- hidedriver_bin.zip
- HideDriver_bin
- HideDriver.sys
- HideDriverGUI.exe
- hidedriver_source.zip
- HideDriver_source
- Common
- ddk_build.bat
- drvCppLib
- build.bat
- cxx.h
- drvCppLib_vs7.vcproj
- drvCppLib_vs8.vcproj
- drvCppLib_vs8.vcproj.AdiosNote.Adios.user
- drvCppLib_vs8.vcproj.ADIOSNOTE.Admin.user
- drvCppLib_vs9.vcproj
- drvCppLib_vs9.vcproj.AdiosNote.Adios.user
- drvCppLib_vs9.vcproj.ADIOSNOTE.Admin.user
- except.c
- lib_copy
- _memicmp.obj
- _stricmp.obj
- _strnicm.obj
- atlssup.obj
- chkesp.obj
- chkstk.obj
- conv.lib
- eh.lib
- eh3valid.obj
- enable.obj
- exsup.obj
- exsup2.obj
- exsup3.obj
- info.txt
- inp.obj
- lldiv.obj
- lldvrm.obj
- llmul.obj
- llrem.obj
- llshl.obj
- llshr.obj
- longjmp.obj
- matherr.obj
- memccpy.obj
- memchr.obj
- memcmp.obj
- memcpy.obj
- memmove.obj
- memset.obj
- outp.obj
- rtc.lib
- sehprolg.obj
- sehsupp.obj
- setjmp.obj
- setjmp3.obj
- setjmpex.obj
- strcat.obj
- strchr.obj
- strcmp.obj
- strcspn.obj
- strdup.obj
- strlen.obj
- strncat.obj
- strncmp.obj
- strncpy.obj
- strnset.obj
- strpbrk.obj
- strrchr.obj
- strrev.obj
- strset.obj
- strspn.obj
- strstr.obj
- tlssup.obj
- tran.lib
- ulldiv.obj
- ulldvrm.obj
- ullrem.obj
- ullshr.obj
- libcpp.cpp
- libcpp.h
- MAKEFILE
- new.h
- rtti.cpp
- Sources
- drvCppLibTest
- drvSingleModeTest
- drvUtils
- HideDriver
- HideDriver_vs7.sln
- HideDriver_vs8.sln
- HideDriver_vs9.sln
- HideDriverGUI
- info.txt
- STLPort
- Utils
- UtilsPortable
- UtilsPortableUnitTest
- HideDriver.zip
- HideDriver
|
#include "UserNameFromSIDUtils.h"
#include "drvCommon.h"
#include "StringUtils.h"
#include "KernelHandleGuard.h"
namespace utils
{
/*
There is two ways how to convert SID to UserName using registry.
1) Using RID and UserName
In kernel registry "\\registry\\machine\\sam\\sam\\domains\\account\\users\\names"
Windows store user name in sub key name, in each sub key default value is user RID
RID is last element of SubAuthority.
So need to find sub key with default value equal to RID.
2) Using V-Block parsing
In kernel registry "\\registry\\machine\\sam\\sam\\domains\\account\\users"
Windows store in each sub key, except "names", exist value with name "V"
this is V-Block. V-Block has two important params:
ULONG NameOffsetFromEnd; at offset 0xc from start
ULONG NameSizeInBytes; at offset 0x10 from start
Using this two params SID alsow can be converted to UserName
*/
const wchar_t* namesKeyPath = L"\\registry\\machine\\sam\\sam\\domains\\account\\users\\names";
ULONG GetNameKeyRID(const std::wstring& keyPath)
{
std::vector<char> buffer(256);
ULONG resultLength = NULL;
PVOID keyInformation = &buffer.front();
UNICODE_STRING keyPathUnSt = utils::wstring2UnicodeStr(keyPath);
OBJECT_ATTRIBUTES keyAttr;
InitializeObjectAttributes(&keyAttr, &keyPathUnSt, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
HANDLE hKey;
NTSTATUS status = ZwOpenKey(&hKey,GENERIC_READ,&keyAttr);
if( !NT_SUCCESS(status) )
throw std::exception("-HideDriver- GetNameKeyRID: ZwOpenKey fail.");
HandleGuard guard(hKey);
// RID stores in default value
ULONG index = 0;
status = ZwEnumerateValueKey(hKey,
index,
KeyValueBasicInformation,
keyInformation,
buffer.size(),
&resultLength);
if( !NT_SUCCESS(status) )
throw std::exception("-HideDriver- GetNameKeyRID: ZwEnumerateValueKey fail.");
KEY_VALUE_BASIC_INFORMATION* basicInfo =
(KEY_VALUE_BASIC_INFORMATION*)keyInformation;
// MS developers like store values for SAM in type record instead of value record
return basicInfo->Type;
}
void GetUserNameBySidUseNamesKey(const std::vector<char>& sid,std::wstring* userName)
{
std::wstring keyPath(namesKeyPath);
UNICODE_STRING keyPathUnSt = utils::wstring2UnicodeStr(keyPath);
OBJECT_ATTRIBUTES keyAttr;
InitializeObjectAttributes(&keyAttr, &keyPathUnSt, OBJ_KERNEL_HANDLE | OBJ_CASE_INSENSITIVE, NULL, NULL);
HANDLE hKey;
NTSTATUS status = ZwOpenKey(&hKey,GENERIC_READ,&keyAttr);
if( !NT_SUCCESS(status) )
throw std::exception("-HideDriver- GetUserNameBySidUseNamesKey: ZwOpenKey fail.");
HandleGuard guard(hKey);
SID* pSid = (SID*)&sid.front();
// RID is last element of SubAuthority
ULONG ridIndex = pSid->SubAuthorityCount - 1;
ULONG RID = pSid->SubAuthority[ridIndex];
if(RID == 0x12)
{
// RID of system account always 0x12
*userName = L"System";
return;
}
std::vector<char> buffer(1024);
for(ULONG index = 0 ; ; ++index )
{
ULONG resultLength = NULL;
PVOID keyInformation = &buffer.front();
NTSTATUS status =
ZwEnumerateKey(hKey,
index,
KeyBasicInformation,
keyInformation,
buffer.size(),
&resultLength);
if(status == STATUS_NO_MORE_ENTRIES)
break;
if( !NT_SUCCESS(status) )
throw std::exception("-HideDriver- GetUserNameBySidUseNamesKey: ZwEnumerateValueKey fail.");
KEY_BASIC_INFORMATION* keyInfo =
(KEY_BASIC_INFORMATION*)keyInformation;
std::wstring subKeyName(keyInfo->Name,keyInfo->NameLength/2);
std::wstring subKeyPath = keyPath + L'\\' + subKeyName;
ULONG keyRID = GetNameKeyRID(subKeyPath);
if(keyRID != RID)
continue;
// Sub key name is user name
*userName = subKeyName;
return;
}
throw std::exception("-HideDriver- GetUserNameBySidUseNamesKey: Can't find user name for SID.");
}
////////////////////////////////////////////////////////////////////////////////////////////////////
const wchar_t* pathToSubKeysWithVBlock = L"\\registry\\machine\\sam\\sam\\domains\\account\\users\\names";
struct VBlock
{
ULONG Unknown[3];
ULONG NameOffsetFromEnd; //0xc
ULONG NameSizeInBytes; //0x10
ULONG Unknown2[46];
};
char* static_asser[sizeof(VBlock) == 0xcc];
void GetUserNameBySidUseVBlock(const std::vector<char>& sid,std::wstring* userNam)
{
throw std::exception("GetUserNameBySidUseVBlock - is not implemented yet.");
}
}
|
By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.
If a file you wish to view isn't highlighted, and is a text file (not binary), please
let us know and we'll add colourisation support for it.
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.
As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.
Our specialty is reverse engineering, we apply it for security testing and security-related projects.
A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.
Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.
Sergey Popenko.
22 years old.
The Driver Team`s software developer.
Master of the Applied Math faculty, the Dnipropetrovsk National University, Ukraine.