Click here to Skip to main content
15,893,588 members
Articles / Programming Languages / C++

Detect Driver

,
Rate me:
Please Sign up or sign in to vote.
5.00/5 (46 votes)
10 Mar 2010CPOL12 min read 110.4K   9.1K   155  
This article is the continue of the previously posted article Hide Driver. Some methods to detect hidden files and processes are described in it
#include "drvCommon.h"

#include "ProcNativeApiWork.h"
#include "WorkItemUtils.h"
#include "ServiceTableUtils.h"
#include "StringUtils.h"

#include <string>

extern "C"
{
typedef NTSTATUS (*NtQuerySystemInfoPtr)(
	IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
	IN OUT PVOID SystemInformation,
	IN ULONG SystemInformationLength,
	OUT PULONG ReturnLength OPTIONAL
	);
}// extern "C"

namespace DetectDriver
{
const wchar_t* strZwQuerySystemInfo = L"ZwQuerySystemInformation";
const wchar_t* strNtQuerySystemInfo = L"NtQuerySystemInformation";

void GetZwQuerySysInfoPointers(PVOID* sstPtr,PVOID* fncPtr)
{
	std::wstring functionNameZw(strZwQuerySystemInfo);
	UNICODE_STRING functionNameZwUnc = utils::wstring2UnicodeStr(functionNameZw); 

	std::wstring functionNameNt(strNtQuerySystemInfo);
	UNICODE_STRING functionNameNtUnc = utils::wstring2UnicodeStr(functionNameNt); 
	
	*sstPtr = utils::GetFunctionSSTPtr(&functionNameZwUnc);
	*fncPtr = MmGetSystemRoutineAddress(&functionNameNtUnc);

	if( *fncPtr == NULL )
		throw std::exception("Can't get system routine address");
}

void GetProcListsImpl(NtQuerySystemInfoPtr originalFnc,
					  NtQuerySystemInfoPtr hookedFnc,
					  std::vector<char>* originalListBuffer,
					  std::vector<char>* hookListBuffer)
{
	ULONG retLength;
	NTSTATUS status;

	// Request needed size
	ULONG originalDataSize;
	status = originalFnc(SystemProcessesAndThreadsInformation,NULL,0,&originalDataSize);
	if( status != STATUS_INFO_LENGTH_MISMATCH )
		throw std::exception("Can't get original process info data size.");

	ULONG hookedDataSize;
	status = hookedFnc(SystemProcessesAndThreadsInformation,NULL,0,&hookedDataSize);
	if( status != STATUS_INFO_LENGTH_MISMATCH )
		throw std::exception("Can't get hooked process info data size.");

	// Resize buffers
	hookListBuffer->resize(hookedDataSize);
	originalListBuffer->resize(originalDataSize);

	// Request information
	status = originalFnc(SystemProcessesAndThreadsInformation,
		&originalListBuffer->front(),originalListBuffer->size(),&retLength);
	if( !NT_SUCCESS(status) )
		throw std::exception("Can't get process info by original function.");
	
	status = hookedFnc(SystemProcessesAndThreadsInformation,
					   &hookListBuffer->front(),hookListBuffer->size(),&retLength);
	if( !NT_SUCCESS(status) )
		throw std::exception("Can't get process info by hooked function.");
}

struct GetProcListParams
{
	NtQuerySystemInfoPtr originalFnc;
	NtQuerySystemInfoPtr hookedFnc;
	std::vector<char>* originalListBuffer;
	std::vector<char>* hookListBuffer;
};

void GetProcListsProxy(GetProcListParams* params)
{
	GetProcListsImpl(params->originalFnc,
					 params->hookedFnc,
					 params->originalListBuffer,
					 params->hookListBuffer);
}

void GetProcLists(NtQuerySystemInfoPtr originalFnc,
				  NtQuerySystemInfoPtr hookedFnc,
				  std::vector<char>* originalListBuffer,
				  std::vector<char>* hookListBuffer)
{
	GetProcListParams params = {originalFnc,
								hookedFnc,
								originalListBuffer,
								hookListBuffer};

	utils::CallFromWorkerThread(&GetProcListsProxy,&params);
}

void GetProcessInfo(std::vector<char> *hookListBuffer,
					std::vector<char> *originalListBuffer)
{
	PVOID hookedFncPtr,originalFncPtr;
	GetZwQuerySysInfoPointers(&hookedFncPtr,&originalFncPtr);
	if(hookedFncPtr == originalFncPtr)
		throw std::exception("No hooks detected.");

	NtQuerySystemInfoPtr hookedFnc   = (NtQuerySystemInfoPtr)hookedFncPtr;
	NtQuerySystemInfoPtr originalFnc = (NtQuerySystemInfoPtr)originalFncPtr;

	GetProcLists(originalFnc,hookedFnc,originalListBuffer,hookListBuffer);
}

}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer Apriorit Inc.
United States United States
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This is a Organisation

33 members

Written By
Software Developer Codedgers Inc
Ukraine Ukraine
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions