检测并禁用隐藏服务
//I don''t know the reason why, it work well in linux envoriment.
// read the dumped hive file to fill hive struct.
// return the point
struct hive *My_openHive(char *filename, int mode)
{
HANDLE hFile;
int szread;
struct hive *hdesc;
int vofs;
unsigned long pofs;
char *c;
struct hbin_page *p;
struct regf_header *hdr;
int verbose = (mode & HMODE_VERBOSE);
CREATE(hdesc,struct hive,1);
hdesc->filename = str_dup(filename);
hdesc->state = 0;
hdesc->size = 0;
hdesc->buffer = NULL;
hFile = CreateFile(hdesc->filename,
GENERIC_READ, // open for reading
0, // do not share
NULL, // no security
OPEN_ALWAYS, // existing file only
FILE_ATTRIBUTE_NORMAL, // normal file
NULL); // no attr. template
if (hFile == INVALID_HANDLE_VALUE)
{
printf("Could not open hive file."); // process error
return 0;
}
/* Read the whole file */
hdesc->size = GetFileSize(hFile, NULL);
ALLOC(hdesc->buffer,1,hdesc->size);
ReadFile(hFile, (void *)hdesc->buffer, hdesc->size, &szread, NULL);
CloseHandle(hFile);
if (szread < hdesc->size) {
printf("Could not read file, got %d bytes while expecting %d\n",
szread, hdesc->size);
My_closeHive(hdesc);
return(NULL);
}
/* Now run through file, tallying all pages */
/* NOTE/KLUDGE: Assume first page starts at offset 0x1000 */
pofs = 0x1000;
hdr = (struct regf_header *)hdesc->buffer;
if (hdr->id != 0x66676572) {
printf("openHive(%s): File does not seem to be a registry hive!\n",filename);
return(hdesc);
}
for (c = hdr->name; *c && (c < hdr->name + 64); c += 2) putchar(*c);
hdesc->rootofs = hdr->ofs_rootkey + 0x1000;
while (pofs < hdesc->size) {
#ifdef LOAD_DEBUG
if (verbose) hexdump(hdesc->buffer,pofs,pofs+0x20,1);
#endif
p = (struct hbin_page *)(hdesc->buffer + pofs);
if (p->id != 0x6E696268) {
printf("Page at 0x%lx is not ''hbin'', assuming file contains garbage at end",pofs);
break;
}
hdesc->pages++;
#ifdef LOAD_DEBUG
if (verbose) printf("\n###### Page at 0x%0lx has size 0x%0lx, next at 0x%0lx ######\n",pofs,p->len_page,p->ofs_next);
#endif
if (p->ofs_next == 0) {
#ifdef LOAD_DEBUG
if (verbose) printf("openhive debug: bailing out.. pagesize zero!\n");
#endif
return(hdesc);
}
#if 0
if (p->len_page != p->ofs_next) {
#ifdef LOAD_DEBUG
if (verbose) printf("openhive debug: len & ofs not same. HASTA!\n");
#endif
exit(0);
}
#endif
vofs = pofs + 0x20; /* Skip page header */
#if 1
while (vofs-pofs < p->ofs_next) {
vofs += parse_block(hdesc,vofs,verbose);
}
#endif
pofs += p->ofs_next;
}
return(hdesc);
}
void My_closeHive(struct hive *hdesc)
{
FREE(hdesc->filename);
FREE(hdesc->buffer);
FREE(hdesc);
}
int My_writeHive(struct hive *hdesc)
{
HANDLE hFile;
DWORD dwBytesWritten;
hFile = CreateFile("C:\\tmp2.hiv",
GENERIC_WRITE, // open for writing
0, // do not share
NULL, // no security
CREATE_ALWAYS, // open or create
FILE_ATTRIBUTE_NORMAL, // normal file
NULL);
if(hFile == INVALID_HANDLE_VALUE)
{ printf("Can''t open dump file");
return 0;
}
WriteFile(hFile, hdesc->buffer, hdesc->size,&dwBytesWritten, NULL);
if(dwBytesWritten != hdesc->size)
{
printf("WriteHive error\n");
}
CloseHandle(hFile);
return 0;
}
void CleanPatterns()
{
int i;
if(pattern!=NULL)
{
for(i = 0; i < pattern_count; i++)
{
if(pattern[i]!=NULL)
free(pattern[i]);
}
free(pattern);
}
}
void GetPatterns()
{
HANDLE hService;
CHAR achKey[MAX_PATH];
DWORD i;
DWORD retCode;
int Nohide = 1;
DWORD SubKeyNum = 0;
pattern_count = 0;
if(RegOpenKeyEx(
HKEY_LOCAL_MACHINE, // handle to open key
"SYSTEM\\ControlSet001\\Services", // subkey name
NULL, // reserved
KEY_ALL_ACCESS,// security access mask
&hService // handle to open key
) != ERROR_SUCCESS)
{
printf("sorry %d\n",GetLastError());
return;
}
RegQueryInfoKey( hService,
NULL,
NULL,
NULL,
&SubKeyNum,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL);
//Before it don''t work well , because i set the wrong premission of HKEY
//KEY_ALL_ACCESS is needed
if(SubKeyNum == 0)
{
printf("SubKey''s Number is NULL, it''s too strange.\n");
return;
}
pattern = malloc(sizeof(char *) * SubKeyNum );
for (i = 0, retCode = ERROR_SUCCESS; retCode == ERROR_SUCCESS; i++)
{
retCode = RegEnumKey(
hService, // handle to key to query
i, // index of subkey to query
achKey, // buffer for subkey name
MAX_PATH // size of subkey name buffer
);
if (retCode == (DWORD)ERROR_SUCCESS)
{
//What i add to get pattern Services Table.
pattern[ pattern_count ] = strdup ( achKey ) ;
pattern_count++;
}
}
CloseHandle(hService);
}
void ShowPathImage(struct hive *hdesc, int nkofs, char *path)
{
void *data;
int len,i,type;
char string[SZ_MAX+1];
type = get_val_type(hdesc, nkofs, path);
if (type == -1) {
printf("No such value <%s>\n",path);
return;
}
len = get_val_len(hdesc, nkofs, path);
if (!len) {
printf("Value <%s> has zero length\n",path);
return;
}
data = (void *)get_val_data(hdesc, nkofs, path, 0);
if (!data) {
printf("Value <%s> references NULL-pointer (bad boy!)\n",path);
abort();
return;
}
switch (type) {
case REG_SZ:
case REG_EXPAND_SZ:
case REG_MULTI_SZ:
cheap_uni2ascii(data,string,len);
for (i = 0; i < (len>>1)-1; i++) {
if (string[i] == 0) string[i] = ''\n'';
if (type == REG_SZ) break;
}
puts(string);
break;
case REG_DWORD:
printf("0x%08x",*(unsigned short *)data);
break;
default:
printf("Don''t know how to handle type yet!\n");
case REG_BINARY:
hexdump((char *)data, 0, len, 1);
}
}
void EnablePriv(LPCTSTR lpName)
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
{ printf("open process error\n");
return;
}
if ( ! LookupPrivilegeValue( NULL, lpName , &sedebugnameValue ) ){
printf("can''t find privilege error\n");
CloseHandle( hToken );
return;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof (tkp), NULL, NULL ) )
{
// read the dumped hive file to fill hive struct.
// return the point
struct hive *My_openHive(char *filename, int mode)
{
HANDLE hFile;
int szread;
struct hive *hdesc;
int vofs;
unsigned long pofs;
char *c;
struct hbin_page *p;
struct regf_header *hdr;
int verbose = (mode & HMODE_VERBOSE);
CREATE(hdesc,struct hive,1);
hdesc->filename = str_dup(filename);
hdesc->state = 0;
hdesc->size = 0;
hdesc->buffer = NULL;
hFile = CreateFile(hdesc->filename,
GENERIC_READ, // open for reading
0, // do not share
NULL, // no security
OPEN_ALWAYS, // existing file only
FILE_ATTRIBUTE_NORMAL, // normal file
NULL); // no attr. template
if (hFile == INVALID_HANDLE_VALUE)
{
printf("Could not open hive file."); // process error
return 0;
}
/* Read the whole file */
hdesc->size = GetFileSize(hFile, NULL);
ALLOC(hdesc->buffer,1,hdesc->size);
ReadFile(hFile, (void *)hdesc->buffer, hdesc->size, &szread, NULL);
CloseHandle(hFile);
if (szread < hdesc->size) {
printf("Could not read file, got %d bytes while expecting %d\n",
szread, hdesc->size);
My_closeHive(hdesc);
return(NULL);
}
/* Now run through file, tallying all pages */
/* NOTE/KLUDGE: Assume first page starts at offset 0x1000 */
pofs = 0x1000;
hdr = (struct regf_header *)hdesc->buffer;
if (hdr->id != 0x66676572) {
printf("openHive(%s): File does not seem to be a registry hive!\n",filename);
return(hdesc);
}
for (c = hdr->name; *c && (c < hdr->name + 64); c += 2) putchar(*c);
hdesc->rootofs = hdr->ofs_rootkey + 0x1000;
while (pofs < hdesc->size) {
#ifdef LOAD_DEBUG
if (verbose) hexdump(hdesc->buffer,pofs,pofs+0x20,1);
#endif
p = (struct hbin_page *)(hdesc->buffer + pofs);
if (p->id != 0x6E696268) {
printf("Page at 0x%lx is not ''hbin'', assuming file contains garbage at end",pofs);
break;
}
hdesc->pages++;
#ifdef LOAD_DEBUG
if (verbose) printf("\n###### Page at 0x%0lx has size 0x%0lx, next at 0x%0lx ######\n",pofs,p->len_page,p->ofs_next);
#endif
if (p->ofs_next == 0) {
#ifdef LOAD_DEBUG
if (verbose) printf("openhive debug: bailing out.. pagesize zero!\n");
#endif
return(hdesc);
}
#if 0
if (p->len_page != p->ofs_next) {
#ifdef LOAD_DEBUG
if (verbose) printf("openhive debug: len & ofs not same. HASTA!\n");
#endif
exit(0);
}
#endif
vofs = pofs + 0x20; /* Skip page header */
#if 1
while (vofs-pofs < p->ofs_next) {
vofs += parse_block(hdesc,vofs,verbose);
}
#endif
pofs += p->ofs_next;
}
return(hdesc);
}
void My_closeHive(struct hive *hdesc)
{
FREE(hdesc->filename);
FREE(hdesc->buffer);
FREE(hdesc);
}
int My_writeHive(struct hive *hdesc)
{
HANDLE hFile;
DWORD dwBytesWritten;
hFile = CreateFile("C:\\tmp2.hiv",
GENERIC_WRITE, // open for writing
0, // do not share
NULL, // no security
CREATE_ALWAYS, // open or create
FILE_ATTRIBUTE_NORMAL, // normal file
NULL);
if(hFile == INVALID_HANDLE_VALUE)
{ printf("Can''t open dump file");
return 0;
}
WriteFile(hFile, hdesc->buffer, hdesc->size,&dwBytesWritten, NULL);
if(dwBytesWritten != hdesc->size)
{
printf("WriteHive error\n");
}
CloseHandle(hFile);
return 0;
}
void CleanPatterns()
{
int i;
if(pattern!=NULL)
{
for(i = 0; i < pattern_count; i++)
{
if(pattern[i]!=NULL)
free(pattern[i]);
}
free(pattern);
}
}
void GetPatterns()
{
HANDLE hService;
CHAR achKey[MAX_PATH];
DWORD i;
DWORD retCode;
int Nohide = 1;
DWORD SubKeyNum = 0;
pattern_count = 0;
if(RegOpenKeyEx(
HKEY_LOCAL_MACHINE, // handle to open key
"SYSTEM\\ControlSet001\\Services", // subkey name
NULL, // reserved
KEY_ALL_ACCESS,// security access mask
&hService // handle to open key
) != ERROR_SUCCESS)
{
printf("sorry %d\n",GetLastError());
return;
}
RegQueryInfoKey( hService,
NULL,
NULL,
NULL,
&SubKeyNum,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL);
//Before it don''t work well , because i set the wrong premission of HKEY
//KEY_ALL_ACCESS is needed
if(SubKeyNum == 0)
{
printf("SubKey''s Number is NULL, it''s too strange.\n");
return;
}
pattern = malloc(sizeof(char *) * SubKeyNum );
for (i = 0, retCode = ERROR_SUCCESS; retCode == ERROR_SUCCESS; i++)
{
retCode = RegEnumKey(
hService, // handle to key to query
i, // index of subkey to query
achKey, // buffer for subkey name
MAX_PATH // size of subkey name buffer
);
if (retCode == (DWORD)ERROR_SUCCESS)
{
//What i add to get pattern Services Table.
pattern[ pattern_count ] = strdup ( achKey ) ;
pattern_count++;
}
}
CloseHandle(hService);
}
void ShowPathImage(struct hive *hdesc, int nkofs, char *path)
{
void *data;
int len,i,type;
char string[SZ_MAX+1];
type = get_val_type(hdesc, nkofs, path);
if (type == -1) {
printf("No such value <%s>\n",path);
return;
}
len = get_val_len(hdesc, nkofs, path);
if (!len) {
printf("Value <%s> has zero length\n",path);
return;
}
data = (void *)get_val_data(hdesc, nkofs, path, 0);
if (!data) {
printf("Value <%s> references NULL-pointer (bad boy!)\n",path);
abort();
return;
}
switch (type) {
case REG_SZ:
case REG_EXPAND_SZ:
case REG_MULTI_SZ:
cheap_uni2ascii(data,string,len);
for (i = 0; i < (len>>1)-1; i++) {
if (string[i] == 0) string[i] = ''\n'';
if (type == REG_SZ) break;
}
puts(string);
break;
case REG_DWORD:
printf("0x%08x",*(unsigned short *)data);
break;
default:
printf("Don''t know how to handle type yet!\n");
case REG_BINARY:
hexdump((char *)data, 0, len, 1);
}
}
void EnablePriv(LPCTSTR lpName)
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
{ printf("open process error\n");
return;
}
if ( ! LookupPrivilegeValue( NULL, lpName , &sedebugnameValue ) ){
printf("can''t find privilege error\n");
CloseHandle( hToken );
return;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof (tkp), NULL, NULL ) )
{
0
相关文章
关注我们
