + dprintf("pNtosBase=%p\n", pNtosBase); + + // 48 89 5C 24 10 48 89 74 24 18 48 89 7C 24 20 41 54 41 56 41 57 48 83 EC 20 41 C7 00 00 00 00 00 4D 8B E0 65 48 8B + // ?? ?? 88 01 00 00 44 8B ?? 48 8B ?? ?? ?? ?? B8 00 00 00 + fnMiObtainReferencedVadEx pMiObtainReferencedVadEx = (fnMiObtainReferencedVadEx)FindPattern( + ((PUCHAR)pNtosBase + 0x1000), + 0x50000, + "\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x48\x89\x7C\x24\x20\x41\x54\x41\x56\x41\x57\x48\x83\xEC\x20\x41\xC7\x00\x00\x00\x00\x00\x4D\x8B\xE0\x65\x48\x8B\x00\x00\x88\x01\x00\x00\x44\x8B\x00\x48\x8B\x00\x00\x00\x00\xB8\x00\x00\x00", + "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx??xxxxxx?xx????xxxx"); + dprintf("pMiObtainReferencedVadEx=%p\n", pMiObtainReferencedVadEx); + + if (!pMiObtainReferencedVadEx) + { + dprintf("Error: Not found MiObtainReferencedVadEx!\n"); + return -1; + } + + ULONG uDWMPID; + PEPROCESS pEpDWM = FindDWMEprocess(uDWMPID); + dprintf("pEpDWM=%p, uDWMPID=%d!\n", pEpDWM, uDWMPID); + if (uDWMPID == 0) + { + dprintf("Error: Not found DWM!\n"); + return -2; + } + + PUCHAR pFirstPage = (PUCHAR)PsGetProcessSectionBaseAddress(pEpDWM) + 0x1000; + dprintf("pFirstPage=%p!\n", pFirstPage); + + KAPC_STATE ks; + KeStackAttachProcess(pEpDWM, &ks); + + PETHREAD pCurThread = KeGetCurrentThread(); + short uOldSpecialApcDisable = *(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET); + + *(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET) = 0; + + int ns = 0; + auto pVAD = (PMMVAD_SHORT_17763)pMiObtainReferencedVadEx(pFirstPage, 2, &ns); + + *(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET) = uOldSpecialApcDisable; + + KeUnstackDetachProcess(&ks); + + dprintf("pVAD=%p\n", pVAD); + if (pVAD) + { + dprintf("pVAD->u.VadFlags.PrivateMemory=%d\n", pVAD->u.VadFlags.PrivateMemory); + dprintf("pVAD->u.VadFlags.Graphics=%d\n", pVAD->u.VadFlags.Graphics); + dprintf("pVAD->u.VadFlags.Enclave=%d\n", pVAD->u.VadFlags.Enclave); + + pVAD->u.VadFlags.PrivateMemory = 1; + pVAD->u.VadFlags.Graphics = 1; + pVAD->u.VadFlags.Enclave = 1; + dprintf("fake world!\n"); + } + + return STATUS_VIRUS_INFECTED; +} diff --git a/struct.h b/struct.h new file mode 100644 index 0000000..7cb01a6 --- /dev/null +++ b/struct.h @@ -0,0 +1,83 @@ +#pragma once +#include + +typedef struct _EX_PUSH_LOCK_17763 +{ + union + { + struct /* bitfield */ + { + /* 0x0000 */ unsigned __int64 Locked : 1; /* bit position: 0 */ + /* 0x0000 */ unsigned __int64 Waiting : 1; /* bit position: 1 */ + /* 0x0000 */ unsigned __int64 Waking : 1; /* bit position: 2 */ + /* 0x0000 */ unsigned __int64 MultipleShared : 1; /* bit position: 3 */ + /* 0x0000 */ unsigned __int64 Shared : 60; /* bit position: 4 */ + }; /* bitfield */ + /* 0x0000 */ unsigned __int64 Value; + /* 0x0000 */ void *Ptr; + }; /* size: 0x0008 */ +} EX_PUSH_LOCK_17763, *PEX_PUSH_LOCK_17763; /* size: 0x0008 */ + +typedef struct _MMVAD_FLAGS_17763 +{ + struct /* bitfield */ + { + /* 0x0000 */ unsigned long VadType : 3; /* bit position: 0 */ + /* 0x0000 */ unsigned long Protection : 5; /* bit position: 3 */ + /* 0x0000 */ unsigned long PreferredNode : 6; /* bit position: 8 */ + /* 0x0000 */ unsigned long PrivateMemory : 1; /* bit position: 14 */ + /* 0x0000 */ unsigned long PrivateFixup : 1; /* bit position: 15 */ + /* 0x0000 */ unsigned long Graphics : 1; /* bit position: 16 */ + /* 0x0000 */ unsigned long Enclave : 1; /* bit position: 17 */ + /* 0x0000 */ unsigned long PageSize64K : 1; /* bit position: 18 */ + /* 0x0000 */ unsigned long ShadowStack : 1; /* bit position: 19 */ + /* 0x0000 */ unsigned long Spare : 6; /* bit position: 20 */ + /* 0x0000 */ unsigned long HotPatchAllowed : 1; /* bit position: 26 */ + /* 0x0000 */ unsigned long NoChange : 1; /* bit position: 27 */ + /* 0x0000 */ unsigned long ManySubsections : 1; /* bit position: 28 */ + /* 0x0000 */ unsigned long DeleteInProgress : 1; /* bit position: 29 */ + /* 0x0000 */ unsigned long LockContended : 1; /* bit position: 30 */ + /* 0x0000 */ unsigned long Lock : 1; /* bit position: 31 */ + }; /* bitfield */ +} MMVAD_FLAGS_17763, *PMMVAD_FLAGS_17763; /* size: 0x0004 */ + +typedef struct _MMVAD_SHORT_17763 +{ + union + { + struct + { + /* 0x0000 */ struct _MMVAD_SHORT *NextVad; + /* 0x0008 */ void *ExtraCreateInfo; + }; /* size: 0x0010 */ + /* 0x0000 */ struct _RTL_BALANCED_NODE VadNode; + }; /* size: 0x0018 */ + /* 0x0018 */ unsigned long StartingVpn; + /* 0x001c */ unsigned long EndingVpn; + /* 0x0020 */ unsigned char StartingVpnHigh; + /* 0x0021 */ unsigned char EndingVpnHigh; + /* 0x0022 */ unsigned char CommitChargeHigh; + /* 0x0023 */ unsigned char SpareNT64VadUChar; + /* 0x0024 */ long ReferenceCount; + /* 0x0028 */ struct _EX_PUSH_LOCK_17763 PushLock; + union + { + union + { + /* 0x0030 */ unsigned long LongFlags; + /* 0x0030 */ struct _MMVAD_FLAGS_17763 VadFlags; + /* 0x0030 */ volatile unsigned long VolatileVadLong; + }; /* size: 0x0004 */ + } /* size: 0x0004 */ u; + union + { + union + { + /* 0x0034 */ unsigned long LongFlags1; + ///* 0x0034 */ struct _MMVAD_FLAGS1 VadFlags1; + }; /* size: 0x0004 */ + } /* size: 0x0004 */ u1; + /* 0x0038 */ struct _MI_VAD_EVENT_BLOCK *EventList; +} MMVAD_SHORT_17763, *PMMVAD_SHORT_17763; /* size: 0x0040 */ + +#define SpecialApcDisable_17763_OFFSET (0x01e6)