ANTICHAT — форум по информационной безопасности, OSINT и технологиям

 


#define LOAD_ORDER_TYPE 0 
#define MEM_ORDER_TYPE	1 
#define INIT_ORDER_TYPE	2 
#define FUNC_ERROR	0 
#define FUNC_SUCCESS 1 
#define BUFMAXLEN 512 


//#define PEB_ADDRESS						0x7ffdf000 
#define PEB_LDR_DATA_OFFSET				0x0C    // RVA to _PEB_LDR_DATA (ProcessModuleInfo) 
 
#define LDR_DATA_IMAGE_BASE				0x18	// MODULE_ITEM.ImageBase 
#define LDR_DATA_IMAGE_SIZE				0x20	// MODULE_ITEM.ImageSize 
#define LDR_DATA_PATHFILENAME_OFFSET	0x24	// MODULE_ITEM.PathFileName 
#define LDR_DATA_FILENAME_OFFSET		0x2C	// MODULE_ITEM.FileName 
 
	  
typedef struct _PEB { 
	/*000*/ BOOLEAN              InheritedAddressSpace; 
	/*001*/ BOOLEAN              ReadImageFileExecOptions; 
	/*002*/ BOOLEAN              BeingDebugged; 
	/*003*/ BOOL                 SpareBool; // alloc size 
	/*004*/ HANDLE               Mutant; 
	/*008*/ PVOID                ImageBaseAddress; 
	/*00C   PPROCESS_MODULE_INFO*/PVOID ProcessModuleInfo; 
	/*010   PPROCESS_PARAMETERS*/ PVOID ProcessParameters; 
	/*...*/ 
/*1E8*/} PEB, *PPEB; 
 
// At PEB+0x0C (PEB+PEB_LDR_DATA_OFFSET) : PEB_LDR_DATA (ProcessModuleInfo) 

typedef struct _PEB_LDR_DATA { 
	/*000*/  ULONG Length; 
	/*004*/  BOOLEAN Initialized; 
	/*008*/  PVOID SsHandle; 
	/*00C*/  LIST_ENTRY ModuleListLoadOrder; 
	/*014*/  LIST_ENTRY ModuleListMemoryOrder; 
	/*018*/  LIST_ENTRY ModuleListInitOrder; 
	/*020*/ } PEB_LDR_DATA, *PPEB_LDR_DATA; 

     
// At PEB_LDR_DATA->ModuleListLoadOrder 
typedef struct _MODULE_ITEM { 
	/*000*/ LIST_ENTRY     ModuleListLoadOrder; 
	/*008*/ LIST_ENTRY     ModuleListMemoryOrder; 
	/*010*/ LIST_ENTRY     ModuleListInitOrder; 
	/*018*/ DWORD          ImageBase; 
	/*01C*/ DWORD          EntryPoint; 
	/*020*/ DWORD          ImageSize; 
	/*024*/ UNICODE_STRING PathFileName; 
	/*02C*/ UNICODE_STRING FileName; 
	/*034*/ ULONG          ModuleFlags; 
	/*038*/ WORD           LoadCount; 
	/*03A*/ WORD           Fill; 
	/*03C*/ DWORD          dw3c; 
	/*040*/ DWORD          dw40; 
	/*044*/ DWORD          TimeDateStamp; 
	/*048*/ } MODULE_ITEM, *PMODULE_ITEM; 
 
// Winnt.h : 
/*typedef struct _LIST_ENTRY { 
   struct _LIST_ENTRY *Flink; 
   struct _LIST_ENTRY *Blink; 
} LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; 
*/ 
 








    

static PLIST_ENTRY pUserModuleListLoadOrder;   
static PLIST_ENTRY pUserModuleListMemoryOrder;   
static PLIST_ENTRY pUserModuleListInitOrder;   
    
 // Walks one of the three modules double linked lists referenced by the PEB, adds old pointer back as first in list   
 /*
 int WalkModuleListAdd(char ModuleListType, char *szDllToStrip)   
 {   
     PLIST_ENTRY pUserModuleListHead, pUserModuleListPtr;   
            
     DWORD PebBaseAddr, dwOffset=0;   
     PPEB_LDR_DATA pLdrData;   
        
     PebBaseAddr = GetPEB(0);   
     if(PebBaseAddr == FUNC_ERROR)   
         return FUNC_ERROR;   
     pLdrData=(PPEB_LDR_DATA)(DWORD *)(*(DWORD *)(PebBaseAddr + PEB_LDR_DATA_OFFSET)); // PEB.ProcessModuleInfo = PEB + 0x0C   
     if(!pLdrData->Initialized)    
         return FUNC_ERROR;   
    
     // Init chained list head and offset   
     if(ModuleListType == LOAD_ORDER_TYPE)   
     {   
         // LOAD_ORDER_TYPE   
         pUserModuleListHead = (PLIST_ENTRY)(&(pLdrData->ModuleListLoadOrder));   
         pUserModuleListPtr = pUserModuleListLoadOrder;   
         dwOffset = 0x0;   
     } else if(ModuleListType == MEM_ORDER_TYPE)   
     {   
         // MEM_ORDER_TYPE   
         pUserModuleListHead = (PLIST_ENTRY)(&(pLdrData->ModuleListMemoryOrder));   
         pUserModuleListPtr = pUserModuleListMemoryOrder;   
         dwOffset = 0x08;   
     } else if(ModuleListType == INIT_ORDER_TYPE)   
     {   
         // INIT_ORDER_TYPE   
         pUserModuleListHead = (PLIST_ENTRY)(&(pLdrData->ModuleListInitOrder));   
         pUserModuleListPtr = pUserModuleListInitOrder;   
         dwOffset = 0x10;   
     }   
     else return FUNC_ERROR;   
        
    
     // Add this dll :   
         pUserModuleListPtr->Blink = pUserModuleListHead;   
         pUserModuleListPtr->Flink = (pUserModuleListHead->Flink);   
         pUserModuleListHead->Flink = pUserModuleListPtr;   
         (pUserModuleListPtr->Flink)->Blink = pUserModuleListPtr;   
    
     return FUNC_SUCCESS;   
 }   
  */



 // Walks one of the three modules double linked lists referenced by the PEB   
static int remmodule(char ModuleListType, DWORD modBase)   
 {   
     PLIST_ENTRY pUserModuleListHead, pUserModuleListPtr;   
     PLIST_ENTRY *pHiddenModuleListPtr;   
    
     DWORD PebBaseAddr, dwOffset=0;   
     DWORD ImageBase, ImageSize;   
     PPEB_LDR_DATA pLdrData;   
     PUNICODE_STRING pImageName;   
     char szImageName[BUFMAXLEN]; // Non-unicode string   
        
     PebBaseAddr = (DWORD)GetPeb();   
     if(PebBaseAddr == FUNC_ERROR)   
         return FUNC_ERROR;   
     pLdrData=(PPEB_LDR_DATA)(DWORD *)(*(DWORD *)(PebBaseAddr + PEB_LDR_DATA_OFFSET)); // PEB.ProcessModuleInfo = PEB + 0x0C   
     if(!pLdrData->Initialized)    
         return FUNC_ERROR;   
    
     // Init chained list head and offset   
     if(ModuleListType == LOAD_ORDER_TYPE)   
     {   
         // LOAD_ORDER_TYPE   
         pUserModuleListHead = pUserModuleListPtr = (PLIST_ENTRY)(&(pLdrData->ModuleListLoadOrder));   
         pHiddenModuleListPtr = &pUserModuleListLoadOrder;   
         dwOffset = 0x0;   
     } else if(ModuleListType == MEM_ORDER_TYPE)   
     {   
         // MEM_ORDER_TYPE   
         pUserModuleListHead = pUserModuleListPtr = (PLIST_ENTRY)(&(pLdrData->ModuleListMemoryOrder));   
         pHiddenModuleListPtr = &pUserModuleListMemoryOrder;   
         dwOffset = 0x08;   
     } else if(ModuleListType == INIT_ORDER_TYPE)   
     {   
         // INIT_ORDER_TYPE   
         pUserModuleListHead = pUserModuleListPtr = (PLIST_ENTRY)(&(pLdrData->ModuleListInitOrder));   
        pHiddenModuleListPtr = &pUserModuleListInitOrder;   
         dwOffset = 0x10;   
     }   
     else return FUNC_ERROR;   
        
     do   
     {   
         // Jump to next MODULE_ITEM structure   
         pUserModuleListPtr = pUserModuleListPtr->Flink;   
         pImageName = (PUNICODE_STRING)( ((DWORD)(pUserModuleListPtr)) + (LDR_DATA_PATHFILENAME_OFFSET-dwOffset));   
         ImageBase = *(DWORD *)(((DWORD)(pUserModuleListPtr)) + (LDR_DATA_IMAGE_BASE-dwOffset));   
         ImageSize = *(DWORD *)(((DWORD)(pUserModuleListPtr)) + (LDR_DATA_IMAGE_SIZE-dwOffset));   
    
         //Convert string from unicode and to lower case : 
		 //wide2byte(szImageName, pImageName->Buffer, BUFMAXLEN);
		 //lowercase(szImageName);
         //if(strstr((char*)szImageName, szDllToStrip) != 0 ) {  
		 if(ImageBase == modBase)
         {   

			 // Hide this dll :   
             // throw this module away (out of the double linked list)   
            (pUserModuleListPtr->Blink)->Flink = (pUserModuleListPtr->Flink);   
            (pUserModuleListPtr->Flink)->Blink = (pUserModuleListPtr->Blink);   
    
            *pHiddenModuleListPtr = pUserModuleListPtr;   


         }   
     }   while(pUserModuleListPtr->Flink != pUserModuleListHead);    
    
     return FUNC_SUCCESS;   
 }  

//скрыть модуль
static int LdrEliminateModule(DWORD modBase)   
 {   
     
         remmodule(LOAD_ORDER_TYPE, modBase);  
         remmodule(MEM_ORDER_TYPE, modBase); 
         remmodule(INIT_ORDER_TYPE, modBase);

		 return 1;
    
//     return (    WalkModuleListAdd(LOAD_ORDER_TYPE, szDllName)   
//             &&  WalkModuleListAdd(MEM_ORDER_TYPE, szDllName)   
//             &&  WalkModuleListAdd(INIT_ORDER_TYPE, szDllName)   );   
 }