Anti StrongOD Kernel Mode

/**************************************
/* 作者:半斤八兩
/* 博客:http://cnblogs.com/bjblcracked
/* 日期:2013-12-11  00:00
/**************************************

只是感兴趣，没有其他目的。失误之处敬请诸位大侠赐教!


  相信大家都有用过海风前辈写的strongod反反调试插件.用起来是十分方便的. strongod 是属于驱动级别的插件, 如果是我们自己写的应用层软件,如何来对付strongod呢? 

在strongod早些版本的时候,我们是可以通过符号链接来做检测的.早些版本符号链接是写死的.

名为 fengyue .但是到后来,符号链接,弄成自定义的了,缺省的,还是不变的. 大多数人都会通过strongod的ini配置文件来修改缺省的名字. 

它的INI配置是直接写入OD 的 ollydbg.ini 里面. 打开ollydbg.ini 直接搜索 strongod 就能搜到如下内容, 

[Plugin StrongOD]
CreateProcessMode=0
HidePEB=1
IsPatchFloat=1
IsAdvGoto=1
KernelMode=1
KillPEBug=1
SuperEnumMod=1
AdvAttach=1
SkipExpection=1
HideWindow=1
HideProcess=1
ProtectProcess=1
DriverKey=-82693034
DriverName=fengyue
OrdFirst=0
BreakOnLdr=0
BreakOnTls=0
RemoveEpOneShot=1
ShowBar=17
LoadSym=1
AutoUpdate=0
UpdateURL=http://sod.ibt.name/update.txt

其中 DriverName=fengyue 就是我们关心的. 虽然现在符号连接是"随机的" 但是我们还是有办法获取真实的符号链接名~ 具体的看源码吧. 

DWORD IsEnumProcess()
{
    DWORD dwPidTemp = 0;
    
    HANDLE procSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if(procSnap == INVALID_HANDLE_VALUE)
    {
        return -1;
    }
    
    PROCESSENTRY32 procEntry = {0};
    
    procEntry.dwSize = sizeof(PROCESSENTRY32);
    
    BOOL bRet = Process32First(procSnap,&procEntry);
    
    while(bRet)
    {
        if(0 == strcmp(procEntry.szExeFile, "csrss.exe"))
        {
            dwPidTemp = procEntry.th32ProcessID;
            return TRUE;
        }
        
        bRet = Process32Next(procSnap, &procEntry);
    }
    
    CloseHandle(procSnap);
    
    return dwPidTemp;
}


BOOL CCheckStrongOD::IsDebugSymbolicLink()
{
    UNICODE_STRING     strDirName;
    OBJECT_ATTRIBUTES  oba;
    NTSTATUS           ntStatus; 
    HANDLE             hDirectory;
    
    RtlInitUnicodeString(&strDirName, L"\global??");
    InitializeObjectAttributes(&oba, &strDirName, OBJ_CASE_INSENSITIVE, NULL, NULL);
    
    ntStatus = ZwOpenDirectoryObject(&hDirectory, DIRECTORY_QUERY, &oba);

    if (ntStatus != STATUS_SUCCESS)
    {
        if (hDirectory != NULL)
        {
            ZwClose(hDirectory);
        }
        
        return NULL;
    }
    
    UNICODE_STRING symbolicLink;
    BYTE           buffer[2048] = {0};
    ULONG          ulLength  = 2048;
    ULONG          ulContext = 0;
    ULONG          ulRet     = 0;

    RtlInitUnicodeString(&symbolicLink, L"SymbolicLink");
    
    tagSTRONGOD tagStrongOD = {0};
    
    tagStrongOD.m_dwFlag = 123456789;
    tagStrongOD.m_dwCressPID = IsEnumProcess();
    tagStrongOD.m_wMePid = (WORD)GetCurrentProcessId();

    do{
        ntStatus = ZwQueryDirectoryObject(hDirectory, buffer, ulLength,
            TRUE, FALSE, &ulContext, &ulRet);

        if ((ntStatus != STATUS_SUCCESS) && (ntStatus != STATUS_NO_MORE_ENTRIES))
        {
            if (hDirectory != NULL)
            {
                ZwClose(hDirectory);
            }
        }
        else if (STATUS_NO_MORE_ENTRIES == ntStatus)
        {
            if (hDirectory != NULL)
            {
                ZwClose(hDirectory);
            }
            
            return NULL;
        }

        PDIRECTORY_BASIC_INFORMATION  directoryInfo = (PDIRECTORY_BASIC_INFORMATION)buffer;
       
        WCHAR szSymbolicLink[MAXBYTE] = L"\\.\";
        wcscat(szSymbolicLink, directoryInfo->ObjectName.Buffer);

        int nLen = wcslen(szSymbolicLink);

        if(nLen > 0xc)
        {
            continue;
        }

        BYTE szControlCode1[MAXBYTE] = {0};
        DWORD dwBytesReturned = 0;

        HANDLE hFile = 
            CreateFileW(szSymbolicLink, GENERIC_READ|GENERIC_WRITE,
            FILE_SHARE_READ|FILE_SHARE_WRITE,
            NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);

        if(hFile != (HANDLE)-1)
        {

        }
        else
        {
            continue;
        }

        *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;
        *(PDWORD)&szControlCode1[4] = tagStrongOD.m_dwCressPID;
        *(PDWORD)&szControlCode1[8] = 1;
        *(PDWORD)&szControlCode1[0xc] = 1;
        *(PDWORD)&szControlCode1[0x10] = 1;
        *(PDWORD)&szControlCode1[0x14] = 1;
        *(PDWORD)&szControlCode1[0x18] = 1;
        *(PDWORD)&szControlCode1[0x1c] = 0;
        *(PWORD)&szControlCode1[0x20] = tagStrongOD.m_wMePid;
        *(PWORD)&szControlCode1[0x22] = 0;

        BYTE szControlCode2[0x24] = {
            0x42, 0xa3, 0x53, 0x04, 0x4D, 0x4B, 0xA3, 0xC4, 0xEC, 0xF8, 
            0xE5, 0x41, 0x9D, 0xEF, 0xAE, 0x46, 0x95, 0x59, 0x7D, 0xF3, 
            0x98, 0xBD, 0xDC, 0xD4, 0x1F, 0xE9, 0xC1, 0xD9, 0xFB, 0xF1, 
            0xE9, 0x8D, 0x85, 0x0B, 0x7B, 0x14};


        BYTE szOutBuffer[0x4] = {0xff, 0xff, 0xff, 0xff};

        for(int i = 0; i < 0x24; i++)
        {
            szControlCode1[i] ^= szControlCode2[i];
        }


        if(TRUE == DeviceIoControl(hFile, 0x22215c, 
            szControlCode2, 0x24, NULL, 0, &dwBytesReturned, NULL))
        {

        }
        else
        {
            CloseHandle(hFile);
            continue;
        }

        *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;
        *(PDWORD)&szControlCode1[4] = 0;
        *(PDWORD)&szControlCode1[8] = 0;
        *(PDWORD)&szControlCode1[0xc] = 0;
        *(PDWORD)&szControlCode1[0x10] = 0;
        *(PDWORD)&szControlCode1[0x14] = 0;
        *(PDWORD)&szControlCode1[0x18] = 0;
        *(PDWORD)&szControlCode1[0x1c] = 0;
        *(PWORD)&szControlCode1[0x20] = 0;
        *(PWORD)&szControlCode1[0x22] = 0;


        for(i = 0; i < 0x24; i++)
        {
            szControlCode1[i] ^= szControlCode2[i];
        }

        if(0 == DeviceIoControl(hFile, 0x222178, szControlCode1,
            0x24, NULL, 0, &dwBytesReturned, NULL))
        {
            
        }
        else
        {
            CloseHandle(hFile);
            continue;
        }

        

        *(PDWORD)&szControlCode1[0] = tagStrongOD.m_dwFlag;
        *(PDWORD)&szControlCode1[4] = 0;
        *(PDWORD)&szControlCode1[8] = 0;
        *(PDWORD)&szControlCode1[0xc] = 0;
        *(PDWORD)&szControlCode1[0x10] = 0;
        *(PDWORD)&szControlCode1[0x14] = 0;
        *(PDWORD)&szControlCode1[0x18] = 0;
        *(PDWORD)&szControlCode1[0x1c] = 0;
        *(PWORD)&szControlCode1[0x20] = tagStrongOD.m_wMePid;
        *(PWORD)&szControlCode1[0x22] = 0;


        for(i = 0; i < 0x24; i++)
        {
            szControlCode1[i] ^= szControlCode2[i];
        }



        if(TRUE == DeviceIoControl(hFile, 0x222160, szControlCode2,
            0x24, szOutBuffer, 0x4, &dwBytesReturned, NULL))
        {
//            MessageBox(0, 0, 0, 0);

            _putws(szSymbolicLink);

            return TRUE;
        }
        else
        {
            CloseHandle(hFile);
            continue;
        }

    }while(TRUE);


    if (hDirectory != NULL)
    {
        ZwClose(hDirectory);
    }

    return FALSE;
}


CCheckStrongOD::CCheckStrongOD()
{
    system("chcp 936 & cls & color 0a & title 检测StrongOD Kernel Mode");
}

CCheckStrongOD::~CCheckStrongOD()
{
    system("pause");
}

本文没任何技术含量,只是一个思路~ 抛砖~ 

SRC和BIN下载地址:<<<看雪学院>>>