gmh5225
2 years ago
parent
328b869cf7
commit
ce936023a2
@ -0,0 +1,101 @@
|
|||||||
|
AccessModifierOffset: -4
|
||||||
|
AlignAfterOpenBracket: AlwaysBreak
|
||||||
|
AlignConsecutiveAssignments: false
|
||||||
|
AlignConsecutiveDeclarations: false
|
||||||
|
AlignEscapedNewlines: DontAlign
|
||||||
|
AlignOperands: true
|
||||||
|
AllowAllParametersOfDeclarationOnNextLine: false
|
||||||
|
AllowShortBlocksOnASingleLine: false
|
||||||
|
AllowShortCaseLabelsOnASingleLine: false
|
||||||
|
AllowShortFunctionsOnASingleLine: Inline
|
||||||
|
AllowShortIfStatementsOnASingleLine: false
|
||||||
|
AllowShortLoopsOnASingleLine: false
|
||||||
|
AlwaysBreakAfterReturnType: TopLevel
|
||||||
|
AlwaysBreakBeforeMultilineStrings: false
|
||||||
|
AlwaysBreakTemplateDeclarations: true
|
||||||
|
BinPackArguments: false
|
||||||
|
BinPackParameters: false
|
||||||
|
BraceWrapping:
|
||||||
|
AfterClass: true
|
||||||
|
AfterControlStatement: true
|
||||||
|
AfterEnum: true
|
||||||
|
AfterFunction: true
|
||||||
|
AfterNamespace: false
|
||||||
|
AfterStruct: true
|
||||||
|
AfterUnion: true
|
||||||
|
AfterExternBlock: false
|
||||||
|
BeforeCatch: true
|
||||||
|
BeforeElse: true
|
||||||
|
BreakBeforeBraces: Custom
|
||||||
|
BreakBeforeBinaryOperators: None
|
||||||
|
BreakBeforeTernaryOperators: true
|
||||||
|
BreakConstructorInitializers: AfterColon
|
||||||
|
BreakStringLiterals: false
|
||||||
|
ColumnLimit: 120
|
||||||
|
CommentPragmas: '^begin_wpp|^end_wpp|^FUNC |^USESUFFIX |^USESUFFIX '
|
||||||
|
ConstructorInitializerAllOnOneLineOrOnePerLine: true
|
||||||
|
ConstructorInitializerIndentWidth: 4
|
||||||
|
ContinuationIndentWidth: 4
|
||||||
|
Cpp11BracedListStyle: true
|
||||||
|
DerivePointerAlignment: false
|
||||||
|
ExperimentalAutoDetectBinPacking: false
|
||||||
|
IndentCaseLabels: false
|
||||||
|
IndentPPDirectives: AfterHash
|
||||||
|
IndentWidth: 4
|
||||||
|
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||||
|
Language: Cpp
|
||||||
|
MacroBlockBegin: '^BEGIN_MODULE$|^BEGIN_TEST_CLASS$|^BEGIN_TEST_METHOD$'
|
||||||
|
MacroBlockEnd: '^END_MODULE$|^END_TEST_CLASS$|^END_TEST_METHOD$'
|
||||||
|
MaxEmptyLinesToKeep: 1
|
||||||
|
NamespaceIndentation: None
|
||||||
|
PointerAlignment: Right
|
||||||
|
ReflowComments: true
|
||||||
|
SortIncludes: false
|
||||||
|
SpaceAfterCStyleCast: false
|
||||||
|
SpaceBeforeAssignmentOperators: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeCtorInitializerColon: true
|
||||||
|
SpaceBeforeParens: ControlStatements
|
||||||
|
SpaceBeforeRangeBasedForLoopColon: true
|
||||||
|
SpaceInEmptyParentheses: false
|
||||||
|
SpacesInAngles: false
|
||||||
|
SpacesInCStyleCastParentheses: false
|
||||||
|
SpacesInParentheses: false
|
||||||
|
SpacesInSquareBrackets: false
|
||||||
|
Standard: Cpp11
|
||||||
|
StatementMacros: [
|
||||||
|
'EXTERN_C',
|
||||||
|
'PAGED',
|
||||||
|
'PAGEDX',
|
||||||
|
'NONPAGED',
|
||||||
|
'PNPCODE',
|
||||||
|
'INITCODE',
|
||||||
|
'_At_',
|
||||||
|
'_When_',
|
||||||
|
'_Success_',
|
||||||
|
'_Check_return_',
|
||||||
|
'_Must_inspect_result_',
|
||||||
|
'_IRQL_requires_',
|
||||||
|
'_IRQL_requires_max_',
|
||||||
|
'_IRQL_requires_min_',
|
||||||
|
'_IRQL_saves_',
|
||||||
|
'_IRQL_restores_',
|
||||||
|
'_IRQL_saves_global_',
|
||||||
|
'_IRQL_restores_global_',
|
||||||
|
'_IRQL_raises_',
|
||||||
|
'_IRQL_lowers_',
|
||||||
|
'_Acquires_lock_',
|
||||||
|
'_Releases_lock_',
|
||||||
|
'_Acquires_exclusive_lock_',
|
||||||
|
'_Releases_exclusive_lock_',
|
||||||
|
'_Acquires_shared_lock_',
|
||||||
|
'_Releases_shared_lock_',
|
||||||
|
'_Requires_lock_held_',
|
||||||
|
'_Use_decl_annotations_',
|
||||||
|
'_Guarded_by_',
|
||||||
|
'__drv_preferredFunction',
|
||||||
|
'__drv_allocatesMem',
|
||||||
|
'__drv_freesMem',
|
||||||
|
]
|
||||||
|
TabWidth: '4'
|
||||||
|
UseTab: Never
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="Source Files">
|
||||||
|
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||||
|
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Header Files">
|
||||||
|
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||||
|
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="Resource Files">
|
||||||
|
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||||
|
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="Source.cpp">
|
||||||
|
<Filter>Source Files</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="struct.h">
|
||||||
|
<Filter>Header Files</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@ -1,3 +1,11 @@
|
|||||||
# FakeEnclave
|
# FakeEnclave
|
||||||
|
|
||||||
A poc that abuses Enclave
|
A poc that abuses Enclave
|
||||||
|
|
||||||
|
|
||||||
|
## What it can do?
|
||||||
|
- Anti-tamper
|
||||||
|
- There may be nothing to do
|
||||||
|
|
||||||
|
## Compile
|
||||||
|
- Visual Studio 2022 & WDK10
|
||||||
|
- llvm-msvc [[link]](https://github.com/NewWorldComingSoon/llvm-msvc-build)
|
||||||
|
|||||||
@ -0,0 +1,183 @@
|
|||||||
|
#include <fltKernel.h>
|
||||||
|
#include <ntimage.h>
|
||||||
|
#include "struct.h"
|
||||||
|
|
||||||
|
#define YOUR_APP_NAME "dwm.exe"
|
||||||
|
|
||||||
|
#define dprintf(...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, __VA_ARGS__)
|
||||||
|
|
||||||
|
EXTERN_C
|
||||||
|
PCCHAR
|
||||||
|
NTAPI
|
||||||
|
PsGetProcessImageFileName(IN PEPROCESS Process);
|
||||||
|
|
||||||
|
EXTERN_C
|
||||||
|
PVOID
|
||||||
|
PsGetProcessSectionBaseAddress(__in PEPROCESS Process);
|
||||||
|
|
||||||
|
using fnMiObtainReferencedVadEx = void *(NTAPI *)(void *a1, char a2, int *a3);
|
||||||
|
|
||||||
|
__declspec(naked) PVOID GetNtosBase()
|
||||||
|
{
|
||||||
|
_asm {
|
||||||
|
mov rax, qword ptr gs:[18h]
|
||||||
|
mov rcx, [rax+38h]
|
||||||
|
mov rax, 0FFFFFFFFFFFFF000h
|
||||||
|
and rax, [rcx+4h]
|
||||||
|
jmp while_begin
|
||||||
|
search_begin:
|
||||||
|
add rax, 0FFFFFFFFFFFFF000h
|
||||||
|
while_begin:
|
||||||
|
xor ecx, ecx
|
||||||
|
jmp search_cmp
|
||||||
|
search_next:
|
||||||
|
add rcx, 1
|
||||||
|
cmp rcx, 0FF9h
|
||||||
|
jz search_begin
|
||||||
|
search_cmp:
|
||||||
|
cmp byte ptr[rax+rcx], 48h
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+1], 8Dh
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+2], 1Dh
|
||||||
|
jnz search_next
|
||||||
|
cmp byte ptr[rax+rcx+6], 0FFh
|
||||||
|
jnz search_next
|
||||||
|
mov r8d,[rax+rcx+3]
|
||||||
|
lea edx,[rcx+r8]
|
||||||
|
add edx, eax
|
||||||
|
add edx, 7
|
||||||
|
test edx, 0FFFh
|
||||||
|
jnz search_next
|
||||||
|
mov rdx, 0FFFFFFFF00000000h
|
||||||
|
and rdx, rax
|
||||||
|
add r8d, eax
|
||||||
|
lea eax,[rcx+r8]
|
||||||
|
add eax, 7
|
||||||
|
or rax, rdx
|
||||||
|
ret
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static PUCHAR
|
||||||
|
FindPattern(PVOID Module, ULONG Size, LPCSTR Pattern, LPCSTR Mask)
|
||||||
|
{
|
||||||
|
auto checkMask = [](PUCHAR Buffer, LPCSTR Pattern, LPCSTR Mask) -> bool {
|
||||||
|
for (auto x = Buffer; *Mask; Pattern++, Mask++, x++)
|
||||||
|
{
|
||||||
|
auto addr = *(UCHAR *)(Pattern);
|
||||||
|
if (addr != *x && *Mask != '?')
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
return true;
|
||||||
|
};
|
||||||
|
|
||||||
|
for (auto x = 0; x < Size - strlen(Mask); x++)
|
||||||
|
{
|
||||||
|
auto addr = (PUCHAR)Module + x;
|
||||||
|
if (checkMask(addr, Pattern, Mask))
|
||||||
|
return addr;
|
||||||
|
}
|
||||||
|
|
||||||
|
return nullptr;
|
||||||
|
}
|
||||||
|
|
||||||
|
static PEPROCESS
|
||||||
|
FindDWMEprocess(ULONG &OutPid)
|
||||||
|
{
|
||||||
|
OutPid = 0;
|
||||||
|
PEPROCESS pEpDWM = nullptr;
|
||||||
|
for (ULONG i = 0; i < 0x5000; i += 4)
|
||||||
|
{
|
||||||
|
PEPROCESS pEp = nullptr;
|
||||||
|
auto lStatus = PsLookupProcessByProcessId((HANDLE)i, &pEp);
|
||||||
|
if (!NT_SUCCESS(lStatus) || !pEp)
|
||||||
|
{
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
|
||||||
|
auto pName = PsGetProcessImageFileName(pEp);
|
||||||
|
// A more casual code
|
||||||
|
if (pName && strstr(pName, YOUR_APP_NAME))
|
||||||
|
{
|
||||||
|
pEpDWM = pEp;
|
||||||
|
}
|
||||||
|
ObDereferenceObject(pEp);
|
||||||
|
|
||||||
|
if (pEpDWM)
|
||||||
|
{
|
||||||
|
OutPid = i;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return pEpDWM;
|
||||||
|
}
|
||||||
|
|
||||||
|
EXTERN_C
|
||||||
|
NTSTATUS
|
||||||
|
DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath)
|
||||||
|
{
|
||||||
|
dprintf("new world!\n");
|
||||||
|
|
||||||
|
PVOID pNtosBase = GetNtosBase();
|
||||||
|
dprintf("pNtosBase=%p\n", pNtosBase);
|
||||||
|
|
||||||
|
// 48 89 5C 24 10 48 89 74 24 18 48 89 7C 24 20 41 54 41 56 41 57 48 83 EC 20 41 C7 00 00 00 00 00 4D 8B E0 65 48 8B
|
||||||
|
// ?? ?? 88 01 00 00 44 8B ?? 48 8B ?? ?? ?? ?? B8 00 00 00
|
||||||
|
fnMiObtainReferencedVadEx pMiObtainReferencedVadEx = (fnMiObtainReferencedVadEx)FindPattern(
|
||||||
|
((PUCHAR)pNtosBase + 0x1000),
|
||||||
|
0x50000,
|
||||||
|
"\x48\x89\x5C\x24\x10\x48\x89\x74\x24\x18\x48\x89\x7C\x24\x20\x41\x54\x41\x56\x41\x57\x48\x83\xEC\x20\x41\xC7\x00\x00\x00\x00\x00\x4D\x8B\xE0\x65\x48\x8B\x00\x00\x88\x01\x00\x00\x44\x8B\x00\x48\x8B\x00\x00\x00\x00\xB8\x00\x00\x00",
|
||||||
|
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx??xxxxxx?xx????xxxx");
|
||||||
|
dprintf("pMiObtainReferencedVadEx=%p\n", pMiObtainReferencedVadEx);
|
||||||
|
|
||||||
|
if (!pMiObtainReferencedVadEx)
|
||||||
|
{
|
||||||
|
dprintf("Error: Not found MiObtainReferencedVadEx!\n");
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
ULONG uDWMPID;
|
||||||
|
PEPROCESS pEpDWM = FindDWMEprocess(uDWMPID);
|
||||||
|
dprintf("pEpDWM=%p, uDWMPID=%d!\n", pEpDWM, uDWMPID);
|
||||||
|
if (uDWMPID == 0)
|
||||||
|
{
|
||||||
|
dprintf("Error: Not found DWM!\n");
|
||||||
|
return -2;
|
||||||
|
}
|
||||||
|
|
||||||
|
PUCHAR pFirstPage = (PUCHAR)PsGetProcessSectionBaseAddress(pEpDWM) + 0x1000;
|
||||||
|
dprintf("pFirstPage=%p!\n", pFirstPage);
|
||||||
|
|
||||||
|
KAPC_STATE ks;
|
||||||
|
KeStackAttachProcess(pEpDWM, &ks);
|
||||||
|
|
||||||
|
PETHREAD pCurThread = KeGetCurrentThread();
|
||||||
|
short uOldSpecialApcDisable = *(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET);
|
||||||
|
|
||||||
|
*(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET) = 0;
|
||||||
|
|
||||||
|
int ns = 0;
|
||||||
|
auto pVAD = (PMMVAD_SHORT_17763)pMiObtainReferencedVadEx(pFirstPage, 2, &ns);
|
||||||
|
|
||||||
|
*(short *)((PUCHAR)pCurThread + SpecialApcDisable_17763_OFFSET) = uOldSpecialApcDisable;
|
||||||
|
|
||||||
|
KeUnstackDetachProcess(&ks);
|
||||||
|
|
||||||
|
dprintf("pVAD=%p\n", pVAD);
|
||||||
|
if (pVAD)
|
||||||
|
{
|
||||||
|
dprintf("pVAD->u.VadFlags.PrivateMemory=%d\n", pVAD->u.VadFlags.PrivateMemory);
|
||||||
|
dprintf("pVAD->u.VadFlags.Graphics=%d\n", pVAD->u.VadFlags.Graphics);
|
||||||
|
dprintf("pVAD->u.VadFlags.Enclave=%d\n", pVAD->u.VadFlags.Enclave);
|
||||||
|
|
||||||
|
pVAD->u.VadFlags.PrivateMemory = 1;
|
||||||
|
pVAD->u.VadFlags.Graphics = 1;
|
||||||
|
pVAD->u.VadFlags.Enclave = 1;
|
||||||
|
dprintf("fake world!\n");
|
||||||
|
}
|
||||||
|
|
||||||
|
return STATUS_VIRUS_INFECTED;
|
||||||
|
}
|
||||||
@ -0,0 +1,83 @@
|
|||||||
|
#pragma once
|
||||||
|
#include <fltKernel.h>
|
||||||
|
|
||||||
|
typedef struct _EX_PUSH_LOCK_17763
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct /* bitfield */
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned __int64 Locked : 1; /* bit position: 0 */
|
||||||
|
/* 0x0000 */ unsigned __int64 Waiting : 1; /* bit position: 1 */
|
||||||
|
/* 0x0000 */ unsigned __int64 Waking : 1; /* bit position: 2 */
|
||||||
|
/* 0x0000 */ unsigned __int64 MultipleShared : 1; /* bit position: 3 */
|
||||||
|
/* 0x0000 */ unsigned __int64 Shared : 60; /* bit position: 4 */
|
||||||
|
}; /* bitfield */
|
||||||
|
/* 0x0000 */ unsigned __int64 Value;
|
||||||
|
/* 0x0000 */ void *Ptr;
|
||||||
|
}; /* size: 0x0008 */
|
||||||
|
} EX_PUSH_LOCK_17763, *PEX_PUSH_LOCK_17763; /* size: 0x0008 */
|
||||||
|
|
||||||
|
typedef struct _MMVAD_FLAGS_17763
|
||||||
|
{
|
||||||
|
struct /* bitfield */
|
||||||
|
{
|
||||||
|
/* 0x0000 */ unsigned long VadType : 3; /* bit position: 0 */
|
||||||
|
/* 0x0000 */ unsigned long Protection : 5; /* bit position: 3 */
|
||||||
|
/* 0x0000 */ unsigned long PreferredNode : 6; /* bit position: 8 */
|
||||||
|
/* 0x0000 */ unsigned long PrivateMemory : 1; /* bit position: 14 */
|
||||||
|
/* 0x0000 */ unsigned long PrivateFixup : 1; /* bit position: 15 */
|
||||||
|
/* 0x0000 */ unsigned long Graphics : 1; /* bit position: 16 */
|
||||||
|
/* 0x0000 */ unsigned long Enclave : 1; /* bit position: 17 */
|
||||||
|
/* 0x0000 */ unsigned long PageSize64K : 1; /* bit position: 18 */
|
||||||
|
/* 0x0000 */ unsigned long ShadowStack : 1; /* bit position: 19 */
|
||||||
|
/* 0x0000 */ unsigned long Spare : 6; /* bit position: 20 */
|
||||||
|
/* 0x0000 */ unsigned long HotPatchAllowed : 1; /* bit position: 26 */
|
||||||
|
/* 0x0000 */ unsigned long NoChange : 1; /* bit position: 27 */
|
||||||
|
/* 0x0000 */ unsigned long ManySubsections : 1; /* bit position: 28 */
|
||||||
|
/* 0x0000 */ unsigned long DeleteInProgress : 1; /* bit position: 29 */
|
||||||
|
/* 0x0000 */ unsigned long LockContended : 1; /* bit position: 30 */
|
||||||
|
/* 0x0000 */ unsigned long Lock : 1; /* bit position: 31 */
|
||||||
|
}; /* bitfield */
|
||||||
|
} MMVAD_FLAGS_17763, *PMMVAD_FLAGS_17763; /* size: 0x0004 */
|
||||||
|
|
||||||
|
typedef struct _MMVAD_SHORT_17763
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
struct
|
||||||
|
{
|
||||||
|
/* 0x0000 */ struct _MMVAD_SHORT *NextVad;
|
||||||
|
/* 0x0008 */ void *ExtraCreateInfo;
|
||||||
|
}; /* size: 0x0010 */
|
||||||
|
/* 0x0000 */ struct _RTL_BALANCED_NODE VadNode;
|
||||||
|
}; /* size: 0x0018 */
|
||||||
|
/* 0x0018 */ unsigned long StartingVpn;
|
||||||
|
/* 0x001c */ unsigned long EndingVpn;
|
||||||
|
/* 0x0020 */ unsigned char StartingVpnHigh;
|
||||||
|
/* 0x0021 */ unsigned char EndingVpnHigh;
|
||||||
|
/* 0x0022 */ unsigned char CommitChargeHigh;
|
||||||
|
/* 0x0023 */ unsigned char SpareNT64VadUChar;
|
||||||
|
/* 0x0024 */ long ReferenceCount;
|
||||||
|
/* 0x0028 */ struct _EX_PUSH_LOCK_17763 PushLock;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
/* 0x0030 */ unsigned long LongFlags;
|
||||||
|
/* 0x0030 */ struct _MMVAD_FLAGS_17763 VadFlags;
|
||||||
|
/* 0x0030 */ volatile unsigned long VolatileVadLong;
|
||||||
|
}; /* size: 0x0004 */
|
||||||
|
} /* size: 0x0004 */ u;
|
||||||
|
union
|
||||||
|
{
|
||||||
|
union
|
||||||
|
{
|
||||||
|
/* 0x0034 */ unsigned long LongFlags1;
|
||||||
|
///* 0x0034 */ struct _MMVAD_FLAGS1 VadFlags1;
|
||||||
|
}; /* size: 0x0004 */
|
||||||
|
} /* size: 0x0004 */ u1;
|
||||||
|
/* 0x0038 */ struct _MI_VAD_EVENT_BLOCK *EventList;
|
||||||
|
} MMVAD_SHORT_17763, *PMMVAD_SHORT_17763; /* size: 0x0040 */
|
||||||
|
|
||||||
|
#define SpecialApcDisable_17763_OFFSET (0x01e6)
|
||||||
Loading…
Reference in new issue