offline
- bobby
- Administrator
- Pridružio: 04 Sep 2003
- Poruke: 24135
- Gde živiš: Wien
|
To je ta grupa konstanti, hvala puno, isprobacu sutra (ili veceras ako mi zenica da dozvolu da visim kraj kompa do 4 ujutru  )
Javljam rezultate.
Dopuna: 06 Jan 2007 23:27
Srki, da mi je sada onaj link na kojem one zivuljke kazu milion puta "Thank You"...
Poljubio bih te da mogu (ali necu posto si neobrijan na avataru)
@all (kojima ikada zatreba)
Sledi source code za anti-delete DLL.
Potreban je MadshiCodeHook za Delphi da bi se ovo iskompajliralo:
http://madshi.net/
kao i prevedeni headeri iz Win SDK (DDK), koje je malo teze naci.
library WatcherHook;
{$IMAGEBASE $5a000000}
{Copyrigth: Boban Spasic
Credits: Srki82 and madshi}
uses
Windows,
Native,
JwaWinType,
JwaWinBase,
madCodeHook,
madStrings;
var
NtOpenFileNext : function (FileHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIO_STATUS_BLOCK; ShareAccess: ULONG; OpenOptions: ULONG): NTSTATUS; stdcall;
NtCreateFileNext: function (FileHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIO_STATUS_BLOCK; AllocationSize: PLARGE_INTEGER; FileAttributes: ULONG; ShareAccess: ULONG; CreateDisposition: ULONG; CreateOptions: ULONG; EaBuffer: PVOID; EaLength: ULONG): NTSTATUS; stdcall;
NtDeleteFileNext: function (ObjectAttributes: POBJECT_ATTRIBUTES): NTSTATUS; stdcall;
NtSetInformationFileNext: function (FileHandle: HANDLE; IoStatusBlock: PIO_STATUS_BLOCK; FileInformation: PVOID; FileInformationLength: ULONG; FileInformationClass: FILE_INFORMATION_CLASS): NTSTATUS; stdcall;
function NtOpenFileCallback(FileHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIO_STATUS_BLOCK; ShareAccess: ULONG; OpenOptions: ULONG): NTSTATUS; stdcall;
begin
if ((OpenOptions and $00001000) <> 0) then OpenOptions := OpenOptions and not $00001000;
Result := NtOpenFileNext(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
end;
function NtCreateFileCallback(FileHandle: PHANDLE; DesiredAccess: ACCESS_MASK; ObjectAttributes: POBJECT_ATTRIBUTES; IoStatusBlock: PIO_STATUS_BLOCK; AllocationSize: PLARGE_INTEGER; FileAttributes: ULONG; ShareAccess: ULONG; CreateDisposition: ULONG; CreateOptions: ULONG; EaBuffer: PVOID; EaLength: ULONG): NTSTATUS; stdcall;
begin
if ((CreateOptions and $00001000) <> 0) then CreateOptions := CreateOptions and not $00001000;
Result := NtCreateFileNext(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, AllocationSize, FileAttributes, ShareAccess, CreateDisposition, CreateOptions, EaBuffer, EaLength);
end;
function NtDeleteFileCallback(ObjectAttributes: POBJECT_ATTRIBUTES): NTSTATUS; stdcall;
begin
Result := 0;
end;
function NtSetInformationFileCallback(FileHandle: HANDLE; IoStatusBlock: PIO_STATUS_BLOCK; FileInformation: PVOID; FileInformationLength: ULONG; FileInformationClass: FILE_INFORMATION_CLASS): NTSTATUS; stdcall;
begin
if FileInformationClass = FileDispositionInformation then Result := 0
else Result := NtSetInformationFileNext(FileHandle, IoStatusBlock, FileInformation, FileInformationLength, FileInformationClass);
end;
begin
CollectHooks;
HookAPI('ntdll.dll', 'NtOpenFile', @NtOpenFileCallback, @NtOpenFileNext);
HookAPI('ntdll.dll', 'NtCreateFile', @NtCreateFileCallback, @NtCreateFileNext);
HookAPI('ntdll.dll', 'NtDeleteFile', @NtDeleteFileCallback, @NtDeleteFileNext);
HookAPI('ntdll.dll', 'NtSetInformationFile', @NtSetInformationFileCallback, @NtSetInformationFileNext);
FlushHooks;
end.
Ukoliko se ovaj DLL injectuje System wide, ni jedan program na sistemu ne moze da obrise ni jedan jedini fajl. Prebacivanje fajla u Recycle Bin se ne racuna, posto to ne spada pod brisanje.
Meni ovo konkretno znaci da cu moci da raspakujem sve moguce vrste instalera, arhivera, exe-pakera i embeded fajlova.
Kako?
E to vec necu da vam kazem
Dopuna: 07 Jan 2007 16:00
Uf, nije bas sve kako treba... 
Nastaje sledeci problem:
- program je napravio temp fajl i postavio FILE_DELETE_ON_CLOSE flag
- pri zatvaranju fajla program ocekuje da je to ime (recimo ~DF001.tmp) slobodno
- pokusava da kreira drugi fajl pod istim imenom
- BSOD
Nije mi jasno zasto BSOD, zar ne bi trebao neki Access Denied ili bilo sta drugo?
Kontam da treba uraditi sledece:
- zapamtiti Handle koji je program dobio za temp fajl
- kada bude pozvan neki CloseHandle (jos ne znam tacno ime funkcije) da preimenujem fajl ili da ga negde prebacim
- da moj DLL obrise temp fajl tako da ime bude slobodno
Ima li neko tacnu ideju sta treba uraditi?
Meni je problem sto nisam siguran kako i sta treba uraditi s obzirom da postoje vise instanci ovog DLL-a, tj. na sta treba da obratim paznju da ne bi bilo interferenci izmedju instanci.
Dopuna: 07 Jan 2007 21:25
Hmmm... ovo zadnje gore nisam vise mogao da ponovim... izgleda da nije to sto sam mislio da jeste.
Sada imam drugu muku:
- program napravi tmp fajl i u njega iskopira neki sadrzaj
- ne brise fajl
- postavi Length := 0 i u njega upise drugi sadrzaj
Treba sada da vidim kako da hooknem onaj momenat kada "prazni" temp fajl, pa da iskopiram sadrzaj pre toga.
|
