hook NtQueryDirectoryFile实现文件隐藏
一、NtQueryDirectoryFile函数功能(NT系列函数)
NtQueryDirectoryFile函数:在一个给定的文件句柄,该函数返回该文件句柄指定目录下的不同文件的各种信息。
根据传入的文件句柄参数fileHandle,返回句柄所表示的目录中的不同文件的信息。
NTSTATUS ZwQueryDirectoryFile(
_In_ HANDLE FileHandle,
_In_opt_ HANDLE Event,
_In_opt_ PIO_APC_ROUTINE ApcRoutine,
_In_opt_ PVOID ApcContext,
_Out_ PIO_STATUS_BLOCK IoStatusBlock,
_Out_ PVOID FileInformation,
_In_ ULONG Length,
_In_ FILE_INFORMATION_CLASS FileInformationClass,
_In_ BOOLEAN ReturnSingleEntry,
_In_opt_ PUNICODE_STRING FileName,
_In_ BOOLEAN RestartScan
);
下面就简单说几个重要的参数:
1.FileHandle [in]文件句柄
ZwCreateFile或者ZwOpenFile返回的句柄。
A handle returned by ZwCreateFile or ZwOpenFile for the file object that represents the directory for which information is being requested. The file object must have been opened for asynchronous I/O if the caller specifies a non-NULL value for Event or ApcRoutine.
7.FileInformation [out]
FileInformation是一个指向一个缓冲区的指针。该缓冲区存储关于文件的信息。信息的结构由FileInformationClassparameter定义。就由最后一个参数FileInformationClass决定。所以要先判断这个参数的值是什么呀。
A pointer to a buffer that receives the desired information about the file. The structure of the information returned in the buffer is defined by the FileInformationClassparameter.
8.Length [in] 长度,代表缓冲区的size,以字节大小记录。
The size, in bytes, of the buffer pointed to by FileInformation. The caller should set this parameter according to the given FileInformationClass.
9.FileInformationClass [in]文件信息类
返回的关于在一个目录中的文件的信息类型。它的取值是下表中的一个。
The type of information to be returned about files in the directory. One of the following.
Value | Meaning |
---|---|
FileBothDirectoryInformation |
Return a FILE_BOTH_DIR_INFORMATION structure for each file. |
FileDirectoryInformation |
Return a FILE_DIRECTORY_INFORMATION structure for each file. |
FileFullDirectoryInformation |
Return a FILE_FULL_DIR_INFORMATION structure for each file. |
FileIdBothDirectoryInformation |
Return a FILE_ID_BOTH_DIR_INFORMATION structure for each file. |
FileIdFullDirectoryInformation |
Return a FILE_ID_FULL_DIR_INFORMATION structure for each file. |
FileNamesInformation |
Return a FILE_NAMES_INFORMATION structure for each file. |
FileObjectIdInformation |
Return a FILE_OBJECTID_INFORMATION structure for each file. This information class is valid only for NTFS volumes on Windows 2000 and later versions of Windows. |
FileReparsePointInformation |
Return a single FILE_REPARSE_POINT_INFORMATION structure for the directory. |
ReturnSingleEntry [in]
Set to TRUE if only a single entry should be returned, FALSE otherwise. If this parameter is TRUE, ZwQueryDirectoryFile returns only the first entry that is found.
FileName [in, optional]
An optional pointer to a caller-allocated Unicode string containing the name of a file (or multiple files, if wildcards are used) within the directory specified by FileHandle. This parameter is optional and can be NULL.
If FileName is not NULL, only files whose names match the FileName string are included in the directory scan. If FileName is NULL, all files are included.
The FileName is used as a search expression and is captured on the very first call to ZwQueryDirectoryFile for a given handle. Subsequent calls toZwQueryDirectoryFile will use the search expression set in the first call. The FileName parameter passed to subsequent calls will be ignored.
RestartScan [in]
Set to TRUE if the scan is to start at the first entry in the directory. Set to FALSE if resuming the scan from a previous call.
When the ZwQueryDirectoryFile routine is called for a particular handle, the RestartScan parameter is treated as if it were set to TRUE, regardless of its value. On subsequent ZwQueryDirectoryFile calls, the value of the RestartScan parameter is honored.
2.hook NtQueryDirectoryFile()实现对文件的隐藏
#include "ntddk.h" #pragma pack(1)
typedef struct ServiceDescriptorEntry {
unsigned int *ServiceTableBase;
unsigned int *ServiceCounterTableBase;
unsigned int NumberOfServices;
unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry_t, *PServiceDescriptorTableEntry_t; typedef struct _FILE_BOTH_DIR_INFORMATION {
ULONG NextEntryOffset;
ULONG FileIndex;
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
LARGE_INTEGER EndOfFile;
LARGE_INTEGER AllocationSize;
ULONG FileAttributes;
ULONG FileNameLength;
ULONG EaSize;
CCHAR ShortNameLength;
WCHAR ShortName[];
WCHAR FileName[];
} FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; // Our System Call Table
PVOID* NewSystemCallTable; // Our Memory Descriptor List
PMDL pMyMDL; #define HOOK_INDEX(function2hook) *(PULONG)((PUCHAR)function2hook+1) #define HOOK(functionName, newPointer2Function, oldPointer2Function ) \
oldPointer2Function = (PVOID) InterlockedExchange( (PLONG) &NewSystemCallTable[HOOK_INDEX(functionName)], (LONG) newPointer2Function) #define UNHOOK(functionName, oldPointer2Function) \
InterlockedExchange( (PLONG) &NewSystemCallTable[HOOK_INDEX(functionName)], (LONG) oldPointer2Function) NTSYSAPI
NTSTATUS
NTAPI ZwQueryDirectoryFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
OUT PVOID FileInformation,
IN ULONG Length,
IN FILE_INFORMATION_CLASS FileInformationClass,
IN BOOLEAN ReturnSingleEntry,
IN PUNICODE_STRING FileName OPTIONAL,
IN BOOLEAN RestartScan
); typedef NTSTATUS (__stdcall* ZWQUERYDIRECTORYFILE)(
__in HANDLE FileHandle,
__in_opt HANDLE Event OPTIONAL,
__in_opt PIO_APC_ROUTINE ApcRoutine OPTIONAL,
__in_opt PVOID ApcContext OPTIONAL,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID FileInformation,
__in ULONG Length,
__in FILE_INFORMATION_CLASS FileInformationClass,
__in BOOLEAN ReturnSingleEntry,
__in PUNICODE_STRING FileName OPTIONAL,
__in BOOLEAN RestartScan
); int ZwQueryDirectoryFileIndex;//作为ZwQueryDirectoryFileIndex在ssdt索引地址中的相对路径。 NTSTATUS __stdcall NewNtQueryDirectoryFile(
__in HANDLE FileHandle,
__in_opt HANDLE Event ,
__in_opt PIO_APC_ROUTINE ApcRoutine,
__in_opt PVOID ApcContext OPTIONAL,
__out PIO_STATUS_BLOCK IoStatusBlock,
__out PVOID FileInformation,
__in ULONG Length,
__in FILE_INFORMATION_CLASS FileInformationClass,
__in BOOLEAN ReturnSingleEntry,
__in PUNICODE_STRING FileName,
__in BOOLEAN RestartScan
)
{
NTSTATUS status;
ANSI_STRING ansiFileName,ansiDirName,HideDirFile;
UNICODE_STRING uniFileName;
ZWQUERYDIRECTORYFILE OldZwQueryDirectoryFile;
int ;
//测试C盘中的123.txt是否可以被隐藏。
RtlInitAnsiString(&HideDirFile,"123.txt");
KdPrint(("hide: NewZwQueryDirectoryFile called.")); if(MmIsAddressValidEx(OriginalServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex]))//判断函数的地址是否有效
{
OldZwQueryDirectoryFile=OriginalServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex];
}
else
OldZwQueryDirectoryFile=KeServiceDescriptorTable->ServiceTable[ZwQueryDirectoryFileIndex]; status = OldZwQueryDirectoryFile (
FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
FileInformation,
Length,
FileInformationClass,
ReturnSingleEntry,
FileName,
RestartScan);
if()
//这部分是隐藏文件的核心部分
if(NT_SUCCESS(status)&&FileInformationClass==FileBothDirectoryInformation)
{
PFILE_BOTH_DIR_INFORMATION pFileInfo;
PFILE_BOTH_DIR_INFORMATION pLastFileInfo;
BOOLEAN bLastOne=FALSE;
pFileInfo = (PFILE_BOTH_DIR_INFORMATION)FileInformation;
pLastFileInfo = NULL;
do
{
bLastOne = !( pFileInfo->NextEntryOffset );
RtlInitUnicodeString(&uniFileName,pFileInfo->FileName); RtlUnicodeStringToAnsiString(&ansiFileName,&uniFileName,TRUE);
RtlUnicodeStringToAnsiString(&ansiDirName,&uniFileName,TRUE); if( RtlCompareMemory(ansiFileName.Buffer,HideDirFile.Buffer,HideDirFile.Length ) == HideDirFile.Length)
{
if(bLastOne)
{
pLastFileInfo->NextEntryOffset = ;
break;
}
else //指针往后移动
{
int iPos = ((ULONG)pFileInfo) - (ULONG)FileInformation;
int iLeft = (DWORD)Length - iPos - pFileInfo->NextEntryOffset;
RtlCopyMemory( (PVOID)pFileInfo, (PVOID)( (char *)pFileInfo + pFileInfo->NextEntryOffset ), (DWORD)iLeft );
continue;
}
}
pLastFileInfo = pFileInfo;
pFileInfo = (PFILE_BOTH_DIR_INFORMATION)((char *)pFileInfo + pFileInfo->NextEntryOffset);
}while(!bLastOne);
RtlFreeAnsiString(&ansiDirName);
RtlFreeAnsiString(&ansiFileName);
}
goto _FunctionRet; _FunctionRet: return status;
161
}
其中,指针类型变量强化转换为ULONG型变量。
(ULONG)pFileInfo ;//即把地址转化为ULONG型变量。
(ULONG) FileInformation;
那么int iPos=((ULONG)pFileInfo)- (ULONG) FileInformation;
得到的就是地址偏移值。
int iLeft=(DWORD)Length-iPos-pFileInfo->NextEntryOffset;
3.上述代码,采用WDK编译。然后再整合到MFC开发的用户界面程序中。
4.在Vmware虚拟机中,操作系统是Windows XP,做测试。
5.发现在点击XX.exe之后,C盘中的123.txt就消失不见。说明对123.txt的文件隐藏成功。
hook NtQueryDirectoryFile实现文件隐藏的更多相关文章
- Inline Hook NtQueryDirectoryFile
Inline Hook NtQueryDirectoryFile 首先声明这个是菜鸟—我的学习日记,不是什么高深文章,高手们慎看. 都总是发一些已经过时的文章真不好意思,几个月以来沉迷于游戏也是时候反 ...
- 默默的发现在网上找到的hook NtQueryDirectoryFile......
默默的发现在网上找到的hook NtQueryDirectoryFile...... hook NtQueryDirectoryFile是为了实现文件隐藏,然后就发现在网上发现的代码版本似乎同一个 ...
- tp5.1入口文件隐藏
修改.htaccess文件 <IfModule mod_rewrite.c> Options +FollowSymlinks -Multiviews RewriteEngine On Re ...
- Webshell清除-解决驱动级文件隐藏挂马
Webshell清除-解决驱动级文件隐藏挂马
- FlashFXP链接到服务器上,如果www目录下的文件隐藏
FlashFXP链接到服务器上,如果www目录下的文件隐藏,那么请按照如下设置,就可以显示隐藏的文件了 [站点]->[站点管理器]->选项,然后按照如下设置:
- mac 如何让文件隐藏
1.首先,要确保知道目标文件或文件夹的名称,你不把这个名称正确地输入到终端中,Mac也无能为力啊... 2.打开终端,输入chflags hidden 3.在上述代码的后面加上该文件夹的路径,但是注意 ...
- 如何把.rar文件隐藏在一个图片内
首先假设我们要隐藏的.rar文件叫a.rar,图片叫a.jpg.先把他俩放到同一个目录下,然后通过“cmd”进入windows命令行,进入目标目录下,使用以下命令进行隐藏: copy/B a.jpg ...
- Ring3下Hook NtQueryDirectoryFile隐藏文件
NTSTATUS WINAPI Hook_NtQueryDirectoryFile(IN HANDLE FileHandle,IN HANDLE Event OPTIONAL,IN PIO_APC_R ...
- API HOOK和PE文件的关系
api hook技术的难点,并不在于hook技术,而在于对PE结构的学习和理解.如何修改api函数的入口地址?这就需要学习pe可执行文件(.exe,.dll等)如何被系统映射到进程空间中,这需要学习p ...
随机推荐
- UIImage+PYJAnimatedGIF
UIImage+PYJAnimatedGIF.h: #import <UIKit/UIKit.h> @interface UIImage (PYJAnimatedGIF) + (UIIma ...
- php判断是否为ajax请求
先说前端使用 jQuery 时怎么区分: jQuery 发出 ajax 请求时,会在请求头部添加一个名为 X-Requested-With 的信息,信息内容为:XMLHttpRequest 在后端可以 ...
- mysql字符类型
字符类型 #官网:https://dev.mysql.com/doc/refman/5.7/en/char.html #注意:char和varchar括号内的参数指的都是字符的长度 #char类型:定 ...
- 爬了个爬(三)Scrapy框架
参考博客:武Sir Scrapy是一个为了爬取网站数据,提取结构性数据而编写的应用框架. 其可以应用在数据挖掘,信息处理或存储历史数据等一系列的程序中.其最初是为了页面抓取 (更确切来说, 网络抓取 ...
- 列举不少于6条的IE与FF脚本兼容性问题,需要写出命令
(1) window.event: 表示当前的事件对象,IE有这个对象,FF没有,FF通过给事件处理函数传递事件对象 (2) 获取事件源 IE用srcElement获取事件源,而FF用target获取 ...
- 8.solr学习速成之FacetPivot
什么是Facet.pivot Facet.pivot就是按照多个维度进行分组查询,是Facet的加强,在实际运用中经常用到,一个典型的例子就是商品目录树 NamedList解释: NamedList ...
- php 中php-fpm 的重启、终止操作命令
php 中php-fpm 的重启.终止操作命令: service nginx restart service php-fpm restart 查看php-fpm进程数:ps aux | grep -c ...
- Vue 简单的总结四(项目流程,DIY脚手架、vue-cli的使用)
项目流程 1.下载 cdn 2.引包 vue-router依赖vue vue-router.js 3.如果是模块化机制 Vue.use(vue-router) 4.创建示例 let Home = {/ ...
- VB.NET使用TagLib#读取MP3中的ID3v2标签
Taglib#是一个为.NET开发的元数据读取类库,为一个开源项目,可以在他们的官网上获取windows版本的源码包或者编译好的类库:http://download.banshee.fm/taglib ...
- Java微信公众平台开发(十五)--微信JSSDK的使用
转自:http://www.cuiyongzhi.com/post/63.html 在前面的文章中有介绍到我们在微信web开发过程中常常用到的 [微信JSSDK中Config配置] ,但是我们在真正的 ...