浅析syscall

#include <Windows.h> 
#include <iostream>
int main() {  
  STARTUPINFO            sinfo;    
  PROCESS_INFORMATION    pinfo;    
  memset(&sinfo, 0, sizeof(STARTUPINFO));    
  memset(&pinfo, 0, sizeof(PROCESS_INFORMATION));    
  sinfo.dwFlags = STARTF_USESHOWWINDOW;    s
  info.wShowWindow = SW_SHOWMAXIMIZED;   
   BOOL bSucess = CreateProcess(L"C:\\Windows\\notepad.exe", NULL, NULL, NULL, FALSE, CREATE_DEFAULT_ERROR_MODE, NULL, NULL, &sinfo, &pinfo);    
   std::cout << "Hello World!\n"; 
   }

 if (correct_bytes[0] == assemblyBytes[0] && correct_bytes[1] == assemblyBytes[1] && correct_bytes[2] == assemblyBytes[2] && correct_bytes[3] == assemblyBytes[3])            {                printf( "\t[*]%s has NOT been hooked!\n", szExportedFunctionName );                nClean++;            }            else            {                printf("\t[*] %s HAS been hooked!\n", szExportedFunctionName);                printf("\t\t");             }

OpenProcess() [Kernel32] -> OpenProcess() [Kernelbase] -> NtOpenProcess() [Ntdll] -> Direct syscall to the kernel -> | Kernel Mode |

0x4c 0x8b 0xd1 0xb8 0xZZ 0xZZ 0x00 0x00

typedef struct _LIST_ENTRY {   struct _LIST_ENTRY *Flink;   struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;

typedef struct _LDR_DATA_TABLE_ENTRY {    PVOID Reserved1[2];    LIST_ENTRY InMemoryOrderLinks;    PVOID Reserved2[2];    PVOID DllBase; // Base address of the module in memory     PVOID EntryPoint;    PVOID Reserved3;    UNICODE_STRING FullDllName; // Full path + name of the dll    BYTE Reserved4[8];    PVOID Reserved5[3];    union {        ULONG CheckSum;        PVOID Reserved6;    };    ULONG TimeDateStamp; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY;

typedef struct _IMAGE_EXPORT_DIRECTORY {                  DWORD   Characteristics;                DWORD   TimeDateStamp;                    WORD    MajorVersion;                 WORD    MinorVersion;                 DWORD   Name;                   // The name of the Dll    DWORD   Base;                   // Number to add to the values found in AddressOfNameOrdinals to retrieve the "real" Ordinal number of the function (by real I mean used to call it by ordinals).    DWORD   NumberOfFunctions;      // Number of all exported functions          DWORD   NumberOfNames;          // Number of functions exported by name          DWORD   AddressOfFunctions;     // Export Address Table. Address of the functions addresses array.       DWORD   AddressOfNames;         // Export Name table. Address of the functions names array.            DWORD   AddressOfNameOrdinals;  // Export sequence number table.  Address of the Ordinals (minus the value of Base) array.             } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;

for (size_t i = 0; i < export_dir->NumberOfNames; i++) {    function_name = reinterpret_cast<const char *>(ntdll_base + names_table[i]);
    // If the name of the function start with "Nt" and don't start with "Ntdll"    // we retrieve the info    if (function_name.rfind("Nt", 0) == 0 && function_name.rfind("Ntdll", 0) == std::string::npos) {      stub_ordinal = names_ordinals_table[i];      stub_address = ntdll_base + functions_table[stub_ordinal];            // We put the RVA as a key and the function name as the value.      // This is a sorted map.      // The elements are automatically sorted using the key value.      // This means that when all the Nt function will be loaded,       // the first element will be the Nt function with the lowest address       // and the last the one with the biggest address.      stub_map.insert({stub_address, function_name});    }  }
  // `stub_map` is ordered from lowest to highest using the stub address. Syscalls numbers are  // assigned using this ordering too. The lowest stub address will be the stub with the lowest  // syscall number (0 in this case). We just need to iterate `stub_map` and iterate the syscall  // number on every iteration.
  static inline void ExtractSyscallsNumbers() noexcept {    uint32_t syscall_no = 0;    // The stub_map filled previously in the code presented above    for (const auto &pair: stub_map)  {      //Creation of a map associating function name and syscall identifier.      syscall_map.insert({pair.second, syscall_no});      syscall_no++;    }  };

  DWORD i = 0;
  /*
  //For info. It's in the header file.
  typedef struct _SW2_SYSCALL_ENTRY
  {
    DWORD Hash;
    DWORD Address;
  } SW2_SYSCALL_ENTRY, *PSW2_SYSCALL_ENTRY;
  
  #define SW2_MAX_ENTRIES 500
  */
  
    PSW2_SYSCALL_ENTRY Entries = SW2_SyscallList.Entries;
    do
    {
        // Retrieve function name from the Dll.
        PCHAR FunctionName = SW2_RVA2VA(PCHAR, DllBase, Names[NumberOfNames - 1]);

        // Check if the function name starts with "Zw"
        if (*(USHORT*)FunctionName == 'wZ')
        {
      // If yes, hash the name (for AV/EDR/Malware Analyst evasion reasons) and put it in an Entries element
            Entries[i].Hash = SW2_HashSyscall(FunctionName);
      // Put also the address of the function
            Entries[i].Address = Functions[Ordinals[NumberOfNames - 1]];

            i++;
            if (i == SW2_MAX_ENTRIES) break;
        }
    } while (--NumberOfNames);

    // Save total number of system calls found.
    SW2_SyscallList.Count = i;

    // Sort the list by address in ascending order.
    for (i = 0; i < SW2_SyscallList.Count - 1; i++)
    {
        for (DWORD j = 0; j < SW2_SyscallList.Count - i - 1; j++)
        {
            if (Entries[j].Address > Entries[j + 1].Address)
            {
                // Swap entries.
                SW2_SYSCALL_ENTRY TempEntry;

                TempEntry.Hash = Entries[j].Hash;
                TempEntry.Address = Entries[j].Address;

                Entries[j].Hash = Entries[j + 1].Hash;
                Entries[j].Address = Entries[j + 1].Address;

                Entries[j + 1].Hash = TempEntry.Hash;
                Entries[j + 1].Address = TempEntry.Address;
            }
        }
    }

    return TRUE;
}

BOOL InitSyscallsFromLdrpThunkSignature()
{
    PPEB Peb = (PPEB)__readgsqword(0x60);
    PPEB_LDR_DATA Ldr = Peb->Ldr;
    PLDR_DATA_TABLE_ENTRY NtdllLdrEntry = NULL;

    for (PLDR_DATA_TABLE_ENTRY LdrEntry = (PLDR_DATA_TABLE_ENTRY)Ldr->InLoadOrderModuleList.Flink;
        LdrEntry->DllBase != NULL;
        LdrEntry = (PLDR_DATA_TABLE_ENTRY)LdrEntry->InLoadOrderLinks.Flink)
    {
        if (_wcsnicmp(LdrEntry->BaseDllName.Buffer, L"ntdll.dll", 9) == 0)
        {
            // got ntdll
            NtdllLdrEntry = LdrEntry;
            break;
        }
    }

    if (NtdllLdrEntry == NULL)
    {
        return FALSE;
    }

    PIMAGE_NT_HEADERS ImageNtHeaders = (PIMAGE_NT_HEADERS)((ULONG_PTR)NtdllLdrEntry->DllBase + ((PIMAGE_DOS_HEADER)NtdllLdrEntry->DllBase)->e_lfanew);
    PIMAGE_SECTION_HEADER SectionHeader = (PIMAGE_SECTION_HEADER)((ULONG_PTR)&ImageNtHeaders->OptionalHeader + ImageNtHeaders->FileHeader.SizeOfOptionalHeader);

    ULONG_PTR DataSectionAddress = NULL;
    DWORD DataSectionSize;

    for (WORD i = 0; i < ImageNtHeaders->FileHeader.NumberOfSections; i++)
    {
        if (!strcmp((char*)SectionHeader[i].Name, ".data"))
        {
            DataSectionAddress = (ULONG_PTR)NtdllLdrEntry->DllBase + SectionHeader[i].VirtualAddress;
            DataSectionSize = SectionHeader[i].Misc.VirtualSize;
            break;
        }
    }

    DWORD dwSyscallNo_NtOpenFile = 0, dwSyscallNo_NtCreateSection = 0, dwSyscallNo_NtMapViewOfSection = 0;

    if (!DataSectionAddress || DataSectionSize < 16 * 5)
    {
        return FALSE;
    }

    for (UINT uiOffset = 0; uiOffset < DataSectionSize - (16 * 5); uiOffset++)
    {
        if (*(DWORD*)(DataSectionAddress + uiOffset) == 0xb8d18b4c &&
            *(DWORD*)(DataSectionAddress + uiOffset + 16) == 0xb8d18b4c &&
            *(DWORD*)(DataSectionAddress + uiOffset + 32) == 0xb8d18b4c &&
            *(DWORD*)(DataSectionAddress + uiOffset + 48) == 0xb8d18b4c &&
            *(DWORD*)(DataSectionAddress + uiOffset + 64) == 0xb8d18b4c)
        {
            dwSyscallNo_NtOpenFile = *(DWORD*)(DataSectionAddress + uiOffset + 4);
            dwSyscallNo_NtCreateSection = *(DWORD*)(DataSectionAddress + uiOffset + 16 + 4);
            dwSyscallNo_NtMapViewOfSection = *(DWORD*)(DataSectionAddress + uiOffset + 64 + 4);
            break;
        }
    }

    if (!dwSyscallNo_NtOpenFile)
    {
        return FALSE;
    }

    ULONG_PTR SyscallRegion = (ULONG_PTR)VirtualAlloc(NULL, 3 * MAX_SYSCALL_STUB_SIZE, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

    if (!SyscallRegion)
    {
        return FALSE;
    }

    NtOpenFile = (FUNC_NTOPENFILE)BuildSyscallStub(SyscallRegion, dwSyscallNo_NtOpenFile);
    NtCreateSection = (FUNC_NTCREATESECTION)BuildSyscallStub(SyscallRegion + MAX_SYSCALL_STUB_SIZE, dwSyscallNo_NtCreateSection);
    NtMapViewOfSection = (FUNC_NTMAPVIEWOFSECTION)BuildSyscallStub(SyscallRegion + (2* MAX_SYSCALL_STUB_SIZE), dwSyscallNo_NtMapViewOfSection);

    return TRUE;
}

DB 77h ; 'H' DB 0h  ; 'e' DB 0h  ; 'l' DB 74h ; 'l' DB 0h  ; 'o'