本帖最后由 aswcy815174418 于 2022-3-23 14:38 编辑
干了一下午,解决了DebugView犯人的弹窗,但没解决掉Windbg里面这串英文:Invalid parameter passed to C runtime function.希望有知道的大大给说说
代码为两个版本:
一丶通过开关WP来过掉写保护
二丶通过重映射过掉写保护(强烈推荐)
原理:vDbgPrintExWithPrefix函数修改rax = 0xC000000D(STATUS_INVALID_PARAMETER),并且ret返回
开关WP版本:
#include "ntifs.h"
VOID DriverUnload(PDRIVER_OBJECT driver) {
DbgPrint("Bye Wolrd\r\n");
}
KIRQL WPOFFx64() {
KIRQL irql = KeRaiseIrqlToDpcLevel();
UINT64 cr0 = __readcr0();
cr0 &= 0xfffffffffffeffff;
_disable();
__writecr0(cr0);
return irql;
}
void WPONx64(KIRQL irql) {
UINT64 cr0 = __readcr0();
cr0 |= 0x10000;
_enable();
__writecr0(cr0);
KeLowerIrql(irql);
}
void CloseInfo() {
KIRQL OldIrql = WPOFFx64();
*(size_t*)vDbgPrintExWithPrefix = 0xc3c000000db8;
WPONx64(OldIrql);
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path) {
driver->Flags |= 0x20;
driver->DriverUnload = DriverUnload;
DbgPrint("Hello Wolrd!\n");
//DbgBreakPoint();
CloseInfo();
return STATUS_SUCCESS;
}
下面为重映射版本头文件:
#ifndef PAGE_HEADER
#ifndef NTIHEADER
#define NTIHEADER
#include "ntifs.h"
#endif
#define PAGE_HEADER
typedef union CR3_ {
UINT64 value;
struct {
UINT64 ignored_1 : 3;
UINT64 write_through : 1;
UINT64 cache_disable : 1;
UINT64 ignored_2 : 7;
UINT64 pml4_p : 40;
UINT64 reserved : 12;
};
} PTE_CR3;
typedef union VIRT_ADDR_ {
UINT64 value;
void* pointer;
struct {
UINT64 offset : 12;
UINT64 pt_index : 9;
UINT64 pd_index : 9;
UINT64 pdpt_index : 9;
UINT64 pml4_index : 9;
UINT64 reserved : 16;
};
} VIRT_ADDR;
typedef UINT64 PHYS_ADDR;
typedef union PML4E_ {
UINT64 value;
struct {
UINT64 present : 1;
UINT64 rw : 1;
UINT64 user : 1;
UINT64 write_through : 1;
UINT64 cache_disable : 1;
UINT64 accessed : 1;
UINT64 ignored_1 : 1;
UINT64 reserved_1 : 1;
UINT64 ignored_2 : 4;
UINT64 pdpt_p : 40;
UINT64 ignored_3 : 11;
UINT64 xd : 1;
};
} PML4E;
typedef union PDPTE_ {
UINT64 value;
struct {
UINT64 present : 1;
UINT64 rw : 1;
UINT64 user : 1;
UINT64 write_through : 1;
UINT64 cache_disable : 1;
UINT64 accessed : 1;
UINT64 dirty : 1;
UINT64 page_size : 1;
UINT64 ignored_2 : 4;
UINT64 pd_p : 40;
UINT64 ignored_3 : 11;
UINT64 xd : 1;
};
} PDPTE;
typedef union PDE_ {
UINT64 value;
struct {
UINT64 present : 1;
UINT64 rw : 1;
UINT64 user : 1;
UINT64 write_through : 1;
UINT64 cache_disable : 1;
UINT64 accessed : 1;
UINT64 dirty : 1;
UINT64 page_size : 1;
UINT64 ignored_2 : 4;
UINT64 pt_p : 40;
UINT64 ignored_3 : 11;
UINT64 xd : 1;
};
} PDE;
typedef union PTE_ {
UINT64 value;
VIRT_ADDR vaddr;
struct {
UINT64 present : 1;
UINT64 rw : 1;
UINT64 user : 1;
UINT64 write_through : 1;
UINT64 cache_disable : 1;
UINT64 accessed : 1;
UINT64 dirty : 1;
UINT64 pat : 1;
UINT64 global : 1;
UINT64 ignored_1 : 3;
UINT64 page_frame : 40;
UINT64 ignored_3 : 11;
UINT64 xd : 1;
};
} PTE;
#endif // !1
下面为重映射代码
#include "ntifs.h"
#include "head.h"
UINT64 PTE_BASE;
UINT64 PDE_BASE;
UINT64 PPE_BASE;
UINT64 PXE_BASE;
VOID DriverUnload(PDRIVER_OBJECT driver) {
DbgPrint("Bye Wolrd\r\n");
}
PULONG64 GetPxeAddress(PVOID addr) {
return (PULONG64)((((((ULONG64)addr & 0xffffffffffff) >> 39)) << 3) + PXE_BASE);
}
PULONG64 GetPpeAddress(PVOID addr) {
return (PULONG64)((((((ULONG64)addr & 0xffffffffffff) >> 30)) << 3) + PPE_BASE);
}
PULONG64 GetPdeAddress(PVOID addr) {
return (PULONG64)((((((ULONG64)addr & 0xffffffffffff) >> 21)) << 3) + PDE_BASE);
}
PULONG64 GetPteAddress(PVOID addr) {
return (PULONG64)((((((ULONG64)addr & 0xffffffffffff) >> 12)) << 3) + PTE_BASE);
}
size_t MmGetVirtalPteBase() {
size_t pte_base = 0;
PHYSICAL_ADDRESS cr3_pa = { __readcr3() & 0xfffffffffffffff0 };
PTE* page_directory_va = MmGetVirtualForPhysical(cr3_pa);
if (page_directory_va) {
for (size_t index = 0; index < 512; index++) {
if (page_directory_va[index].page_frame == (cr3_pa.QuadPart >> 12)) {
pte_base = (index + 0x1FFFE00) << 39;
PTE_BASE = pte_base;
break;
}
}
}
return pte_base;
}
void InitializePageBase() {
PDE_BASE = (SIZE_T)GetPteAddress((PVOID)MmGetVirtalPteBase());
PPE_BASE = (SIZE_T)GetPteAddress((PVOID)PDE_BASE);
PXE_BASE = (SIZE_T)GetPteAddress((PVOID)PPE_BASE);
}
void CloseInfo() {
size_t Address = ExAllocatePoolWithTag(PagedPool, 0x1000,"Tag");
if (Address) {
RtlZeroBytes(Address, 0x1000);
size_t* OldPte = GetPteAddress(Address);
size_t* TargetPte = GetPteAddress(vDbgPrintExWithPrefix);
size_t ReserveOldPte = *OldPte;
//mov eax,0xC000000D
//ret;
size_t TargetOpCode = 0xc3c000000db8;
size_t OldOpCode = *(size_t*)vDbgPrintExWithPrefix;
size_t offset = (size_t)vDbgPrintExWithPrefix & 0xFFF;
*OldPte = (*TargetPte & 0xFFFFFFFFF000) | (*OldPte & 0xFFF);
//DbgPrint("%x\n", *OldPte);
//DbgPrint("%x\n", *TargetPte);
//DbgPrint("%x\n", offset);
while (*(size_t*)vDbgPrintExWithPrefix == OldOpCode && *(size_t*)vDbgPrintExWithPrefix != TargetOpCode) {
InterlockedExchange64(Address + offset, TargetOpCode);
YieldProcessor();
}
DbgPrint("成功去除垃圾信息\n");
*OldPte = ReserveOldPte;
ExFreePoolWithTag(Address, "Tag");
}
}
NTSTATUS DriverEntry(PDRIVER_OBJECT driver, PUNICODE_STRING reg_path) {
driver->Flags |= 0x20;
driver->DriverUnload = DriverUnload;
InitializePageBase();
DbgPrint("Hello Wolrd!\n");
if (PTE_BASE) {
CloseInfo();
}
return STATUS_SUCCESS;
}
| 
发表于 2022-3-21 18:21
|
发表于 2022-3-21 21:03
