ANTICHAT — форум по информационной безопасности, OSINT и технологиям

unit bot_SDT;
interface
uses bot_types,bot_api;
function GetSDTFunc(i:integer):dword;
procedure CLOSE_SDT;
function OPEN_SDT:boolean;
var
SDT_prepare:boolean=false;
implementation


const
STATUS_INFO_LENGTH_MISMATCH=dword($C0000004);
SystemModuleInformation=11;
IMAGE_NT_OPTIONAL_HDR32_MAGIC=$10b;
type
IMAGE_FIXUP_ENTRY=packed record
offset_type:word;
end;
PIMAGE_FIXUP_ENTRY=^IMAGE_FIXUP_ENTRY;
IMAGE_BASE_RELOCATION=packed record
 VirtualAddress:dword;
 SizeOfBlock:dword;
end;
PIMAGE_BASE_RELOCATION=^IMAGE_BASE_RELOCATION;

var
pService:dword;
poha:PIMAGEOPTIONALHEADER;
dwKernelBase:dword;
hKernel:dword;

function GetHeaders(ibase:pointer; var pfh:PIMAGEFILEHEADER; var poh:PIMAGEOPTIONALHEADER; var psh:PIMAGESECTIONHEADER):boolean;
var
 mzhead:PIMAGEDOSHEADER;
 pehead:PIMAGEOPTIONALHEADER;
begin
 result:=false;
 mzhead:=ibase;
 pehead:=pointer(mzhead^._lfanew+dword(ibase));
 if (mzhead^.e_magic<>IMAGE_DOS_SIGNATURE) or (pehead^.Magic<>IMAGE_NT_SIGNATURE) then exit;
 pfh:=pointer(pehead);
 pfh:=pointer(dword(pfh)+4);
 poh:=pointer(dword(pfh)+sizeof(_IMAGE_FILE_HEADER));
 if poh^.Magic<>IMAGE_NT_OPTIONAL_HDR32_MAGIC then exit;
 psh:=pointer(dword(poh)+sizeof(_IMAGE_OPTIONAL_HEADER));
 result:=true;
end;

function RVATOVA(base,offset:dword):pointer;
begin
 result:=pointer(base+offset);
end;

function FindKiServiceTable(hModule:pointer;dwKSDT:dword):dword;
var
 pfh:PIMAGEFILEHEADER;
 poh:PIMAGEOPTIONALHEADER;
 psh:PIMAGESECTIONHEADER;
 pbr:PIMAGE_BASE_RELOCATION;
 pfe:PIMAGE_FIXUP_ENTRY;
 dwFixups,i,dwPointerRva,dwPointsToRva,dwKiServiceTable:dword;
 bFirstChunk:boolean;
 p:pointer;
 w:word;
begin
 result:=0;
 dwFixups:=0;
 GetHeaders(hModule,pfh,poh,psh);
 if (poh^.DataDirectory[5].VirtualAddress<>0) and (pfh^.Characteristics mod 2=0) then
  begin
   pbr:=RVATOVA(poh^.DataDirectory[5].VirtualAddress,dword(hModule));
    bFirstChunk:=true;
    while (bFirstChunk=true) or (pbr^.VirtualAddress<>0) do
     begin
      bFirstChunk:=false;
      pfe:=pointer(dword(pbr)+sizeof(IMAGE_BASE_RELOCATION));
      for i:=0 to ((pbr^.SizeOfBlock-sizeof(IMAGE_BASE_RELOCATION))shr 1)-1 do
       begin
        if (pfe^.offset_type shr 12=3) then
         begin
          inc(dwFixups);
          w:=pfe^.offset_type;
          w:=w shl 4;
          w:=w shr 4;
          dwPointerRva:=pbr^.VirtualAddress+w;
          p:=pointer(dword(hModule)+dwPointerRva);
          dwPointsToRva:=DWORD(p^)-poh^.ImageBase;
          if (dwPointsToRva=dwKSDT) then
           begin
            p:=pointer(DWORD(hModule)+dwPointerRva-2);
            if word(p^)=$05c7 then
             begin
              p:=pointer(DWORD(hModule)+dwPointerRva+4);
              dwKiServiceTable:=dword(p^)-poh^.ImageBase;
              result:=dwKiServiceTable;
              exit;
             end;
           end;
        end;
//        else
//        if (pfe^.offset_type shr 12<>0) then
//         begin
//          resul:=0;
//         end;
        inc(pfe);
       end;
      pbr:=pointer(dword(pbr)+pbr^.SizeOfBlock);
   end;
end;
if (dwFixups=0) then result:=0;
end;

function OPEN_SDT:boolean;
var
 dwNeededSize,rc:dword;
 dwKSDT:dword;
 dwKiServiceTable:dword;
 pModules:PSYSTEM_MODULE_INFORMATION_EX;
 pKernelName:pchar;
 pfh:PIMAGEFILEHEADER;
 psh:PIMAGESECTIONHEADER;
label strange;
begin
 result:=false;
 SDT_prepare:=false;
 rc:=_ZwQuerySystemInformation(SystemModuleInformation,@pModules,4,@dwNeededSize);
 if rc=STATUS_INFO_LENGTH_MISMATCH then
  begin
   pModules:=pointer(_GlobalAlloc(64,dwNeededSize));
   rc:=_ZwQuerySystemInformation(SystemModuleInformation,pointer(pModules),dwNeededSize,nil);
  end
  else
  begin
   strange:
    exit;
  end;
  if (rc<>0)then goto strange;
  dwKernelBase:=dword(pmodules^.Modules[0].Base);
  pKernelName:=pModules^.Modules[0].ModuleNameOffset+pModules^.Modules[0].ImageName;
  hKernel:=_LoadLibraryEx(pKernelName,0,1);
  if hKernel=0 then exit;
  _GlobalFree(dword(pModules));
  dwKSDT:=dword(GetProcAddress(hKernel,'KeServiceDescriptorTable'));
  if dwKSDT=0 then exit;
  dwKSDT:=dwKSDT-hKernel;
  dwKiServiceTable:=FindKiServiceTable(Pointer(hKernel),dwKSDT);
  if dwKiServiceTable=0 then exit;
  GetHeaders(pointer(hKernel),pfh,poha,psh);
  pService:=hKernel+dwKiServiceTable;
  SDT_prepare:=true;
  result:=true;
end;

function GetSDTFunc(i:integer):dword;
begin
if OPEN_SDT=false then exit;
if SDT_prepare then result:=dword(pointer(pService+4*i)^)-poha^.ImageBase+dwKernelBase else result:=0;
end;

procedure CLOSE_SDT;
begin
  if SDT_prepare then
   begin
    SDT_prepare:=false;
    _FreeLibrary(hKernel);
   end;
end;

begin

end.