Click here to Skip to main content
15,896,557 members
Articles / Programming Languages / C

Simple SST Unhooker

,
Rate me:
Please Sign up or sign in to vote.
4.92/5 (13 votes)
17 Mar 2010CPOL4 min read 37.5K   1.2K   26  
This article includes a description of a simple unhooker that restores original SST hooked by unknown rootkits, which hide some services and processes.
#ifndef DRV_COMMON_PORTABLE_DEFS_H
#define DRV_COMMON_PORTABLE_DEFS_H


// drvUnhookerDevice
#define DRV_UNHOOKER_DEVICE_TYPE 0x8100

#define DRV_UNHOOKER_UNHOOK CTL_CODE( \
	DRV_UNHOOKER_DEVICE_TYPE,0x08000, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define DRV_UNHOOKER_GET_STATUS CTL_CODE( \
	DRV_UNHOOKER_DEVICE_TYPE,0x08001, METHOD_BUFFERED, FILE_ANY_ACCESS)

#define DRV_UNHOOKER_DEVICE_NAME             L"\\Device\\drvUnhooker"
#define DRV_UNHOOKER_DEVICE_SYMBOLIC_LINK    L"\\??\\drvUnhooker"
#define DRV_UNHOOKER_USERMODE_SYMBOLIC_LINK  L"\\\\.\\drvUnhooker"

#define SERVICE_NAME      L"drvUnhooker"
#define DRIVER_FILENAME   L"drvUnhooker.sys"

#pragma pack(push, 1)

typedef struct _DRV_REPORT
{
    __int32 m_countOfModifiedEntries;
    __int32 m_countOfReportEntries;
    __int32 m_reportEntryOffsets;
    __int32 m_sizeOfReportEntry;
}DRV_REPORT;

typedef struct _DRV_REPORT_ENTRY
{
    __int32  m_sizeOfEntry;
    unsigned __int64 m_moduleAddress;
    unsigned __int64 m_newAddress;
    __int32  m_nameOffset;
    __int32  m_nameSize;
    __int32  m_sstIndex;
}DRV_REPORT_ENTRY;

#pragma pack(pop)

#endif

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Chief Technology Officer Apriorit Inc.
United States United States
ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit
This is a Organisation

33 members

Written By
Ukraine Ukraine
This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions